mirrors/btcpayserver
1
0
Fork 0
mirror of https://github.com/btcpayserver/btcpayserver.git synced 2025-02-21 14:04:12 +01:00
Code Issues Projects Releases Packages Wiki Activity

Do not create if create API key is called on a non-existant user (Fix #4731)

Browse source
This commit is contained in:
nicolas.dorier 2023-03-03 20:30:54 +09:00
parent 9d72b9779e
commit 0406b420c8
No known key found for this signature in database
GPG key ID: 6618763EF09186FE
3 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
BTCPayServer.Tests/GreenfieldAPITests.cs
View file

@ -218,6 +218,8 @@ namespace BTCPayServer.Tests
Permissions = new Permission[] { Permission.Create(Policies.CanViewInvoices, store.Id) },
});
await AssertAPIError("user-not-found", () => unrestricted.CreateAPIKey("fewiofwuefo", new CreateApiKeyRequest()));
// Despite the grant, the user shouldn't be able to get the invoices!
newUserClient = acc.CreateClientFromAPIKey(newUserAPIKey.ApiKey);
await Assert.ThrowsAsync<GreenfieldAPIException>(() => newUserClient.GetInvoices(store.Id));

10
BTCPayServer/Controllers/GreenField/GreenfieldApiKeysController.cs
View file

@ -11,6 +11,7 @@ using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Cors;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;
using NBitcoin;
using NBitcoin.DataEncoders;
@ -66,7 +67,14 @@ namespace BTCPayServer.Controllers.Greenfield
{
Permissions = request.Permissions.Select(p => p.ToString()).Distinct().ToArray()
});
await _apiKeyRepository.CreateKey(key);
try
{
await _apiKeyRepository.CreateKey(key);
}
catch (DbUpdateException)
{
return this.CreateAPIError("user-not-found", "This user does not exists");
}
return Ok(FromModel(key));
}

1
Changelog.md
View file

@ -9,6 +9,7 @@
### Bug fix
* Avoid crash when some plugins are installed (#4725)
* Greenfield: Do not create if create API key is called on a non-existant user (Fix #4731)
### Improvements