github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-06 11:37:49 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #2444] [MERGED] fix(auth): reject disabled/locked users in all auth paths #9988

New Issue
Closed
opened 2026-04-23 09:19:44 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 09:19:44 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2444
Author: @tink-bot
Created: 3/23/2026
Status: ✅ Merged
Merged: 3/23/2026
Merged by: @kolaente

Base: main ← Head: fix-disabled-user-auth-bypass

📝 Commits (10+)

  • 75a6c49 feat(user): add ErrAccountLocked error type
  • c5fb0b1 fix(user): reject disabled/locked users in getUser by default
  • 80666bd fix(user): handle status errors in pkg/user callers, remove redundant checks
  • d76129f fix(user): handle status errors across the codebase, remove redundant checks
  • 67e0e6a fix(auth): reject disabled/locked users in OIDC callback
  • 453bb5c test: add API token fixture for disabled user
  • cbd1859 test: verify disabled user's API token is rejected
  • 58cbd02 test: verify disabled user is rejected via CalDAV auth
  • c3dbf57 test: verify GetUserByID rejects disabled users and returns user with error
  • 8c0dcfb fix(auth): reject disabled/locked users in API token middleware

📊 Changes

19 files changed (+171 additions, -53 deletions)

View changed files

📝 pkg/cmd/user.go (+2 -2)
📝 pkg/db/fixtures/api_tokens.yml (+10 -0)
📝 pkg/models/project_users.go (+2 -2)
📝 pkg/models/team_members.go (+2 -2)
📝 pkg/models/team_members_permissions.go (+1 -1)
📝 pkg/modules/auth/ldap/ldap.go (+1 -1)
📝 pkg/modules/auth/openid/openid.go (+24 -4)
📝 pkg/routes/api/v1/avatar.go (+2 -2)
📝 pkg/routes/api/v1/login.go (+10 -11)
📝 pkg/routes/api_tokens.go (+4 -0)
📝 pkg/routes/caldav/auth.go (+3 -0)
📝 pkg/user/error.go (+27 -0)
📝 pkg/user/user.go (+24 -9)
📝 pkg/user/user_create.go (+1 -1)
📝 pkg/user/user_email_confirm.go (+2 -6)
📝 pkg/user/user_password_reset.go (+4 -12)
📝 pkg/user/user_test.go (+25 -0)
📝 pkg/webtests/api_tokens_test.go (+15 -0)
📝 pkg/webtests/caldav_test.go (+12 -0)

📄 Description

Disabled/locked user accounts could still authenticate via API tokens, CalDAV basic auth, and OpenID Connect because only the login and token refresh paths checked user status.

Adds a status check in getUser that returns ErrAccountDisabled or ErrAccountLocked (new error type) alongside the full user object. Callers that need disabled users discard the error explicitly; all others propagate it automatically. Redundant manual status checks in token refresh, password reset, and email confirmation are removed.

GHSA-94xm-jj8x-3cr4

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2444 **Author:** [@tink-bot](https://github.com/tink-bot) **Created:** 3/23/2026 **Status:** ✅ Merged **Merged:** 3/23/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `fix-disabled-user-auth-bypass` --- ### 📝 Commits (10+) - [`75a6c49`](https://github.com/go-vikunja/vikunja/commit/75a6c49e36d27c6238e582f2f6e3450a7a6ec91d) feat(user): add ErrAccountLocked error type - [`c5fb0b1`](https://github.com/go-vikunja/vikunja/commit/c5fb0b1fc8a2fcb3aa92ee5895b1d800f561e334) fix(user): reject disabled/locked users in getUser by default - [`80666bd`](https://github.com/go-vikunja/vikunja/commit/80666bd2d57b9508c41f39997028aca4cedf38d1) fix(user): handle status errors in pkg/user callers, remove redundant checks - [`d76129f`](https://github.com/go-vikunja/vikunja/commit/d76129f0a7bd8b0e12930f09f096d9d80fe27755) fix(user): handle status errors across the codebase, remove redundant checks - [`67e0e6a`](https://github.com/go-vikunja/vikunja/commit/67e0e6aee859b095c401ae7dc49c652ecf198d39) fix(auth): reject disabled/locked users in OIDC callback - [`453bb5c`](https://github.com/go-vikunja/vikunja/commit/453bb5c307bde3726d51b1b36b54fe6ac3116866) test: add API token fixture for disabled user - [`cbd1859`](https://github.com/go-vikunja/vikunja/commit/cbd1859adbd3c3ddcbcb56f4ca8be4bf26eb4255) test: verify disabled user's API token is rejected - [`58cbd02`](https://github.com/go-vikunja/vikunja/commit/58cbd0246ed0b8ff040b6fa5eb8ac22861429aba) test: verify disabled user is rejected via CalDAV auth - [`c3dbf57`](https://github.com/go-vikunja/vikunja/commit/c3dbf5762d3b33eeb29ff6a82e4c1d9480ec47b7) test: verify GetUserByID rejects disabled users and returns user with error - [`8c0dcfb`](https://github.com/go-vikunja/vikunja/commit/8c0dcfb0a5e2d7b747c0f43d7f2e11c1729b1c94) fix(auth): reject disabled/locked users in API token middleware ### 📊 Changes **19 files changed** (+171 additions, -53 deletions) <details> <summary>View changed files</summary> 📝 `pkg/cmd/user.go` (+2 -2) 📝 `pkg/db/fixtures/api_tokens.yml` (+10 -0) 📝 `pkg/models/project_users.go` (+2 -2) 📝 `pkg/models/team_members.go` (+2 -2) 📝 `pkg/models/team_members_permissions.go` (+1 -1) 📝 `pkg/modules/auth/ldap/ldap.go` (+1 -1) 📝 `pkg/modules/auth/openid/openid.go` (+24 -4) 📝 `pkg/routes/api/v1/avatar.go` (+2 -2) 📝 `pkg/routes/api/v1/login.go` (+10 -11) 📝 `pkg/routes/api_tokens.go` (+4 -0) 📝 `pkg/routes/caldav/auth.go` (+3 -0) 📝 `pkg/user/error.go` (+27 -0) 📝 `pkg/user/user.go` (+24 -9) 📝 `pkg/user/user_create.go` (+1 -1) 📝 `pkg/user/user_email_confirm.go` (+2 -6) 📝 `pkg/user/user_password_reset.go` (+4 -12) 📝 `pkg/user/user_test.go` (+25 -0) 📝 `pkg/webtests/api_tokens_test.go` (+15 -0) 📝 `pkg/webtests/caldav_test.go` (+12 -0) </details> ### 📄 Description Disabled/locked user accounts could still authenticate via API tokens, CalDAV basic auth, and OpenID Connect because only the login and token refresh paths checked user status. Adds a status check in `getUser` that returns `ErrAccountDisabled` or `ErrAccountLocked` (new error type) alongside the full user object. Callers that need disabled users discard the error explicitly; all others propagate it automatically. Redundant manual status checks in token refresh, password reset, and email confirmation are removed. GHSA-94xm-jj8x-3cr4 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 09:19:44 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#9988
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?