Commit Graph

9 Commits

Author SHA1 Message Date
Tony Murray
35406b4b32 Fix some issues with admin self settings (#15332)
Don't require old password when not settings password
Show old password field for user's own user
2023-09-18 14:35:12 -05:00
Tony Murray
2cd207028a Implement RBAC (only built in roles) (#15212)
* Install bouncer

* Seeder and level migration

* Display and edit roles

* remove unused deluser page

* Update Radius and SSO to assign roles

* update AlertUtil direct level check to use roles instead

* rewrite ircbot auth handling

* Remove legacy auth getUserlist and getUserlevel methods, add getRoles
Set roles in LegacyUserProvider

* Small cleanups

* centralize role sync code
show roles on user preferences page

* VueSelect component WIP and a little docs

* WIP

* SelectControllers id and text fields.

* LibrenmsSelect component extracted from SettingSelectDynamic

* Handle multiple selections

* allow type coercion

* full width settings

* final style adjustments

* Final compiled assets update

* Style fixes

* Fix SSO tests

* Lint cleanups

* small style fix

* don't use json yet

* Update baseline for usptream package issues

* Change schema, not 100% sure it is correct
not sure why xor doesn't work
2023-08-28 00:13:40 -05:00
Jellyfrog
b14e2d4609 Apply fixes from StyleCI (#15101)
Co-authored-by: StyleCI Bot <bot@styleci.io>
2023-06-13 13:35:00 +02:00
Jellyfrog
2b3575a5e9 Laravel 10.x Shift (#14995)
* Apply code style

* Remove explicit call to register policies

* Shift core files

* Shift config files

* Default config files

In an effort to make upgrading the constantly changing config files
easier, Shift defaulted them and merged your true customizations -
where ENV variables may not be used.

* Bump Laravel dependencies

* Add type hints for Laravel 10

* Shift cleanup

* wip

* wip

* sync translation

* Sync back config

* Public Path Binding

* QueryException

* monolog

* db::raw

* monolog

* db::raw

* fix larastan collections

* fix phpstan bug looping forever

* larastan errors

* larastan: fix column type

* styleci

* initialize array

* fixes

* fixes

---------

Co-authored-by: Shift <shift@laravelshift.com>
2023-05-24 22:21:54 +02:00
Tony Murray
09a2977adb Fix authentication mass assignment vulnerability (#14468)
Users were able to submit changes to fields they should not have access to change by bypassing the frontend validation.  Correct backend validation to prevent that.
2022-10-17 12:11:14 -05:00
Jellyfrog
77c531527c Apply fixes from StyleCI (#12117)
* Apply fixes from StyleCI

* Disable style check
2020-09-21 14:54:51 +02:00
Tony Murray
2441096015 Fix html injection in user fields (#10535)
validate realname and descr to alpha/numeric/spaces only
This flaw is actually in bootgrid, the html isn't interpreted until bootgrid loads.
2019-08-21 20:36:22 -05:00
Tony Murray
90a67c2ece User configurable locale (language) (#10204)
* Support for system APP_LOCALE

* Start preferences re-write

* port 2fa form

* Working user preferences

* Language user preference

* Don't look up locale from the DB every request

* Device list working

* Deny demo user middleware

* Finish password changing

* remove used resource methods

* remove leftover use

* warn that translation is incomplete

* fix style
2019-05-23 10:05:45 -05:00
Tony Murray
6e6e54cb98 New User Management (#9348)
* Rewrite user management.

Error management

Revert edituser legacy page

Connect user permissions button to legacy page for now.

Implement user creation
Refine form

Remove PingCheck.php accidental add :)

Fixes for redirection and deletion

More fixes: realname accidental validation setting, hide can modify for read-only auths

Use a panel to improve style

Add icon to panel-title

Not allowed to delete own user (at least via the click of a button)

Use request validation to reduce complexity of controller.
Improve protection against users doing things they should not.

Switch to horizontal form and not nearly as wide of layout :)

delete without refresh.
Fix for buttons

Include all users (not just from this auth)
Hide the auth column if there is only one auth type

Show username if real name isn't set

Don't allow creation of demo users via the webui

a fix to the lnms user:add command, it didn't set auth_id

update edituser.inc.php to current
just redirect to users page

* Remove TwoFactorTest for now

* Update edituser.inc.php

* Update .env.dusk.testing

* Enable 2fa for 2fa test...
2019-04-22 19:01:39 -05:00