Fix: #620 Vulnerability: Any user can create a new user

decentralised-dataexchange · Feb 26, 2024 · 2154059 · 2154059
1 parent dcb2121
commit 2154059
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 2 deletions.
diff --git a/internal/http_path/v2/routes.go b/internal/http_path/v2/routes.go
@@ -134,7 +134,7 @@ func SetRoutes(r *mux.Router, e *casbin.Enforcer, testMode bool) {
 
 	// Individual related api(s)
 	wrapper(ServiceReadIndividual, m.Chain(serviceIndividualHandler.ServiceReadIndividual, m.Logger(), m.ValidateIndividualId(), m.Authorize(e), m.SetApplicationMode(), m.ValidateAPIKey(), m.Authenticate(), m.AddContentType())).Methods("GET")
-	wrapper(ServiceCreateIndividual, m.Chain(serviceIndividualHandler.ServiceCreateIndividual, m.Logger(), m.ValidateIndividualId(), m.SetApplicationMode(), m.ValidateAPIKey(), m.Authenticate(), m.AddContentType())).Methods("POST")
+	wrapper(ServiceCreateIndividual, m.Chain(serviceIndividualHandler.ServiceCreateIndividual, m.Logger(), m.ValidateIndividualId(), m.Authorize(e), m.SetApplicationMode(), m.ValidateAPIKey(), m.Authenticate(), m.AddContentType())).Methods("POST")
 	wrapper(ServiceUpdateIndividual, m.Chain(serviceIndividualHandler.ServiceUpdateIndividual, m.Logger(), m.ValidateIndividualId(), m.Authorize(e), m.SetApplicationMode(), m.ValidateAPIKey(), m.Authenticate(), m.AddContentType())).Methods("PUT")
 	wrapper(ServiceListIndividuals, m.Chain(serviceIndividualHandler.ServiceListIndividuals, m.Logger(), m.ValidateIndividualId(), m.Authorize(e), m.SetApplicationMode(), m.ValidateAPIKey(), m.Authenticate(), m.AddContentType())).Methods("GET")
 

diff --git a/internal/rbac/rbac.go b/internal/rbac/rbac.go
@@ -81,7 +81,6 @@ func GetRbacPolicies(testMode bool) [][]string {
 		{"user", "/service/organisation/coverimage", "GET"},
 		{"user", "/service/organisation/logoimage", "GET"},
 		{"user", "/service/individuals", "GET"},
-		{"user", "/service/individual", "POST"},
 		{"user", "/service/individual/{individualId}", "(GET)|(PUT)"},
 		{"user", "/service/image/{imageId}", "GET"},
 		{"user", "/service/individual/record", "DELETE"},