CVE-2023-1542: Insufficient Information (NVD-CWE-noinfo)
value: Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.4
Published: 2023-03-21T05:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: i18n/en_US.yaml, internal/base/reason/reason.go, internal/controller_admin/user_backyard_controller.go, internal/schema/backyard_user_schema.go, internal/service/user_admin/user_backyard.go
Commit date: 2023-02-23 11:44:05 +0800
Commit message: fix(admin): add restriction about admin modify their status

Diff: diff --git a/i18n/en_US.yaml b/i18n/en_US.yaml
index 237d410c9..dd1169a53 100644
--- a/i18n/en_US.yaml
+++ b/i18n/en_US.yaml
@@ -35,10 +35,12 @@ backend:
     other: Email and password do not match.
   error:
     admin:
       cannot_update_their_password:
         other: You cannot modify your password.
+      cannot_modify_self_status:
+        other: You cannot modify your status.
       email_or_password_wrong:
         other: Email and password do not match.
     answer:
       not_found:
         other: Answer do not found.
diff --git a/internal/base/reason/reason.go b/internal/base/reason/reason.go
index 86b448d91..83b85ab0b 100644
--- a/internal/base/reason/reason.go
+++ b/internal/base/reason/reason.go
@@ -63,6 +63,7 @@ const (
 	UserCannotUpdateYourRole         = "error.user.cannot_update_your_role"
 	TagCannotSetSynonymAsItself      = "error.tag.cannot_set_synonym_as_itself"
 	NotAllowedRegistration           = "error.user.not_allowed_registration"
 	SMTPConfigFromNameCannotBeEmail  = "error.smtp.config_from_name_cannot_be_email"
 	AdminCannotUpdateTheirPassword   = "error.admin.cannot_update_their_password"
+	AdminCannotModifySelfStatus      = "error.admin.cannot_modify_self_status"
 )
diff --git a/internal/controller_admin/user_backyard_controller.go b/internal/controller_admin/user_backyard_controller.go
index 848319b5a..eaa06f736 100644
--- a/internal/controller_admin/user_backyard_controller.go
+++ b/internal/controller_admin/user_backyard_controller.go
@@ -32,10 +32,12 @@ func (uc *UserAdminController) UpdateUserStatus(ctx *gin.Context) {
 	req := &schema.UpdateUserStatusReq{}
 	if handler.BindAndCheck(ctx, req) {
 		return
 	}
 
+	req.LoginUserID = middleware.GetLoginUserIDFromContext(ctx)
+
 	err := uc.userService.UpdateUserStatus(ctx, req)
 	handler.HandleResponse(ctx, err, nil)
 }
 
 // UpdateUserRole update user role
diff --git a/internal/schema/backyard_user_schema.go b/internal/schema/backyard_user_schema.go
index 57f3f1836..995f0187e 100644
--- a/internal/schema/backyard_user_schema.go
+++ b/internal/schema/backyard_user_schema.go
@@ -1,13 +1,12 @@
 package schema
 
 // UpdateUserStatusReq update user request
 type UpdateUserStatusReq struct {
-	// user id
-	UserID string `validate:"required" json:"user_id"`
-	// user status
-	Status string `validate:"required,oneof=normal suspended deleted inactive" json:"status" enums:"normal,suspended,deleted,inactive"`
+	UserID      string `validate:"required" json:"user_id"`
+	Status      string `validate:"required,oneof=normal suspended deleted inactive" json:"status" enums:"normal,suspended,deleted,inactive"`
+	LoginUserID string `json:"-"`
 }
 
 const (
 	UserNormal    = "normal"
 	UserSuspended = "suspended"
diff --git a/internal/service/user_admin/user_backyard.go b/internal/service/user_admin/user_backyard.go
index 5712610d2..76d358592 100644
--- a/internal/service/user_admin/user_backyard.go
+++ b/internal/service/user_admin/user_backyard.go
@@ -59,10 +59,14 @@ func NewUserAdminService(
 	}
 }
 
 // UpdateUserStatus update user
 func (us *UserAdminService) UpdateUserStatus(ctx context.Context, req *schema.UpdateUserStatusReq) (err error) {
+	// Admin cannot modify their status
+	if req.UserID == req.LoginUserID {
+		return errors.BadRequest(reason.AdminCannotModifySelfStatus)
+	}
 	userInfo, exist, err := us.userRepo.GetUserInfo(ctx, req.UserID)
 	if err != nil {
 		return
 	}
 	if !exist {

Vulnerable code: 	// user id
	UserID string `validate:"required" json:"user_id"`
	// user status
	Status string `validate:"required,oneof=normal suspended deleted inactive" json:"status" enums:"normal,suspended,deleted,inactive"`
Fixed code:       cannot_modify_self_status:
        other: You cannot modify your status.
	AdminCannotModifySelfStatus      = "error.admin.cannot_modify_self_status"
	req.LoginUserID = middleware.GetLoginUserIDFromContext(ctx)

	UserID      string `validate:"required" json:"user_id"`
	Status      string `validate:"required,oneof=normal suspended deleted inactive" json:"status" enums:"normal,suspended,deleted,inactive"`
	LoginUserID string `json:"-"`
	// Admin cannot modify their status
	if req.UserID == req.LoginUserID {
		return errors.BadRequest(reason.AdminCannotModifySelfStatus)
	}