Repository: CVEProject/cve-services
Pull request #534 (2021-12-09 17:32:00)

Keep Org Admins from changing user's org.


Patch:
diff --git a/src/controller/org.controller/error.js b/src/controller/org.controller/error.js
index 822a4208..10538daf 100644
--- a/src/controller/org.controller/error.js
+++ b/src/controller/org.controller/error.js
@@ -22,6 +22,13 @@ class OrgControllerError extends idrErr.IDRError {
     return err
   }
 
+  notAllowedToChangeOrganization () {
+    const err = {}
+    err.error = 'NOT_ALLOWED_TO_CHANGE_ORGANIZATION'
+    err.message = 'Only the Secretariat can change the organization for a user.'
+    return err
+  }
+
   orgExists (shortname) { // org
     const err = {}
     err.error = 'ORG_EXISTS'
diff --git a/src/controller/org.controller/org.controller.js b/src/controller/org.controller/org.controller.js
index 0673f06b..b294d495 100644
--- a/src/controller/org.controller/org.controller.js
+++ b/src/controller/org.controller/org.controller.js
@@ -501,6 +501,10 @@ async function updateUser (req, res, next) {
       } else if (key === 'org_shortname') {
         newOrgShortName = req.ctx.query.org_shortname
         changesRequirePrivilegedRole = true
+        if (!isSecretariat) {
+          logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + requesterUsername + ' is an Org Admin and tried to reassign the organization.' })
+          return res.status(403).json(error.notAllowedToChangeOrganization())
+        }
       } else if (key === 'name.first') {
         newUser.name.first = req.ctx.query['name.first']
       } else if (key === 'name.last') {


Test patch:
diff --git a/test/unit-tests/user/userUpdateTest.js b/test/unit-tests/user/userUpdateTest.js
index d67c6f61..3493205d 100644
--- a/test/unit-tests/user/userUpdateTest.js
+++ b/test/unit-tests/user/userUpdateTest.js
@@ -277,6 +277,54 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
         })
     })
 
+    it('User is not updated because Org Admin is trying to change organization', (done) => {
+      class Org {
+        async getOrgUUID () {
+          return userFixtures.existentOrg.UUID
+        }
+
+        async isSecretariat () {
+          return false
+        }
+      }
+
+      class User {
+        async findOneByUserNameAndOrgUUID () {
+          return userFixtures.existentUser
+        }
+
+        async isAdmin () {
+          return true
+        }
+      }
+
+      app.route('/user-not-updated-admin-changing-org/:shortname/:username')
+        .put((req, res, next) => {
+          const factory = {
+            getOrgRepository: () => { return new Org() },
+            getUserRepository: () => { return new User() }
+          }
+          req.ctx.repositories = factory
+          next()
+        }, orgParams.parsePostParams, orgController.USER_UPDATE_SINGLE)
+
+      chai.request(app)
+        .put(`/user-not-updated-admin-changing-org/${userFixtures.existentOrgDummy.short_name}/${userFixtures.userA.username}?org_shortname=${userFixtures.existentOrgDummy.short_name}`)
+        .set(userFixtures.userDHeader)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(403)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          const errObj = error.notAllowedToChangeOrganization()
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
+          done()
+        })
+    })
+
     it('User is not updated because requestor is Org Admin of different organization', (done) => {
       class Org {
         async getOrgUUID () {