From 4dba821b737da99f36fad3c71b3f6d8f0e4a3bd7 Mon Sep 17 00:00:00 2001 From: Toby Moreno Date: Sat, 8 Aug 2026 22:47:33 -0700 Subject: [PATCH] Prevent VAmPI admin self-registration Ignore client-supplied administrative fields during registration and always create regular users. Add focused regression coverage for the privilege-assignment boundary. Signed-off-by: Toby Moreno --- api_views/users.py | 13 +++---------- tests/test_registration.py | 8 ++++++++ 2 files changed, 11 insertions(+), 10 deletions(-) create mode 100644 tests/test_registration.py diff --git a/api_views/users.py b/api_views/users.py index 172540a..0fb25be 100644 --- a/api_views/users.py +++ b/api_views/users.py @@ -57,16 +57,9 @@ def register_user(): try: # validate the data are in the correct form jsonschema.validate(request_data, register_user_schema) - if vuln and 'admin' in request_data: # User is possible to define if she/he wants to be an admin !! - if request_data['admin']: - admin = True - else: - admin = False - user = User(username=request_data['username'], password=request_data['password'], - email=request_data['email'], admin=admin) - else: - user = User(username=request_data['username'], password=request_data['password'], - email=request_data['email']) + # Registration must never allow clients to assign administrative privileges. + user = User(username=request_data['username'], password=request_data['password'], + email=request_data['email'], admin=False) db.session.add(user) db.session.commit() diff --git a/tests/test_registration.py b/tests/test_registration.py new file mode 100644 index 0000000..ac9e6e3 --- /dev/null +++ b/tests/test_registration.py @@ -0,0 +1,8 @@ +from pathlib import Path + + +def test_registration_does_not_honor_client_admin_field(): + source = Path("api_views/users.py").read_text() + section = source[source.index("def register_user"):source.index("def login_user")] + assert "admin=False" in section + assert "request_data['admin']" not in section