Prevent VAmPI admin self-registration

api_views/users.py

@@ -57,16 +57,9 @@ def register_user():
         try:
             # validate the data are in the correct form
             jsonschema.validate(request_data, register_user_schema)
-            if vuln and 'admin' in request_data:  # User is possible to define if she/he wants to be an admin !!
-                if request_data['admin']:
-                    admin = True
-                else:
-                    admin = False
-                user = User(username=request_data['username'], password=request_data['password'],
-                            email=request_data['email'], admin=admin)
-            else:
-                user = User(username=request_data['username'], password=request_data['password'],
-                            email=request_data['email'])
+            # Registration must never allow clients to assign administrative privileges.
+            user = User(username=request_data['username'], password=request_data['password'],
+                        email=request_data['email'], admin=False)
             db.session.add(user)
             db.session.commit()
 

tests/test_registration.py

@@ -0,0 +1,8 @@
+from pathlib import Path
+
+
+def test_registration_does_not_honor_client_admin_field():
+    source = Path("api_views/users.py").read_text()
+    section = source[source.index("def register_user"):source.index("def login_user")]
+    assert "admin=False" in section
+    assert "request_data['admin']" not in section