Prevent VAmPI unauthorized password changes

api_views/users.py

@@ -183,17 +183,9 @@ def update_password(username):
         return Response(error_message_helper(resp), 401, mimetype="application/json")
     else:
         if request_data.get('password'):
-            if vuln:  # Unauthorized update of password of another user
-                user = User.query.filter_by(username=username).first()
-                if user:
-                    user.password = request_data.get('password')
-                    db.session.commit()
-                else:
-                    return Response(error_message_helper("User Not Found"), 400, mimetype="application/json")
-            else:
-                user = User.query.filter_by(username=resp['sub']).first()
-                user.password = request_data.get('password')
-                db.session.commit()
+            user = User.query.filter_by(username=resp['sub']).first()
+            user.password = request_data.get('password')
+            db.session.commit()
             responseObject = {
                 'status': 'success',
                 'Password': 'Updated.'

tests/test_password_change.py

@@ -0,0 +1,8 @@
+from pathlib import Path
+
+
+def test_password_change_uses_authenticated_subject():
+    source = Path("api_views/users.py").read_text()
+    section = source[source.index("def update_password"):source.index("def delete_user")]
+    assert "User.query.filter_by(username=resp['sub'])" in section
+    assert "if vuln:  # Unauthorized update" not in section