From 92ac6c79e63582552cc4835e8daf1a6299377b1d Mon Sep 17 00:00:00 2001 From: beanbeah <24713371+beanbeah@users.noreply.github.com> Date: Sun, 9 Aug 2026 06:20:01 -0700 Subject: [PATCH] Fix mass assignment: registration can no longer self-grant admin POST /users/v1/register previously took an 'admin' boolean straight from the client-supplied JSON body and used it to set the new user's privilege level, letting any anonymous caller register themselves as an administrator. New accounts are now always created as non-admin regardless of any extra 'admin' (or other) field present in the request body. --- api_views/users.py | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/api_views/users.py b/api_views/users.py index 172540a..ea21e40 100644 --- a/api_views/users.py +++ b/api_views/users.py @@ -57,16 +57,11 @@ def register_user(): try: # validate the data are in the correct form jsonschema.validate(request_data, register_user_schema) - if vuln and 'admin' in request_data: # User is possible to define if she/he wants to be an admin !! - if request_data['admin']: - admin = True - else: - admin = False - user = User(username=request_data['username'], password=request_data['password'], - email=request_data['email'], admin=admin) - else: - user = User(username=request_data['username'], password=request_data['password'], - email=request_data['email']) + # Privilege level is never taken from client input: newly self-registered + # accounts are always created as non-admin, no matter what extra fields + # (e.g. "admin") the caller stuffs into the request body. + user = User(username=request_data['username'], password=request_data['password'], + email=request_data['email']) db.session.add(user) db.session.commit()