babelouest / glewlwyd

Experimental Single Sign On server, OAuth2, Openid Connect, multiple factor authentication with, HOTP/TOTP, FIDO2, TLS Certificates, etc. extensible via plugins
https://babelouest.github.io/glewlwyd
Other
430 stars 80 forks source link

[Issue] Register plugin: Add/save configuration errors #217

Open roquie opened 1 year ago

roquie commented 1 year ago

Describe the issue When saving configuration I always getting an error:

["verification-code-length is mandatory and must be a positive integer"]

because frontend app sends string, not positive-int.

Request 1 sample (200):

curl 'https://example.com/api/mod/plugin/default' \
  -X 'PUT' \
  -H 'authority: example.com' \
  -H 'accept: */*' \
  -H 'accept-language: en-US,en;q=0.9,ru;q=0.8' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json; charset=UTF-8' \
  -H 'cookie: G_SESSION_ID=<redacted>' \
  -H 'dnt: 1' \
  -H 'origin: https://example.com' \
  -H 'pragma: no-cache' \
  -H 'sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "macOS"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: same-origin' \
  -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36' \
  -H 'x-requested-with: XMLHttpRequest' \
  --data-raw '{"module":"register","name":"default","display_name":"default","parameters":{"registration":true,"verification-code-length":"8","verification-code-duration":600,"host":"smtp.sendgrid.net","port":581,"verify-email":true,"email-is-username":true,"scope":["profile","openid"],"set-password":"always","schemes":[],"session-key":"G_REGISTER_SESSION","session-duration":3600,"subject":"Confirm registration","content-type":"text/plain; charset=utf-8","from":"noreply@example.com","templates":{"en-US":{"subject":"Confirm registration","body-pattern":"The code is {CODE}\n\nhttps://example.com//profile.html?register=<your_registration_plugin_name>&token={TOKEN}","defaultLang":true}},"update-email":false,"update-email-content-type":"text/plain; charset=utf-8","templatesUpdateEmail":{"en-US":{"subject":"Update e-mail address","body-pattern":"Click on the following link: https://example.com//profile.html?updateEmail=<your_registration_plugin_name>&token={TOKEN}","defaultLang":true}},"update-email-token-duration":600,"update-email-from":"","reset-credentials":true,"reset-credentials-session-key":"G_CREDENTIALS_SESSION","reset-credentials-session-duration":3600,"reset-credentials-email":true,"reset-credentials-content-type":"text/plain; charset=utf-8","templatesResetCredentials":{"en-US":{"subject":"Lost credentials","body-pattern":"Click on the following link: https://example.com//profile.html?resetCredentials=<your_registration_plugin_name>&token={TOKEN}","defaultLang":true}},"reset-credentials-token-duration":600,"reset-credentials-from":"noreply@spacetab.io","reset-credentials-code":false,"reset-credentials-code-list-size":4,"reset-credentials-code-property":"reset-credentials-code","use-tls":true,"check-certificate":true,"user":"apikey","password":"<redacted>","user-lang-property":"lang"},"enabled":true}' \
  --compressed

Request 2 sample (500):

curl 'https://example.com/api/mod/plugin/default/reset/' \
  -X 'PUT' \
  -H 'authority: example.com' \
  -H 'accept: */*' \
  -H 'accept-language: en-US,en;q=0.9,ru;q=0.8' \
  -H 'cache-control: no-cache' \
  -H 'content-length: 0' \
  -H 'cookie: G_SESSION_ID=<redacted>' \
  -H 'dnt: 1' \
  -H 'origin: https://example.com' \
  -H 'pragma: no-cache' \
  -H 'sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "macOS"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: same-origin' \
  -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36' \
  -H 'x-requested-with: XMLHttpRequest' \
  --compressed

To Reproduce

Expected behavior Normal working.

Screenshots

Click me Screenshot 2023-07-25 at 14 25 35

System (please complete the following information):

Additional context Add any other context about the problem here.

babelouest commented 1 year ago

Hello,

If you update a plugin with incorrect parameters, the plugin reset should fail, therefore the plugin will not be available to the user. And the plugin parameter verification code in very strict with the expected types, so if you pass a string instead of an integer, the plugin won't start.

(optional, second issue) When username is email, if I type not email (username for example) frontend app sends a infinity requests to backend in a loop;

Thanks, this has been fixed in https://github.com/babelouest/glewlwyd/commit/c34ab889984590f33332ad6910cb2fa4d4db4bb9