search

fleetdm / fleet

Open device management
https://fleetdm.com
Other
5.22k stars 611 forks source link

Lock command can be sent via API to macOS host that has MDM turned on and then turned off. #30192

Open marko-lisica opened 2 weeks ago

marko-lisica commented 2 weeks ago

Fleet version: 4.69.0

💥  Actual behavior

I hit POST /api/v1/fleet/hosts/:id/lock to lock host that has MDM turned off. It was successful and lock pending badge appeared on the host details.

Image

🧑‍💻  Steps to reproduce

  1. Find a macOS host that has MDM turned off
  2. Take the host ID.
  3. Hit POST /api/v1/fleet/hosts/:id/lock
  4. Observe successful request, even though MDM is required to lock Mac

🕯️ More info (optional)

N/A

🛠️ To fix

Product designer: @marko-lisica

The user shouldn't be able to send a lock request via API to Apple hosts that have MDM turned off.

Show error if the user tries to do so. Can't lock the host because it doesn't have MDM turned on.

AndreyKizimenko commented 1 week ago

Testing notes:

Was able to initially reproduce this on 4.70 but after retesting it on 4.71 the issue appears resolved. When making a lock post request I'm getting a 422 response with a proper error message: "Can't lock the host because it doesn't have MDM turned on."

Image

Moving to Ready for release

Additional testing: