Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[AC-1654] idor allow the attacker to disable any one scim provising #3325

Merged
merged 2 commits into from
Oct 18, 2023

Conversation

r-tome
Copy link
Contributor

@r-tome r-tome commented Oct 5, 2023

Type of change

- [X] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Fix a reported defect re: disable organization scim provisioning.

Code changes

  • src/Api/Controllers/OrganizationConnectionsController.cs: Using new method to get connection matching both Id and OrganizationId
  • src/Core/Repositories/IOrganizationConnectionRepository.cs: Added new method to get connection matching both Id and OrganizationId
  • src/Infrastructure.Dapper/Repositories/OrganizationConnectionRepository.cs: Dapper implementation
  • src/Infrastructure.EntityFramework/Repositories/OrganizationConnectionRepository.cs: EF implementation
  • src/Sql/dbo/Stored Procedures/OrganizationConnection_ReadByIdOrganizationId.sql: Stored procedure SQL script
  • util/Migrator/DbScripts/2023-10-05_00_OrgConnectionsReadByIdOrgId.sql: SQL migration script
  • test/Api.Test/Controllers/OrganizationConnectionsControllerTests.cs: Updated unit tests

Before you submit

  • Please check for formatting errors (dotnet format --verify-no-changes) (required)
  • If making database changes - make sure you also update Entity Framework queries and/or migrations
  • Please add unit tests where it makes sense to do so (encouraged but not required)
  • If this change requires a documentation update - notify the documentation team
  • If this change has particular deployment requirements - notify the DevOps team

r-tome added 2 commits October 5, 2023 16:31
…IdAsync and modified OrganizationConnectionsController to use it to get a connection matching both Id and OrganizationId
@r-tome r-tome requested review from a team and vincentsalucci October 5, 2023 15:50
@r-tome r-tome marked this pull request as ready for review October 5, 2023 15:51
@bitwarden-bot
Copy link

Logo
Checkmarx One – Scan Summary & Details361dabb0-eb36-4a3d-94c8-9c1cbde2b66d

No New Or Fixed Issues Found

@r-tome r-tome merged commit cb73056 into master Oct 18, 2023
@r-tome r-tome deleted the ac/ac-1654/idor-disable-scim-provising branch October 18, 2023 10:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants