fix(admin): check username for updating consumer

apisix/admin/consumers.lua

@@ -25,7 +25,7 @@ local _M = {
 }
 
 
-local function check_conf(conf)
+local function check_conf(username, conf)
     -- core.log.error(core.json.encode(conf))
     if not conf then
         return nil, {error_msg = "missing configurations"}
@@ -38,6 +38,10 @@ local function check_conf(conf)
         return nil, {error_msg = "invalid configuration: " .. err}
     end
 
+    if username and username ~= conf.username then
+        return nil, {error_msg = "wrong username" }
+    end
+
     if conf.plugins then
         ok, err = plugins.check_schema(conf.plugins, core.schema.TYPE_CONSUMER)
         if not ok then
@@ -61,8 +65,8 @@ local function check_conf(conf)
 end
 
 
-function _M.put(_, conf)
-    local consumer_name, err = check_conf(conf)
+function _M.put(username, conf)
+    local consumer_name, err = check_conf(username, conf)
     if not consumer_name then
         return 400, err
     end

t/admin/consumers2.t

@@ -151,3 +151,32 @@ __DATA__
     }
 --- response_body
 {"action":"get","count":0,"node":{"dir":true,"key":"/apisix/consumers","nodes":{}}}
+
+
+
+=== TEST 5: mismatched username, PUT
+--- config
+    location /t {
+        content_by_lua_block {
+            local json = require("toolkit.json")
+            local t = require("lib.test_admin").test
+
+            local code, message, res = t('/apisix/admin/consumers/jack1',
+                ngx.HTTP_PUT,
+                [[{
+                     "username":"jack"
+                }]]
+            )
+
+            ngx.status = code
+            if code >= 300 and code ~= 400 then
+                ngx.say(message)
+                return
+            end
+
+            ngx.say(message)
+        }
+    }
+--- error_code: 400
+--- response_body
+{"error_msg":"wrong username"}