Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Re-Activating account when local passwords are disabled #9587

Merged
merged 2 commits into from
Mar 11, 2021
Merged

Re-Activating account when local passwords are disabled #9587

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6543e8a
Re-Activating account when local passwords are disabled
dklimpel Mar 10, 2021
b494b17
add changelog
dklimpel Mar 10, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/9587.bugfix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Re-Activating account with admin API when local passwords are disabled.
5 changes: 4 additions & 1 deletion synapse/rest/admin/users.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -269,7 +269,10 @@ async def on_PUT(
target_user.to_string(), False, requester, by_admin=True
)
elif not deactivate and user["deactivated"]:
if "password" not in body:
if (
"password" not in body
and self.hs.config.password_localdb_enabled
Comment on lines +273 to +274
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure this will catch all the instances of this, would it make more sense to check if there's a mapping from SSO auth provider to this user?

In particular, I think many admins run with passwords completely disabled, and not specifically the localdb passwords disabled.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO this not the best solution. But this is like set_password is implemented.

synapse/synapse/handlers/set_password.py

Lines 37 to 45 in 1baab20

async def set_password(
self,
user_id: str,
password_hash: str,
logout_devices: bool,
requester: Optional[Requester] = None,
) -> None:
if not self.hs.config.password_localdb_enabled:
raise SynapseError(403, "Password change disabled", errcode=Codes.FORBIDDEN)

To improve it, we have also change the check in set_password.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After further conversation in #synapse-dev:matrix.org, I suspect that this should check self.hs.config.password_enabled and self.hs.config.password_localdb_enabled since that is the only time it makes sense to set a password.

):
raise SynapseError(
400, "Must provide a password to re-activate an account."
)
Expand Down