Skip to content

Commit 77132c6

Browse files
committed
fix: revert SetPassword disable, restore with admin auth
1. Restore SetPassword DBus method implementation, as it is used by dde-control-center when creating new users 2. Require polkitActionUserAdministration authentication to prevent unauthorized password changes 3. Keep the chpasswd injection guard in ModifyPasswd Log: SetPassword DBus method is restored for new user creation Influence: 1. creating a new user via control center should set password successfully 2. non-admin user calling SetPassword should still be denied PMS: TASK-390039 fix: 恢复 SetPassword 接口,保留管理员鉴权 1. 恢复 SetPassword DBus 方法实现,因为控制中心创建新用户 时需要调用该接口 2. 要求 polkitActionUserAdministration 鉴权,防止未授权 修改密码 3. 保留 ModifyPasswd 中的 chpasswd 注入防护 Log: SetPassword DBus 方法已恢复,用于新用户创建场景 Influence: 1. 通过控制中心创建新用户时应能成功设置密码 2. 非管理员用户调用 SetPassword 仍应被拒绝
1 parent 6741354 commit 77132c6

1 file changed

Lines changed: 49 additions & 1 deletion

File tree

accounts1/user_ifc.go

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,55 @@ func (u *User) SetShell(sender dbus.Sender, shell string) *dbus.Error {
116116
}
117117

118118
func (u *User) SetPassword(sender dbus.Sender, password string) *dbus.Error {
119-
return dbusutil.ToError(fmt.Errorf("SetPassword is deprecated and no longer supported"))
119+
logger.Debug("[SetPassword] start ...")
120+
121+
// set password from UnionID
122+
if password == "" {
123+
return nil
124+
}
125+
126+
err := u.checkAuth(sender, false, polkitActionUserAdministration)
127+
if err != nil {
128+
logger.Debug("[SetPassword] access denied:", err)
129+
return dbusutil.ToError(err)
130+
}
131+
132+
var count = 10
133+
for {
134+
_, err := users.GetShadowInfo(u.UserName)
135+
136+
if err == nil {
137+
break
138+
}
139+
count--
140+
if count == 0 {
141+
return dbusutil.ToError(err)
142+
}
143+
time.Sleep(time.Second)
144+
}
145+
146+
if err := users.ModifyPasswd(password, u.UserName); err != nil {
147+
logger.Warning("DoAction: modify password failed:", err)
148+
return dbusutil.ToError(err)
149+
}
150+
151+
err = removeLoginKeyring(u)
152+
if err != nil {
153+
logger.Warningf("DoAction: remove login keyring failed: %v", err)
154+
}
155+
156+
u.PropsMu.Lock()
157+
defer u.PropsMu.Unlock()
158+
159+
if u.Locked {
160+
if err := users.LockedUser(false, u.UserName); err != nil {
161+
logger.Warning("DoAction: unlock user failed:", err)
162+
return dbusutil.ToError(err)
163+
}
164+
u.Locked = false
165+
_ = u.emitPropChangedLocked(false)
166+
}
167+
return nil
120168
}
121169

122170
func (u *User) SetMaxPasswordAge(sender dbus.Sender, nDays int32) *dbus.Error {

0 commit comments

Comments
 (0)