[AC-2605] Restrict collection access for some custom users #4096

eliykat · 2024-05-17T03:14:10Z

Type of change

- [x] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Currently, the Allow admin access to all collections and items setting does not affect Custom Users with the Manage Groups or Manage Users permissions - they can assign groups and users (respectively) to any collection, including those they don't manage.

Update their permission check to only allow this if Allow admin access is enabled. Otherwise, they must have Can Manage permissions like everyone else. This aligns them with how admins and owners are treated.

Clients PR: bitwarden/clients#9231

Code changes

file.ext: Description of what was changed and why

Before you submit

Please check for formatting errors (dotnet format --verify-no-changes) (required)
If making database changes - make sure you also update Entity Framework queries and/or migrations
Please add unit tests where it makes sense to do so (encouraged but not required)
If this change requires a documentation update - notify the documentation team
If this change has particular deployment requirements - notify the DevOps team

codecov · 2024-05-17T03:22:23Z

Codecov Report

Attention: Patch coverage is 92.30769% with 1 lines in your changes are missing coverage. Please review.

Project coverage is 39.07%. Comparing base (489f624) to head (bdc566f).

Files	Patch %	Lines
.../Collections/BulkCollectionAuthorizationHandler.cs	92.30%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4096   +/-   ##
=======================================
  Coverage   39.06%   39.07%           
=======================================
  Files        1201     1201           
  Lines       58010    58021   +11     
  Branches     5338     5339    +1     
=======================================
+ Hits        22660    22670   +10     
  Misses      34295    34295           
- Partials     1055     1056    +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2024-05-17T03:52:44Z

Checkmarx One – Scan Summary & Details – 1b1f208d-6328-4247-a014-7f42a5d3864e

New Issues

Issue	Source File / Package	Checkmarx Insight
Privacy_Violation	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 396	Attack Vector
Privacy_Violation	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 343	Attack Vector
Log_Forging	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 371	Attack Vector
Log_Forging	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 308	Attack Vector

Fixed Issues

Severity	Issue	Source File / Package
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 607
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 607
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 607
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 607
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 132
	CSRF	/src/Api/AdminConsole/Controllers/ProvidersController.cs: 141
	CSRF	/src/Api/SecretsManager/Controllers/AccessPoliciesController.cs: 229
	CSRF	/src/Admin/AdminConsole/Controllers/ProvidersController.cs: 320
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 163
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 163
	CSRF	/src/Api/Billing/Controllers/ProviderClientsController.cs: 30
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 190
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 333
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 333
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 669
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 645
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 535
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 711
	CSRF	/src/Api/Vault/Controllers/FoldersController.cs: 45
	CSRF	/src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs: 51
	CSRF	/src/Api/Controllers/UsersController.cs: 22
	CSRF	/src/Api/Controllers/DevicesController.cs: 70
	CSRF	/src/Api/Controllers/DevicesController.cs: 57
	CSRF	/src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: 69
	CSRF	/src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: 49
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 92
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 49
	CSRF	/src/Api/AdminConsole/Controllers/ProviderUsersController.cs: 142
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 148
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 78
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 61
	CSRF	/bitwarden_license/src/Sso/Controllers/AccountController.cs: 163
	CSRF	/bitwarden_license/src/Sso/Controllers/AccountController.cs: 96
	CSRF	/bitwarden_license/src/Scim/Controllers/v2/UsersController.cs: 50
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 161
	CSRF	/src/Api/Auth/Controllers/EmergencyAccessController.cs: 159
	CSRF	/bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 98
	CSRF	/bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 88
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 449
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 545
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 193
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 222
	CSRF	/src/Admin/AdminConsole/Controllers/OrganizationsController.cs: 308
	CSRF	/src/Admin/AdminConsole/Controllers/ProvidersController.cs: 243
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 81
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 118
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 117
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 150
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 283
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 150
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 898
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1043
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 627
	CSRF	/src/Api/AdminConsole/Controllers/ProviderUsersController.cs: 175
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 361
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 277
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 246
	CSRF	/src/Api/Public/Controllers/CollectionsController.cs: 64
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 144
	CSRF	/src/Api/Controllers/CollectionsController.cs: 411
	CSRF	/src/Api/Controllers/CollectionsController.cs: 375
	CSRF	/src/Api/Controllers/CollectionsController.cs: 303
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 583
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 583
	CSRF	/src/Api/Tools/Controllers/ImportCiphersController.cs: 50
	CSRF	/src/Api/Tools/Controllers/ImportCiphersController.cs: 66
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 111
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 125
	CSRF	/src/Api/AdminConsole/Controllers/ProviderUsersController.cs: 188
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 260
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 572
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 962
	CSRF	/src/Identity/Controllers/AccountsController.cs: 72
	CSRF	/src/Identity/Controllers/AccountsController.cs: 50
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 570
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1120
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 774
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 748
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 246
	CSRF	/src/Api/Controllers/CollectionsController.cs: 411
	CSRF	/src/Api/Controllers/CollectionsController.cs: 375
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 931
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 286
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 193
	CSRF	/src/Api/Controllers/SettingsController.cs: 36
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 722
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 159
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 867
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 627
	CSRF	/src/Api/Controllers/CollectionsController.cs: 303
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 283
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 174
	CSRF	/src/Api/Auth/Controllers/TwoFactorController.cs: 403
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 926
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 287
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 786
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 407
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1100
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 432
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1066
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1066
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1017
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1017
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 811
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 133
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 530
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 86
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 218
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1043
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 300
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 318
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 570
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 312
	CSRF	/src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs: 53
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 301
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 825
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 283
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 283
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 283
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 221
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 286
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 59
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 127
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 519
	CSRF	/src/Api/Controllers/CollectionsController.cs: 323
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 222
	CSRF	/src/Api/Controllers/CollectionsController.cs: 156
	CSRF	/src/Api/Controllers/CollectionsController.cs: 187
	CSRF	/src/Api/Controllers/CollectionsController.cs: 196
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 187
	CSRF	/src/Admin/AdminConsole/Controllers/ProviderOrganizationsController.cs: 40
	CSRF	/src/Api/Auth/Controllers/WebAuthnController.cs: 101
	CSRF	/src/Api/Auth/Controllers/WebAuthnController.cs: 130
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1120
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 679
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 93
	CSRF

More results are available on AST platform

eliykat added 3 commits May 17, 2024 10:19

Make custom users subject to collection settings

e25d970

Add tests

d6d62e4

Simplify tests

e506488

eliykat requested review from a team as code owners May 17, 2024 03:14

eliykat requested review from gbubemismith and r-tome May 17, 2024 03:14

eliykat mentioned this pull request May 17, 2024

[AC-2605] Restrict collection access for some custom users bitwarden/clients#9231

Merged

r-tome approved these changes May 17, 2024

View reviewed changes

Merge branch 'main' into ac/ac-2605/fix-manage-groups-users-permissions

c1eb75f

shane-melton approved these changes May 20, 2024

View reviewed changes

Merge branch 'main' into ac/ac-2605/fix-manage-groups-users-permissions

bdc566f

eliykat merged commit 98b7866 into main May 21, 2024
49 checks passed

eliykat deleted the ac/ac-2605/fix-manage-groups-users-permissions branch May 21, 2024 00:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[AC-2605] Restrict collection access for some custom users #4096

[AC-2605] Restrict collection access for some custom users #4096

eliykat commented May 17, 2024

codecov bot commented May 17, 2024 •

edited

github-actions bot commented May 17, 2024 •

edited

[AC-2605] Restrict collection access for some custom users #4096

[AC-2605] Restrict collection access for some custom users #4096

Conversation

eliykat commented May 17, 2024

Type of change

Objective

Code changes

Before you submit

codecov bot commented May 17, 2024 • edited

Codecov Report

github-actions bot commented May 17, 2024 • edited

New Issues

Fixed Issues

codecov bot commented May 17, 2024 •

edited

github-actions bot commented May 17, 2024 •

edited