trustchain-oc1-orchestral/authentik
Archived
10
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

core: fix missing permission check for group creating when creating service account

Browse source 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
This commit is contained in:
Jens Langhammer 2021-12-06 12:33:29 +01:00
parent 3c8bbc2621
commit c1ea78c422
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
authentik/core/api/users.py
View file

@ -314,7 +314,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
name=username, name=username,
attributes={USER_ATTRIBUTE_SA: True, USER_ATTRIBUTE_TOKEN_EXPIRING: False}, attributes={USER_ATTRIBUTE_SA: True, USER_ATTRIBUTE_TOKEN_EXPIRING: False},
) )
if create_group: if create_group and self.request.user.has_perm("authentik_core.add_group"):
group = Group.objects.create( group = Group.objects.create(
name=username, name=username,
) )