Skip to content

fix(API username change): Issue from the pentest report#144

Merged
samoehlert merged 2 commits intomainfrom
topic/soehlert/pentest_username_change
Apr 8, 2025
Merged

fix(API username change): Issue from the pentest report#144
samoehlert merged 2 commits intomainfrom
topic/soehlert/pentest_username_change

Conversation

@samoehlert
Copy link
Copy Markdown
Collaborator

Remove the ability to change your own username from the API. This was pointed out in the pentest we had done :

The Users API found at ~/api/v1/users/<USER_NAME>/ allows for a user to change their username to one that doesn't exist. This doesn't have any major implications, however, it is unintended functionality that should be removed. As an example, if a user were to change their username to “Admïn,” a person could be fooled into thinking it was another user doing the changes.

…nge their own username over API

this was part of the pentest report
@samoehlert samoehlert marked this pull request as draft April 7, 2025 22:34
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 7, 2025

File Coverage
All files 81%
config/consumers.py 59%
config/urls.py 69%
config/settings/base.py 70%
config/settings/local.py 73%
scram/route_manager/admin.py 85%
scram/route_manager/models.py 70%
scram/route_manager/views.py 81%
scram/route_manager/api/serializers.py 73%
scram/route_manager/api/views.py 83%
scram/templates/403.html 91%
scram/templates/404.html 91%
scram/templates/base.html 99%

Minimum allowed coverage is 50%

Generated by 🐒 cobertura-action against 329a9ef

Copy link
Copy Markdown
Collaborator

@crankynetman crankynetman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks perfect, thanks for fixing. I still don't know what's up with that dang coverage thing, but... Well, I'm fine ignoring it.

@samoehlert samoehlert marked this pull request as ready for review April 8, 2025 16:37
@samoehlert samoehlert merged commit 6c6a122 into main Apr 8, 2025
19 of 20 checks passed
@samoehlert samoehlert deleted the topic/soehlert/pentest_username_change branch April 8, 2025 16:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants