Forbid locale updates for scim-managed users.

wireapp · Jun 3, 2024 · 55f39d4 · 55f39d4
1 parent d66df38
commit 55f39d4
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/services/brig/src/Brig/API/Public.hs b/services/brig/src/Brig/API/Public.hs
@@ -993,7 +993,7 @@ changeLocale ::
   ConnId ->
   Public.LocaleUpdate ->
   (Handler r) ()
-changeLocale u conn l = lift $ API.changeLocale u conn l
+changeLocale u conn l = lift $ API.changeLocale u conn l API.ForbidSCIMUpdates
 
 changeSupportedProtocols ::
   ( Member (Embed HttpClientIO) r,

diff --git a/services/brig/src/Brig/API/User.hs b/services/brig/src/Brig/API/User.hs
@@ -635,6 +635,14 @@ changeLocale ::
   LocaleUpdate ->
   (AppT r) ()
 changeLocale uid conn (LocaleUpdate loc) = do
+  usr <- lift $ wrapClient $ Data.lookupUser WithPendingInvitations uid
+  unless
+    ( userManagedBy u /= ManagedByScim
+        || Just loc == userLocale u
+        || allowScim == AllowSCIMUpdates
+    )
+    $ throwE ChangeHandleManagedByScim
+
   wrapClient $ Data.updateLocale uid loc
   liftSem $ Intra.onUserEvent uid (Just conn) (localeUpdate uid loc)