Forbid locale updates for scim-managed users.

wireapp · Jun 3, 2024 · 907ac61 · 907ac61
1 parent d66df38
commit 907ac61
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 3 deletions.
diff --git a/changelog.d/3-bug-fixes/WPB-9488-fix-update-origin b/changelog.d/3-bug-fixes/WPB-9488-fix-update-origin
@@ -1 +1 @@
-Do not set update origin "scim" in public brig api.
+Do not set update origin "scim" in public brig api. (#4072, #4078)
diff --git a/services/brig/src/Brig/API/Public.hs b/services/brig/src/Brig/API/Public.hs
@@ -993,7 +993,7 @@ changeLocale ::
   ConnId ->
   Public.LocaleUpdate ->
   (Handler r) ()
-changeLocale u conn l = lift $ API.changeLocale u conn l
+changeLocale u conn l = lift $ API.changeLocale u conn l API.ForbidSCIMUpdates
 
 changeSupportedProtocols ::
   ( Member (Embed HttpClientIO) r,

diff --git a/services/brig/src/Brig/API/User.hs b/services/brig/src/Brig/API/User.hs
@@ -633,8 +633,17 @@ changeLocale ::
   UserId ->
   ConnId ->
   LocaleUpdate ->
+  AllowSCIMUpdates ->
   (AppT r) ()
-changeLocale uid conn (LocaleUpdate loc) = do
+changeLocale uid conn (LocaleUpdate loc) allowScim = do
+  usr <- lift $ wrapClient $ Data.lookupUser WithPendingInvitations uid
+  unless
+    ( userManagedBy usr /= ManagedByScim
+        || Just loc == userLocale usr
+        || allowScim == AllowSCIMUpdates
+    )
+    $ throwE ChangeHandleManagedByScim
+
   wrapClient $ Data.updateLocale uid loc
   liftSem $ Intra.onUserEvent uid (Just conn) (localeUpdate uid loc)
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		Do not set update origin "scim" in public brig api.
		Do not set update origin "scim" in public brig api. (#4072, #4078)