bad role check added to reset
@@ -269,6 +269,7 @@ async def update_user(request):
# TODO: FOGL-1226 we don't have any user profile info yet except password, role
raise web.HTTPNotImplemented(reason='FOGL-1226')
+
async def update_password(request):
""" update password
@@ -353,6 +354,10 @@ async def reset(request):
_logger.warning(msg)
raise web.HTTPBadRequest(reason=msg)
+ if not is_valid_role(role_id):
+ _logger.warning("Create user requested with bad role id")
+ return web.HTTPBadRequest(reason="Invalid or bad role id")
+
if password and not isinstance(password, str):
_logger.warning(PASSWORD_ERROR_MSG)
raise web.HTTPBadRequest(reason=PASSWORD_ERROR_MSG)
