Merge pull request #5946 from Alexis-Loskoutoff/require-authentication-to-validate-certificates

Require authentication to validate certificates

backend/internal/certificate.js

@@ -545,13 +545,15 @@ const internalCertificate = {
 
 	/**
 	 * Validates that the certs provided are good.
-	 * No access required here, nothing is changed or stored.
+	 * Nothing is changed or stored, but the files go through openssl, so it needs the same access as creating one.
 	 *
+	 * @param   {Access}  access
 	 * @param   {Object}  data
 	 * @param   {Object}  data.files
 	 * @returns {Promise}
 	 */
-	validate: (data) => {
+	validate: async (access, data) => {
+		await access.can("certificates:create");
 		// Put file contents into an object
 		const files = {};
 		_.map(data.files, (file, name) => {
@@ -600,7 +602,7 @@ const internalCertificate = {
 			throw new error.ValidationError("Cannot upload certificates for this type of provider");
 		}
 
-		const validations = await internalCertificate.validate(data);
+		const validations = await internalCertificate.validate(access, data);
 		if (typeof validations.certificate === "undefined") {
 			throw new error.ValidationError("Certificate file was not provided");
 		}

backend/routes/nginx/certificates.js

@@ -161,7 +161,7 @@ router
 		}
 
 		try {
-			const result = await internalCertificate.validate({
+			const result = await internalCertificate.validate(res.locals.access, {
 				files: req.files,
 			});
 			res.status(200).send(result);

test/cypress/e2e/api/Certificates.cy.js

@@ -35,6 +35,63 @@ describe('Certificates endpoints', () => {
 		});
 	});
 
+	it('Unauthenticated user cannot validate custom certificate', () => {
+		cy.task('backendApiPostFiles', {
+			path:          '/api/nginx/certificates/validate',
+			files:         {
+				certificate:     certFile,
+				certificate_key: keyFile,
+			},
+			returnOnError: true,
+		}).then((data) => {
+			expect(data.error.code).to.equal(403);
+		});
+	});
+
+	it('User with certificates view permission cannot validate custom certificate', () => {
+		const viewer = {
+			email:  'viewer@example.com',
+			secret: 'changeme',
+		};
+
+		cy.task('backendApiPost', {
+			token: token,
+			path:  '/api/users',
+			data:  {
+				name:     'Certificate Viewer',
+				nickname: 'Viewer',
+				email:    viewer.email,
+				roles:    ['user'],
+				auth:     {
+					type:   'password',
+					secret: viewer.secret,
+				},
+			},
+		}).then((user) => {
+			cy.task('backendApiPut', {
+				token: token,
+				path:  `/api/users/${user.id}/permissions`,
+				data:  {
+					certificates: 'view',
+				},
+			});
+
+			cy.getToken(null, {identity: viewer.email, secret: viewer.secret}).then((viewerToken) => {
+				cy.task('backendApiPostFiles', {
+					token:         viewerToken,
+					path:          '/api/nginx/certificates/validate',
+					files:         {
+						certificate:     certFile,
+						certificate_key: keyFile,
+					},
+					returnOnError: true,
+				}).then((data) => {
+					expect(data.error.code).to.equal(403);
+				});
+			});
+		});
+	});
+
 	it('Custom certificate lifecycle', () => {
 		// Create custom cert
 		cy.task('backendApiPost', {