@@ -5520,7 +5520,7 @@ func HandleUpdateUser(resp http.ResponseWriter, request *http.Request) {
55205520 // 3. Make sure it's ONLY changing orgs based on parent org
55215521
55225522 // Check which ones the current user has access to
5523- if debug {
5523+ if debug {
55245524 log.Printf("[DEBUG] PRE PRE orgs for %s (%s) is len(%d). Input length: %d", foundUser.Username, foundUser.Id, len(foundUser.Orgs), len(t.Suborgs))
55255525 }
55265526
@@ -5539,7 +5539,7 @@ func HandleUpdateUser(resp http.ResponseWriter, request *http.Request) {
55395539 }
55405540
55415541 if org.CreatorOrg != parentOrgId {
5542- if debug {
5542+ if debug {
55435543 log.Printf("[ERROR] Skipping org %s as it is not a suborg of parent org %s for user %s (%s).", suborg, parentOrgId, userInfo.Username, userInfo.Id)
55445544 }
55455545
@@ -5560,7 +5560,7 @@ func HandleUpdateUser(resp http.ResponseWriter, request *http.Request) {
55605560 if found {
55615561 newSuborgs = append(newSuborgs, suborg)
55625562 } else {
5563- if debug {
5563+ if debug {
55645564 log.Printf("[ERROR] Skipping adding to org %s as user %s (%s) can't edit this one.", suborg, userInfo.Username, userInfo.Id)
55655565 }
55665566 }
@@ -5612,7 +5612,7 @@ func HandleUpdateUser(resp http.ResponseWriter, request *http.Request) {
56125612 //log.Printf("[DEBUG] Orgs to be added: %s. Existing: %s.", addedOrgs, foundUser.Orgs)
56135613
56145614 // Removed for now due to multi-org chain deleting you from other org chains
5615- if debug {
5615+ if debug {
56165616 log.Printf("[DEBUG] Pre orgs for %s (%s) is len(%d)", foundUser.Username, foundUser.Id, len(foundUser.Orgs))
56175617 }
56185618
@@ -9253,7 +9253,7 @@ func CleanCreds(user *User) *User {
92539253 //user.Orgs = []string{}
92549254 handledOrgs := []string{}
92559255
9256- // Quick deduplication.
9256+ // Quick deduplication.
92579257 for _, org := range user.Orgs {
92589258 if ArrayContains(handledOrgs, org) {
92599259 continue
@@ -9512,7 +9512,6 @@ func HandleGetUsers(resp http.ResponseWriter, request *http.Request) {
95129512 orgUser.Orgs = append(orgUser.Orgs, user.ActiveOrg.Id)
95139513 }
95149514
9515-
95169515 newUsers = append(newUsers, orgUser)
95179516 }
95189517 }
@@ -11695,8 +11694,9 @@ func HandleChangeUserOrg(resp http.ResponseWriter, request *http.Request) {
1169511694 type ReturnData struct {
1169611695 OrgId string `json:"org_id" datastore:"org_id"`
1169711696 RegionUrl string `json:"region_url" datastore:"region_url"`
11698- SSO bool `json:"sso"`
11699- Mode string `json:"mode"`
11697+ // SSO bool `json:"sso"`
11698+ SSO bool `json:"sso_test"`
11699+ Mode string `json:"mode"`
1170011700 }
1170111701
1170211702 var tmpData ReturnData
@@ -11802,15 +11802,14 @@ func HandleChangeUserOrg(resp http.ResponseWriter, request *http.Request) {
1180211802 }
1180311803 }
1180411804
11805- if !found {
11805+ if !found {
1180611806 log.Printf("[WARNING] User swap to the org \"%s\" - access denied", tmpData.OrgId)
1180711807 resp.WriteHeader(403)
1180811808 resp.Write([]byte(`{"success": false, "reason": "No permission to change to this org. Please contact
[email protected] if this is unexpected."}`))
1180911809 return
1181011810 }
1181111811 }
1181211812
11813-
1181411813 if (org.SSOConfig.SSORequired == true && user.UsersLastSession != user.Session && user.SupportAccess == false) || tmpData.SSO {
1181511814
1181611815 // Check if the org is the suborg or not?
@@ -14553,7 +14552,6 @@ func GetOpenIdUrl(request *http.Request, org Org) string {
1455314552 baseSSOUrl += fmt.Sprintf("?client_id=%s&response_type=code&scope=openid email&redirect_uri=%s&state=%s&code_challenge_method=S256&code_challenge=%s", org.SSOConfig.OpenIdClientId, redirectUrl, state, codeChallenge)
1455414553 }
1455514554
14556-
1455714555 return baseSSOUrl
1455814556}
1455914557
@@ -15348,7 +15346,7 @@ func HandleLogin(resp http.ResponseWriter, request *http.Request) {
1534815346
1534915347// FIXME: Do NOT use this yet (May 24th, 2024). It is not ready for production due to being a potential cross-tenant attack vector.
1535015348func HandleSAML(resp http.ResponseWriter, request *http.Request) {
15351- resp.Write([]byte("SAML SSO is deprecated. Please use OpenID Connect instead. Contact
[email protected] if you need help migrating, or are having trouble logging in to your account."))
15349+ resp.Write([]byte("SAML SSO is deprecated. Please use OpenID Connect instead. Contact
[email protected] if you need help migrating, or are having trouble logging in to your account."))
1535215350 return
1535315351}
1535415352
@@ -22188,7 +22186,6 @@ func fixCertificate(parsedX509Key string) string {
2218822186 return parsedX509Key
2218922187}
2219022188
22191-
2219222189// Example implementation of SSO, including a redirect for the user etc
2219322190// Should make this stuff only possible after login
2219422191func HandleOpenId(resp http.ResponseWriter, request *http.Request) {
0 commit comments