TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-08-11 21:17:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request from GHSA-7h8m-vrxx-vr4m

Browse Source 
* fix: handle locking policy correctly for multiple simultaneous password checks

* recheck events
This commit is contained in:
Livio Spring
2023-11-08 15:19:13 +02:00
committed by GitHub
parent 9a708b1b78
commit 22e2d55999
4 changed files with 178 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
internal/command/user_human_password_model.go
View File

@@ -65,8 +65,13 @@ func (wm *HumanPasswordWriteModel) Reduce() error {
wm.PasswordCheckFailedCount += 1
case *user.HumanPasswordCheckSucceededEvent:
wm.PasswordCheckFailedCount = 0
case *user.UserLockedEvent:
wm.UserState = domain.UserStateLocked
case *user.UserUnlockedEvent:
wm.PasswordCheckFailedCount = 0
if wm.UserState != domain.UserStateDeleted {
wm.UserState = domain.UserStateActive
}
case *user.UserRemovedEvent:
wm.UserState = domain.UserStateDeleted
case *user.HumanPasswordHashUpdatedEvent:
@@ -92,6 +97,7 @@ func (wm *HumanPasswordWriteModel) Query() *eventstore.SearchQueryBuilder {
user.HumanPasswordCheckSucceededType,
user.HumanPasswordHashUpdatedType,
user.UserRemovedType,
user.UserLockedType,
user.UserUnlockedType,
user.UserV1AddedType,
user.UserV1RegisteredType,
@@ -108,5 +114,8 @@ func (wm *HumanPasswordWriteModel) Query() *eventstore.SearchQueryBuilder {
if wm.ResourceOwner != "" {
query.ResourceOwner(wm.ResourceOwner)
}
if wm.WriteModel.ProcessedSequence != 0 {
query.SequenceGreater(wm.WriteModel.ProcessedSequence)
}
return query
}