Orchardcore: Admin user became disabled

[vitalybrandes]

Did QA with TryOrchardCore.Web src.
Repro steps:

1. Build SAAS recipe orchard core site
   

2. Login to admin

3. Go to Security - > users, and edit user you specify on setup
   

4. Save the user
   

User disabled.

[Skrypt]

Yep this is a funny one. I did that code. Though you should be able to disable an administrator account but not if it's the last one enabled.

[Skrypt]

And I'm looking at your screens and it seems that from that form it should have kept the user as enabled. So, your issue is that you have a custom Handler that sets the User as disabled.

[vitalybrandes]

Yep this is a funny one. I did that code. Though you should be able to disable an administrator account but not if it's the last one enabled.

For sure if you want to disable "yourself" :-)

[vitalybrandes]

And I'm looking at your screens and it seems that from that form it should have kept the user as enabled. So, your issue is that you have a custom Handler that sets the User as disabled.

I agree, looks like that something happen behind the scene,
the problem is that this this pure code i take from orchard github.
https://github.com/OrchardCMS/TryOrchardCore
I didint make any custom dev...

[Skrypt]

You should not be able to disable "yourself" as the "disabled" button is disabled 🤣

[Skrypt]

Hmm TryOrchardCore surely needs an update 😉
Report the issue there as I can't repro in the dev branch of this repository

[vitalybrandes]

Hmm TryOrchardCore surely needs an update 😉
Report the issue there as I can't repro in the dev branch of this repository

Did you try clean setup?
remove App_data and recreate it?

[Skrypt]

Yes I did a git clean -xdf on the folder. Though I did not recreate the database and tenants as it should not really matter.

[vitalybrandes]

Yes I did a git clean -xdf on the folder. Though I did not recreate the database and tenants as it should not really matter.

I think it is,
Its happen only for first user in the system,
When i added second admin and sis the same scenario, it was ok.
Can you backup your add_data and create one new for sec?

[Skrypt]

Ok doing it.

[Skrypt]

Ok I can repro, I understand the issue now.

[vitalybrandes]

Ok I can repro, I understand the issue now.
Nice one :-)

[hishamco]

You should not be able to disable "yourself" as the "disabled" button is disabled

If I'm not wrong I fix this issue in OC, @Skrypt did you reproduce it in OC or try.OC?

[Skrypt]

OC

[hishamco]

The admin can disable him/her self ;)

[hishamco]

I remembered I fix a delete issue not enable/disable user, I can handle this if no one start on it

[Skrypt]

The issue is that when the HTML checkbox slider component is set to disable it returns a false value everytime (this is something that changed).
We should validate these things on server side to make this bulletproof.

[hishamco]

I see, if you didn't start I can have a look and fix it

[bertalting]

where can I contact some devs of OrchardCore about a privilege escalation that I have found...

[Skrypt]

//cc @sebastienros

[bertalting]

//cc @sebastienros

Thanks, reported and acknowledged by dev.