verdnatura-mirror
/
loopback
mirror of https://github.com/strongloop/loopback.git
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
loopback/test
History
Miroslav Bajtoš 0a2a45512c
Fix "POST /reset-password" for multi-user setup 
Fix the code extracting current user id from the access token provided
in the HTTP request, to allow only access tokens created by the target
user models to execute the action.

This fixes the following security vulnerability:

* A UserA with id 1 (for example), requires a resetToken1

* A UserB with the same id requires a resetToken2.

* Using resetToken2, use the UserAs/reset-password endpoint and change
  the password of UserA and/or vice-versa.
 		2017-10-19 13:29:08 +02:00
..
e2e Update eslint to loopback config v5 2016-11-22 14:08:02 +01:00
fixtures Support createOnlyInstance in model (#3548) 2017-08-22 17:10:55 -07:00
helpers test: extract helpers for logging HTTP errors 2017-10-19 13:08:54 +02:00
util Update eslint to loopback config v5 2016-11-22 14:08:02 +01:00
access-control.integration.js Turn on "no-unused-expressions" rule for eslint 2016-11-22 15:30:04 +01:00
access-token.test.js Refactor access token to make it extensible 2017-05-02 10:55:51 -07:00
acl.test.js Fix acl.resolvePermission for wildcard req 2017-09-27 02:48:34 +02:00
app.test.js Add tests of HTTP normalization on app level 2017-08-03 12:32:54 +02:00
authorization-scopes.test.js test: extract helpers for logging HTTP errors 2017-10-19 13:08:54 +02:00
change-stream.test.js Remove observers from Model on end of the stream 2017-07-12 10:28:27 +02:00
change.test.js Allow custom properties of Change Model 2017-03-09 08:58:42 +01:00
checkpoint.test.js Turn on "no-unused-expressions" rule for eslint 2016-11-22 15:30:04 +01:00
context-options.test.js Upgrade supertest to 3.x 2017-02-09 16:17:10 +01:00
data-source.test.js Update eslint to loopback config v5 2016-11-22 14:08:02 +01:00
email.test.js Update eslint to loopback config v5 2016-11-22 14:08:02 +01:00
error-handler.test.js Turn on "no-unused-expressions" rule for eslint 2016-11-22 15:30:04 +01:00
geo-point.test.js Update eslint to loopback config v5 2016-11-22 14:08:02 +01:00
hidden-properties.test.js Update eslint to loopback config v5 2016-11-22 14:08:02 +01:00
integration.test.js Turn on "no-unused-expressions" rule for eslint 2016-11-22 15:30:04 +01:00
karma.conf.js Babelify juggler for Karma tests 2017-02-01 14:00:43 +01:00
key-value-model.test.js Turn on "no-unused-expressions" rule for eslint 2016-11-22 15:30:04 +01:00
loopback.test.js test: fix too strict test assertion 2017-10-04 10:31:50 +02:00
memory.test.js Update eslint to loopback config v5 2016-11-22 14:08:02 +01:00
mocha.opts Use English when running Mocha tests 2017-01-26 10:11:08 +01:00
model.application.test.js Upgrade eslint config and grunt-eslint to latest 2016-12-06 16:05:13 +01:00
model.test.js Do not add isStatic properties to method settings 2017-08-15 18:09:16 +02:00
multiple-user-principal-types.test.js Fix "POST /reset-password" for multi-user setup 2017-10-19 13:29:08 +02:00
registries.test.js Turn on "no-unused-expressions" rule for eslint 2016-11-22 15:30:04 +01:00
relations.integration.js Allow declarative nestRemoting for relations 2017-09-27 09:22:06 -07:00
remote-connector.test.js Contextify DAO and relation methods 2016-12-22 10:26:09 +01:00
remoting-coercion.test.js Update eslint to loopback config v5 2016-11-22 14:08:02 +01:00
remoting.integration.js Support createOnlyInstance in model (#3548) 2017-08-22 17:10:55 -07:00
replication.rest.test.js Use local registry in test/replication.rest.test 2017-02-24 15:13:06 +01:00
replication.test.js Allow custom properties of Change Model 2017-03-09 08:58:42 +01:00
rest.middleware.test.js Upgrade eslint config and grunt-eslint to latest 2016-12-06 16:05:13 +01:00
role-mapping.test.js Add promise support to built-in model RoleMapping 2017-02-01 09:51:43 +01:00
role.test.js Fix OWNER role to handle multiple relations 2017-09-27 17:11:36 +02:00
user-password.test.js Implement more secure password flow 2017-04-20 10:22:21 +02:00
user.integration.js Implement more secure password flow 2017-04-20 10:22:21 +02:00
user.test.js Fix handling of user verification options 2017-10-09 13:42:22 +02:00
utils.test.js Optimise replication 2017-02-22 15:12:54 +01:00