diff --git a/CHANGELOG.md b/CHANGELOG.md index b3f5b35..e30ce57 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ v1.5 - Fix FLEXIAPI-153 Add phone and email to be changed in the Activity panel - Fix FLEXIAPI-151 Migrate to hCaptcha - Fix FLEXIAPI-150 Use the same account_id parameter for both API and Web routes +- Fix FLEXIAPI-149 Add a toggle to disable phone check on username for admin endpoints and forms - Fix FLEXIAPI-148 Reuse AccountService in the POST /api/accounts admin endpoint - FIX FLEXIAPI-146 Allow users to manage their own devices - Fix FLEXIAPI-145 Put back the 'code' parameter as an alias for the 'confirmation_key' for the activateEmail and activatePhone endpoints diff --git a/flexiapi/.env.example b/flexiapi/.env.example index 5f243ae..3086ea3 100644 --- a/flexiapi/.env.example +++ b/flexiapi/.env.example @@ -12,6 +12,8 @@ APP_FLEXISIP_PUSHER_FIREBASE_KEYSMAP= # Each pair is separated using a space and APP_API_KEY_EXPIRATION_MINUTES=60 # Number of minutes the generated API Keys are valid APP_API_ACCOUNT_CREATION_TOKEN_RETRY_MINUTES=60 # Number of minutes between two consecutive account_creation_token creation +APP_ALLOW_PHONE_NUMBER_USERNAME_ADMIN_API=false # Allow phone numbers to be set as username in admin account creation endpoints + # Risky toggles APP_ADMINS_MANAGE_MULTI_DOMAINS=false # Allow admins to handle all the accounts in the database APP_DANGEROUS_ENDPOINTS=false # Enable some dangerous endpoints used for XMLRPC like fallback usage diff --git a/flexiapi/app/Http/Controllers/Admin/AccountController.php b/flexiapi/app/Http/Controllers/Admin/AccountController.php index f7e3a15..97f915b 100644 --- a/flexiapi/app/Http/Controllers/Admin/AccountController.php +++ b/flexiapi/app/Http/Controllers/Admin/AccountController.php @@ -26,7 +26,7 @@ use Carbon\Carbon; use App\Account; use App\ContactsList; -use App\Http\Requests\CreateAccountRequest; +use App\Http\Requests\CreateAccountWithoutUsernamePhoneCheck; use App\Http\Requests\UpdateAccountRequest; class AccountController extends Controller @@ -79,7 +79,7 @@ class AccountController extends Controller ]); } - public function store(CreateAccountRequest $request) + public function store(CreateAccountWithoutUsernamePhoneCheck $request) { $request->validate([ 'password' => 'confirmed' diff --git a/flexiapi/app/Http/Controllers/Api/Admin/AccountController.php b/flexiapi/app/Http/Controllers/Api/Admin/AccountController.php index 4994c9b..e04aa5c 100644 --- a/flexiapi/app/Http/Controllers/Api/Admin/AccountController.php +++ b/flexiapi/app/Http/Controllers/Api/Admin/AccountController.php @@ -21,17 +21,14 @@ namespace App\Http\Controllers\Api\Admin; use App\Http\Controllers\Controller; use Illuminate\Http\Request; -use Illuminate\Support\Str; use Illuminate\Support\Facades\Log; -use Carbon\Carbon; use App\Account; use App\AccountTombstone; use App\AccountType; -use App\ActivationExpiration; use App\ContactsList; -use App\Http\Controllers\Account\AuthenticateController as WebAuthenticateController; use App\Http\Requests\CreateAccountRequest; +use App\Http\Requests\CreateAccountWithoutUsernamePhoneCheck; use App\Http\Requests\UpdateAccountRequest; use App\Rules\PasswordAlgorithm; use App\Services\AccountService; @@ -129,7 +126,7 @@ class AccountController extends Controller return $account->makeVisible(['provisioning_token']); } - public function store(CreateAccountRequest $request) + public function store(CreateAccountWithoutUsernamePhoneCheck $request) { return (new AccountService)->store($request, asAdmin: true)->makeVisible(['confirmation_key', 'provisioning_token']); } diff --git a/flexiapi/app/Http/Requests/CreateAccountRequest.php b/flexiapi/app/Http/Requests/CreateAccountRequest.php index c85de43..7834cd9 100644 --- a/flexiapi/app/Http/Requests/CreateAccountRequest.php +++ b/flexiapi/app/Http/Requests/CreateAccountRequest.php @@ -32,9 +32,9 @@ class CreateAccountRequest extends FormRequest Rule::unique('accounts', 'username')->where(function ($query) { $query->where('domain', resolveDomain($this)); }), - /*Rule::unique('accounts_tombstones', 'username')->where(function ($query) use ($request) { - $query->where('domain', config('app.sip_domain')); - }),*/ + Rule::unique('accounts_tombstones', 'username')->where(function ($query) { + $query->where('domain', resolveDomain($this)); + }), 'filled', ], 'dictionary' => [new Dictionary], diff --git a/flexiapi/app/Http/Requests/CreateAccountWithoutUsernamePhoneCheck.php b/flexiapi/app/Http/Requests/CreateAccountWithoutUsernamePhoneCheck.php new file mode 100644 index 0000000..79c9ac6 --- /dev/null +++ b/flexiapi/app/Http/Requests/CreateAccountWithoutUsernamePhoneCheck.php @@ -0,0 +1,28 @@ + env('ACCOUNT_TRANSPORT_PROTOCOL_TEXT', 'TLS (recommended), TCP or UDP'), 'account_email_unique' => env('ACCOUNT_EMAIL_UNIQUE', false), + 'allow_phone_number_username_admin_api' => env('APP_ALLOW_PHONE_NUMBER_USERNAME_ADMIN_API', false), 'blacklisted_usernames' => env('ACCOUNT_BLACKLISTED_USERNAMES', ''), 'account_username_regex' => env('ACCOUNT_USERNAME_REGEX', '^[a-z0-9+_.-]*$'), 'account_default_password_algorithm' => env('ACCOUNT_DEFAULT_PASSWORD_ALGORITHM', 'SHA-256'), diff --git a/flexiapi/resources/views/admin/account/create_edit.blade.php b/flexiapi/resources/views/admin/account/create_edit.blade.php index dbe3ed0..dbc4633 100644 --- a/flexiapi/resources/views/admin/account/create_edit.blade.php +++ b/flexiapi/resources/views/admin/account/create_edit.blade.php @@ -39,7 +39,7 @@

Connexion

id) readonly @endif> @include('parts.errors', ['name' => 'username']) @@ -53,7 +53,7 @@
+ value="@if($account->id){{ $account->display_name }}@else{{ old('display_name') }}@endif"> @include('parts.errors', ['name' => 'display_name'])
@@ -75,14 +75,14 @@
+ value="@if($account->id){{ $account->email }}@else{{ old('email') }}@endif"> @include('parts.errors', ['name' => 'email'])
+ value="@if($account->id){{ $account->phone }}@else{{ old('phone') }}@endif"> @include('parts.errors', ['name' => 'phone'])
diff --git a/flexiapi/tests/Feature/ApiAccountTest.php b/flexiapi/tests/Feature/ApiAccountTest.php index 6606757..7f0473f 100644 --- a/flexiapi/tests/Feature/ApiAccountTest.php +++ b/flexiapi/tests/Feature/ApiAccountTest.php @@ -86,15 +86,25 @@ class ApiAccountTest extends TestCase $username = '+33612121212'; $domain = 'example.com'; - $response = $this->keyAuthenticated($password->account) + $this->keyAuthenticated($password->account) ->json($this->method, $this->route, [ 'username' => $username, 'domain' => $domain, 'algorithm' => 'SHA-256', 'password' => '123456', - ]); + ]) + ->assertJsonValidationErrors(['username']); - $response->assertJsonValidationErrors(['username']); + config()->set('app.allow_phone_number_username_admin_api', true); + + $this->keyAuthenticated($password->account) + ->json($this->method, $this->route, [ + 'username' => $username, + 'domain' => $domain, + 'algorithm' => 'SHA-256', + 'password' => '123456', + ]) + ->assertStatus(200); } public function testUsernameNotSIP()