Skip to content

Conversation

migmartri
Copy link
Member

This code swaps the order of the checks done during invitation, from

  • Check that the receiver doesn't belong to the org already
  • Check that the sender can invite to the org

to

  • Check that the sender can invite to the org
  • Check that the receiver doesn't belong to the org already

That way, a sender will not be able to know if a user belongs to an organization by trying emails/uuids.

This is an unlikely case (you need to know orgs UUDIDS and email address to positively know that it belongs to the org) but in any case this patch solves that problem.

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Copy link
Contributor

@buccarel buccarel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rocket emoji

Copy link
Member

@danlishka danlishka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch. Let's meet and review the flow in the invitation system again.

@migmartri migmartri merged commit 01e1902 into chainloop-dev:main Nov 6, 2023
@migmartri migmartri deleted the update-order branch November 6, 2023 08:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants