Aditya Manthramurthy 5a96cbbeaa
Fix user privilege escalation bug (#13976)
The AddUser() API endpoint was accepting a policy field. 
This API is used to update a user's secret key and account 
status, and allows a regular user to update their own secret key. 

The policy update is also applied though does not appear to 
be used by any existing client-side functionality.

This fix changes the accepted request body type and removes 
the ability to apply policy changes as that is possible via the 
policy set API.

NOTE: Changing passwords can be disabled as a workaround
for this issue by adding an explicit "Deny" rule to disable the API
for users.
2021-12-23 09:21:21 -08:00
..
2021-04-23 11:58:53 -07:00
2021-04-23 11:58:53 -07:00
2021-10-22 01:33:28 -07:00
2021-04-23 11:58:53 -07:00
2021-04-23 11:58:53 -07:00
2021-04-23 11:58:53 -07:00
2021-04-23 11:58:53 -07:00
2021-04-23 11:58:53 -07:00
2021-04-23 11:58:53 -07:00