zydronium/websitepanel
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

This change allows you to specify which role is allowed to login to the panel

Browse source 
Add the element ExcludedRolesToLogin tp the SiteSettings.config and specify
comma separate which roles are not allowed to login to the panel. e.g.:

<ExcludedRolesToLogin>Administrator,Reseller</ExcludedRolesToLogin>

By doing this you can eliminate the attack surface by publishing the portal
twice. One for the organization administrators and an internal one for the
adminsitrators and reseller admins
This commit is contained in:
robvde 2012-07-11 20:28:33 +04:00
parent 37af5eceac
commit 80672a555f
4 changed files with 41 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

31
WebsitePanel/Sources/WebsitePanel.WebPortal/Code/PortalUtils.cs
View file

@ -331,11 +331,15 @@ namespace WebsitePanel.Portal
UserInfo user = authService.GetUserByUsernamePassword(username, password, ipAddress);
if (user != null)
{
// issue authentication ticket
FormsAuthenticationTicket ticket = CreateAuthTicket(user.Username, user.Password, user.Role, rememberLogin);
SetAuthTicket(ticket, rememberLogin);
if (IsRoleAllowedToLogin(user.Role))
{
// issue authentication ticket
FormsAuthenticationTicket ticket = CreateAuthTicket(user.Username, user.Password, user.Role, rememberLogin);
SetAuthTicket(ticket, rememberLogin);
CompleteUserLogin(username, rememberLogin, preferredLocale, theme);
CompleteUserLogin(username, rememberLogin, preferredLocale, theme);
}
else return BusinessErrorCodes.ERROR_USER_ACCOUNT_ROLE_NOT_ALLOWED;
}
return 0;
@ -347,6 +351,25 @@ namespace WebsitePanel.Portal
}
}
private static bool IsRoleAllowedToLogin(UserRole role)
{
string tmp = GetExcludedRolesToLogin();
if (tmp == null) tmp = string.Empty;
string roleKey = ((UserRole)role).ToString();
return !tmp.Contains(roleKey);
}
public static string GetExcludedRolesToLogin()
{
return PortalConfiguration.SiteSettings["ExcludedRolesToLogin"];
}
private static int GetAuthenticationFormsTimeout()
{
//default