TRUNK-6228 Protect admin credentials not working if username not set …

…to admin fix for tests
Seremba · Apr 25, 2024 · 97360f6 · 97360f6
1 parent b4cbe60
commit 97360f6
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 2 deletions.
diff --git a/api/src/main/java/org/openmrs/api/impl/UserServiceImpl.java b/api/src/main/java/org/openmrs/api/impl/UserServiceImpl.java
@@ -652,7 +652,7 @@ public void changePassword(User user, String oldPassword, String newPassword) th
 			throw new APIException("new.password.equal.to.old", (Object[]) null);
 		}
 
-		if ("admin".equals(user.getSystemId()) && Boolean.parseBoolean(
+		if (("admin".equals(user.getSystemId()) || "admin".equals(user.getUsername())) && Boolean.parseBoolean(
 			Context.getRuntimeProperties().getProperty(ADMIN_PASSWORD_LOCKED_PROPERTY, "false"))) {
 			throw new APIException("admin.password.is.locked");
 		}

diff --git a/api/src/test/java/org/openmrs/api/UserServiceTest.java b/api/src/test/java/org/openmrs/api/UserServiceTest.java
@@ -397,9 +397,11 @@ public void changePassword_shouldBeAbleToUpdatePasswordMultipleTimes() {
 	@Test
 	public void changePassword_shouldRespectLockingViaRuntimeProperty() {
 		assertThat("admin", is(Context.getAuthenticatedUser().getUsername()));
+		assertTrue(Context.getAuthenticatedUser().isSuperUser());
+
 		User u = userService.getUserByUsername(ADMIN_USERNAME);
 
-		assertThat(u.getSystemId(), is("admin"));
+		assertThat(u.getUsername(), is("admin"));
 
 		Properties props = Context.getRuntimeProperties();
 		props.setProperty(UserService.ADMIN_PASSWORD_LOCKED_PROPERTY, "true");
@@ -421,6 +423,25 @@ public void changePassword_shouldRespectLockingViaRuntimeProperty() {
 		userService.changePassword(u,"test", "SuperAdmin123");
 	}
 
+	@Test
+	public void changePassword_shouldRespectLockingViaRuntimePropertyForSystemIdAdminAndNoUsername() {
+		assertThat("admin", is(Context.getAuthenticatedUser().getUsername()));
+		assertTrue(Context.getAuthenticatedUser().isSuperUser());
+
+		User u = userService.getUserByUsername(ADMIN_USERNAME);
+
+		u.setSystemId("admin");
+		u.setUsername(null);
+
+		Properties props = Context.getRuntimeProperties();
+		props.setProperty(UserService.ADMIN_PASSWORD_LOCKED_PROPERTY, "true");
+		Context.setRuntimeProperties(props);
+
+		APIException apiException = assertThrows(APIException.class, () -> userService.changePassword(u, "test", "SuperAdmin123"));
+
+		assertThat(apiException.getMessage(), is("admin.password.is.locked"));
+	}
+
 	@Test
 	public void saveUser_shouldGrantNewRolesInRolesListToUser() {
 		// add in some basic properties