tree 86a72ac71be16608091ab1c9dfad9287d2835035
parent 03913171c748202e81021ed2520362fd2877879b
author Ed Tanous <edtanous@google.com> 1635919999 +0800
committer Ed Tanous <ed@tanous.net> 1637014204 +0000

Redfish: Repair the wrong change made by non-admin

In Redfish spec, the Operator and Readonly group should only change
their own passwd using patch in ManagerAccount.
(because of their ConfigureSelf privilege)

But now they can even modify their RoleId in the code.

https://www.dmtf.org/sites/default/files/standards/documents/DSP2046_2021.2.pdf

Test:
the 'xiao' is a Operator
~ curl -k -H "X-Auth-Token: $token" -X PATCH -d '{"RoleId":"ReadOnly"}'
https://${bmc}/redfish/v1/AccountService/Accounts/xiao
{
  "error": {
    "@Message.ExtendedInfo": [
      {
        "@odata.type": "#Message.v1_1_1.Message",
        "Message": "There are insufficient privileges for the account
or credentials associated with the current session to perform the
requested operation.",
        "MessageArgs": [],
        "MessageId": "Base.1.8.1.InsufficientPrivilege",
        "MessageSeverity": "Critical",
        "Resolution": "Either abandon the operation or change the
associated access rights and resubmit the request if the operation
failed."
      }
    ],
    "code": "Base.1.8.1.InsufficientPrivilege",
    "message": "There are insufficient privileges for the account or
credentials associated with the current session to perform the
requested operation."
  }
}%

Signed-off-by: Xiaochao Ma <maxiaochao@inspur.com>
Signed-off-by: Ed Tanous <edtanous@google.com>
Change-Id: I9befcd94ee3a0b55f1ae7af38eb40e5f92fc3264