From d7a2a2e8e0fdc75a018fb669e1bd3db7e0ff418d Mon Sep 17 00:00:00 2001
From: Juliusz Chroboczek <jch@irif.fr>
Date: Thu, 2 May 2024 18:14:51 +0200
Subject: [PATCH] Check for mismatched token in API.

---
 webserver/api.go      | 4 ++++
 webserver/api_test.go | 7 +++++++
 2 files changed, 11 insertions(+)

diff --git a/webserver/api.go b/webserver/api.go
index 574045b..7b42b83 100644
--- a/webserver/api.go
+++ b/webserver/api.go
@@ -660,6 +660,10 @@ func tokensHandler(w http.ResponseWriter, r *http.Request, g, pth string) {
 			http.Error(w, "wrong group", http.StatusBadRequest)
 			return
 		}
+		if newtoken.Token != t {
+			http.Error(w, "token mismatch", http.StatusBadRequest)
+			return
+		}
 		_, err = token.Update(&newtoken, etag)
 		if err != nil {
 			httpError(w, err)
diff --git a/webserver/api_test.go b/webserver/api_test.go
index ceb5c02..352a9a9 100644
--- a/webserver/api_test.go
+++ b/webserver/api_test.go
@@ -323,6 +323,13 @@ func TestApi(t *testing.T) {
 		t.Errorf("Update token: %v %v", err, resp.StatusCode)
 	}
 
+	tok.Token = "badtoken"
+	resp, err = do("PUT", tokenpath,
+		"application/json", "", "", marshalToString(tok))
+	if err != nil || resp.StatusCode != http.StatusBadRequest {
+		t.Errorf("Update mismatched token: %v %v", err, resp.StatusCode)
+	}
+
 	tok.Group = "bad"
 	resp, err = do("PUT", tokenpath,
 		"application/json", "", "", marshalToString(tok))