fix: reject password changes when local auth is disabled

The WebUI offered a "Change Password" prompt even with
GOTIFY_LOCALAUTH_ENABLED=false, and the endpoint behind it accepted the
change: ChangePassword never consulted the setting, so a user on an
OIDC-only server could still set a local password that the login form
no longer accepts.

Guard the handler the same way SessionAPI.Login already does, and hide
the header entry that opens the dialog when local auth is off.

Closes #1040

Author: justadityaraj

api/user.go

@@ -63,6 +63,7 @@ type UserAPI struct {
 	PasswordStrength   int
 	UserChangeNotifier *UserChangeNotifier
 	Registration       bool
+	LocalAuthEnabled   bool
 }
 
 // GetUsers returns all the users
@@ -396,6 +397,11 @@ func (a *UserAPI) DeleteUserByID(ctx *gin.Context) {
 //	    schema:
 //	        $ref: "#/definitions/Error"
 func (a *UserAPI) ChangePassword(ctx *gin.Context) {
+	if !a.LocalAuthEnabled {
+		ctx.AbortWithError(403, errors.New("local authentication is disabled"))
+		return
+	}
+
 	pw := model.UserExternalPass{}
 	if err := ctx.Bind(&pw); err == nil {
 		if err := password.ValidateNewPassword(pw.Pass); err != nil {

api/user_test.go

@@ -49,7 +49,7 @@ func (s *UserSuite) BeforeTest(suiteName, testName string) {
 		s.notifiedAdd = true
 		return nil
 	})
-	s.a = &UserAPI{DB: s.db, UserChangeNotifier: s.notifier}
+	s.a = &UserAPI{DB: s.db, UserChangeNotifier: s.notifier, LocalAuthEnabled: true}
 }
 
 func (s *UserSuite) AfterTest(suiteName, testName string) {
@@ -493,6 +493,25 @@ func (s *UserSuite) Test_UpdatePassword_EmptyPassword() {
 	assert.True(s.T(), password.ComparePassword(user.Pass, []byte("old")))
 }
 
+func (s *UserSuite) Test_UpdatePassword_LocalAuthDisabled_Expect403() {
+	pw, err := password.CreatePassword("old", 5)
+	require.NoError(s.T(), err)
+	s.db.CreateUser(&model.User{ID: 1, Name: "jmattheis", Pass: pw})
+	s.a.LocalAuthEnabled = false
+
+	test.WithUser(s.ctx, 1)
+	s.ctx.Request = httptest.NewRequest("POST", "/user/current/password", strings.NewReader(`{"pass": "new"}`))
+	s.ctx.Request.Header.Set("Content-Type", "application/json")
+
+	s.a.ChangePassword(s.ctx)
+
+	assert.Equal(s.T(), 403, s.recorder.Code)
+	user, err := s.db.GetUserByID(1)
+	assert.NoError(s.T(), err)
+	assert.NotNil(s.T(), user)
+	assert.True(s.T(), password.ComparePassword(user.Pass, []byte("old")))
+}
+
 func (s *UserSuite) Test_UpdatePassword_TooLongPassword_Expect400() {
 	pw, err := password.CreatePassword("old", 5)
 	require.NoError(s.T(), err)

router/router.go

@@ -104,7 +104,7 @@ func Create(db *database.GormDatabase, vInfo *model.VersionInfo, conf *config.Co
 	}
 	sessionHandler := api.SessionAPI{DB: db, NotifyDeleted: streamHandler.NotifyDeletedClient, SecureCookie: conf.Server.SecureCookie, LocalAuthEnabled: conf.LocalAuthEnabled}
 	userChangeNotifier := new(api.UserChangeNotifier)
-	userHandler := api.UserAPI{DB: db, PasswordStrength: conf.PassStrength, UserChangeNotifier: userChangeNotifier, Registration: conf.Registration}
+	userHandler := api.UserAPI{DB: db, PasswordStrength: conf.PassStrength, UserChangeNotifier: userChangeNotifier, Registration: conf.Registration, LocalAuthEnabled: conf.LocalAuthEnabled}
 
 	pluginManager, err := plugin.NewManager(db, conf.PluginsDir, g.Group("/plugin/:id/custom/"), streamHandler)
 	if err != nil {

ui/src/layout/Header.tsx

@@ -20,6 +20,7 @@ import React, {CSSProperties} from 'react';
 import {Link} from 'react-router';
 import {useMediaQuery} from '@mui/material';
 import {ThemeKey} from './theme';
+import * as config from '../config';
 
 const themeIcons: Record<ThemeKey, React.ReactElement> = {
     dark: <Brightness4 />,
@@ -195,13 +196,15 @@ const Buttons = ({
             <Link className={classes.link} to="/plugins" id="navigate-plugins">
                 <ResponsiveButton icon={<Apps />} label="plugins" color="inherit" />
             </Link>
-            <ResponsiveButton
-                icon={<AccountCircle />}
-                label={name}
-                onClick={showSettings}
-                id="changepw"
-                color="inherit"
-            />
+            {config.get('localAuth') && (
+                <ResponsiveButton
+                    icon={<AccountCircle />}
+                    label={name}
+                    onClick={showSettings}
+                    id="changepw"
+                    color="inherit"
+                />
+            )}
             <ResponsiveButton
                 icon={<ExitToApp />}
                 label="Logout"