INNER CODE UNIT · Python

api_admin_users

The-Art-of-Hacking/websploit · additional-labs/token-tower/app.py:883

def api_admin_users():
    """Get all users - requires admin role"""
    token = get_token_from_request()
    
    if not token:
        return jsonify({"error": "No authorization token provided"}), 401
    
    try:
        payload = verify_token_vulnerable(token)
        if not payload:
            return jsonify({"error": "Invalid token"}), 401
        
        if payload.get('role') != 'admin':
            return jsonify({"error": "Admin access required"}), 403
        
        # Return users (without passwords)
        users_list = [
            {"username": u, "role": d['role'], "id": d['id']}

View source record →