Authentication bypass via userID login when email and username login are disabled

@@ -95,23 +95,25 @@ func (a *App) GetUserForLogin(rctx request.CTX, id, loginId string) (*model.User
 	enableUsername := *a.Config().EmailSettings.EnableSignInWithUsername
 	enableEmail := *a.Config().EmailSettings.EnableSignInWithEmail
 
-	// If we are given a userID then fail if we can't find a user with that ID
-	if id != "" {
-		user, err := a.GetUser(id)
-		if err != nil {
-			if err.Id != MissingAccountError {
-				err.StatusCode = http.StatusInternalServerError
+	if enableEmail || enableUsername {
+		// If we are given a userID then fail if we can't find a user with that ID
+		if id != "" {
+			user, err := a.GetUser(id)
+			if err != nil {
+				if err.Id != MissingAccountError {
+					err.StatusCode = http.StatusInternalServerError
+					return nil, err
+				}
+				err.StatusCode = http.StatusBadRequest
 				return nil, err
 			}
-			err.StatusCode = http.StatusBadRequest
-			return nil, err
+			return user, nil
 		}
-		return user, nil
-	}
 
-	// Try to get the user by username/email
-	if user, err := a.Srv().Store().User().GetForLogin(loginId, enableUsername, enableEmail); err == nil {
-		return user, nil
+		// Try to get the user by username/email
+		if user, err := a.Srv().Store().User().GetForLogin(loginId, enableUsername, enableEmail); err == nil {
+			return user, nil
+		}
 	}
 
 	// Try to get the user with LDAP if enabled

@@ -4,6 +4,7 @@
 package app
 
 import (
+	"net/http"
 	"os"
 	"testing"
 
@@ -52,3 +53,88 @@ func TestCWSLogin(t *testing.T) {
 		require.Nil(t, user)
 	})
 }
+
+func TestGetUserForLogin(t *testing.T) {
+	mainHelper.Parallel(t)
+	th := Setup(t).InitBasic(t)
+
+	t.Run("Should get user with username when sign in with username is enabled", func(t *testing.T) {
+		th.UpdateConfig(t, func(config *model.Config) {
+			config.EmailSettings.EnableSignInWithUsername = model.NewPointer(true)
+		})
+
+		user, appErr := th.App.GetUserForLogin(th.Context, "", th.BasicUser.Username)
+		require.Nil(t, appErr)
+		require.NotNil(t, user)
+		require.Equal(t, th.BasicUser.Username, user.Username)
+	})
+
+	t.Run("Should not get user with username when sign in with username is disabled", func(t *testing.T) {
+		th.UpdateConfig(t, func(config *model.Config) {
+			config.EmailSettings.EnableSignInWithUsername = model.NewPointer(false)
+		})
+
+		user, appErr := th.App.GetUserForLogin(th.Context, "", th.BasicUser.Username)
+		require.NotNil(t, appErr)
+		require.Equal(t, http.StatusBadRequest, appErr.StatusCode)
+		require.Nil(t, user)
+	})
+
+	t.Run("Should get user with email when sign in with email is enabled", func(t *testing.T) {
+		th.UpdateConfig(t, func(config *model.Config) {
+			config.EmailSettings.EnableSignInWithEmail = model.NewPointer(true)
+		})
+
+		user, appErr := th.App.GetUserForLogin(th.Context, "", th.BasicUser.Email)
+		require.Nil(t, appErr)
+		require.NotNil(t, user)
+		require.Equal(t, th.BasicUser.Username, user.Username)
+	})
+
+	t.Run("Should not user with email when sign in with email is disabled", func(t *testing.T) {
+		th.UpdateConfig(t, func(config *model.Config) {
+			config.EmailSettings.EnableSignInWithEmail = model.NewPointer(false)
+		})
+
+		user, appErr := th.App.GetUserForLogin(th.Context, "", th.BasicUser.Email)
+		require.NotNil(t, appErr)
+		require.Equal(t, http.StatusBadRequest, appErr.StatusCode)
+		require.Nil(t, user)
+	})
+
+	t.Run("Should get user with user ID when sign in with email is enabled", func(t *testing.T) {
+		th.UpdateConfig(t, func(config *model.Config) {
+			config.EmailSettings.EnableSignInWithEmail = model.NewPointer(true)
+			config.EmailSettings.EnableSignInWithUsername = model.NewPointer(false)
+		})
+
+		user, appErr := th.App.GetUserForLogin(th.Context, th.BasicUser.Id, "")
+		require.Nil(t, appErr)
+		require.NotNil(t, user)
+		require.Equal(t, th.BasicUser.Username, user.Username)
+	})
+
+	t.Run("Should get user with user ID when sign in with username is enabled", func(t *testing.T) {
+		th.UpdateConfig(t, func(config *model.Config) {
+			config.EmailSettings.EnableSignInWithEmail = model.NewPointer(false)
+			config.EmailSettings.EnableSignInWithUsername = model.NewPointer(true)
+		})
+
+		user, appErr := th.App.GetUserForLogin(th.Context, th.BasicUser.Id, "")
+		require.Nil(t, appErr)
+		require.NotNil(t, user)
+		require.Equal(t, th.BasicUser.Username, user.Username)
+	})
+
+	t.Run("Should not get user with user ID when both sign in with email and username are disabled", func(t *testing.T) {
+		th.UpdateConfig(t, func(config *model.Config) {
+			config.EmailSettings.EnableSignInWithEmail = model.NewPointer(false)
+			config.EmailSettings.EnableSignInWithUsername = model.NewPointer(false)
+		})
+
+		user, appErr := th.App.GetUserForLogin(th.Context, th.BasicUser.Id, "")
+		require.NotNil(t, appErr)
+		require.Equal(t, http.StatusBadRequest, appErr.StatusCode)
+		require.Nil(t, user)
+	})
+}