mirrors
/
uptime-kuma
mirror of https://github.com/louislam/uptime-kuma.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #743 from andreasbrett/patch-4 

Harden 2FA/TOTP implementation according to rfc6238 (part 2)
This commit is contained in:
Louis Lam 2021-10-23 17:00:46 +08:00 committed by GitHub
parent b77b33e790 acc2995d86
commit d578300104
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
db/patch-2fa-invalidate-used-token.sql Normal file
View File

@ -0,0 +1,7 @@
-- You should not modify if this have pushed to Github, unless it does serious wrong with the db.
BEGIN TRANSACTION;
ALTER TABLE user
ADD twofa_last_token VARCHAR(6);
COMMIT;

1
server/database.js
View File

@ -50,6 +50,7 @@ class Database {
"patch-group-table.sql": true, "patch-group-table.sql": true,
"patch-monitor-push_token.sql": true, "patch-monitor-push_token.sql": true,
"patch-http-monitor-method-body-and-headers.sql": true, "patch-http-monitor-method-body-and-headers.sql": true,
"patch-2fa-invalidate-used-token.sql": true,
} }
/** /**

14
server/server.js
View File

@ -292,7 +292,7 @@ exports.entryPage = "dashboard";
if (user) { if (user) {
afterLogin(socket, user); afterLogin(socket, user);
if (user.twofaStatus == 0) { if (user.twofa_status == 0) {
callback({ callback({
ok: true, ok: true,
token: jwt.sign({ token: jwt.sign({
@ -301,7 +301,7 @@ exports.entryPage = "dashboard";
}); });
} }
if (user.twofaStatus == 1 && !data.token) { if (user.twofa_status == 1 && !data.token) {
callback({ callback({
tokenRequired: true, tokenRequired: true,
}); });
@ -310,7 +310,13 @@ exports.entryPage = "dashboard";
if (data.token) { if (data.token) {
let verify = notp.totp.verify(data.token, user.twofa_secret, twofa_verification_opts); let verify = notp.totp.verify(data.token, user.twofa_secret, twofa_verification_opts);
if (verify && verify.delta == 0) { if (user.twofa_last_token !== data.token && verify) {
await R.exec("UPDATE `user` SET twofa_last_token = ? WHERE id = ? ", [
data.token,
socket.userID,
]);
callback({ callback({
ok: true, ok: true,
token: jwt.sign({ token: jwt.sign({
@ -428,7 +434,7 @@ exports.entryPage = "dashboard";
let verify = notp.totp.verify(token, user.twofa_secret, twofa_verification_opts); let verify = notp.totp.verify(token, user.twofa_secret, twofa_verification_opts);
if (verify && verify.delta == 0) { if (user.twofa_last_token !== token && verify) {
callback({ callback({
ok: true, ok: true,
valid: true, valid: true,