7x31/uptime-kuma
1
0
Fork 0
mirror of https://github.com/louislam/uptime-kuma.git synced 2025-08-08 17:13:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #743 from andreasbrett/patch-4

Browse Source 
Harden 2FA/TOTP implementation according to rfc6238 (part 2)
This commit is contained in:
Louis Lam
2021-10-23 17:00:46 +08:00
committed by GitHub
parent b77b33e790 acc2995d86
commit d578300104
3 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
server/database.js
View File

@@ -50,6 +50,7 @@ class Database {
"patch-group-table.sql": true,
"patch-monitor-push_token.sql": true,
"patch-http-monitor-method-body-and-headers.sql": true,
"patch-2fa-invalidate-used-token.sql": true,
}
/**

14
server/server.js
View File

@@ -292,7 +292,7 @@ exports.entryPage = "dashboard";
if (user) {
afterLogin(socket, user);
if (user.twofaStatus == 0) {
if (user.twofa_status == 0) {
callback({
ok: true,
token: jwt.sign({
@@ -301,7 +301,7 @@ exports.entryPage = "dashboard";
});
}
if (user.twofaStatus == 1 && !data.token) {
if (user.twofa_status == 1 && !data.token) {
callback({
tokenRequired: true,
});
@@ -310,7 +310,13 @@ exports.entryPage = "dashboard";
if (data.token) {
let verify = notp.totp.verify(data.token, user.twofa_secret, twofa_verification_opts);
if (verify && verify.delta == 0) {
if (user.twofa_last_token !== data.token && verify) {
await R.exec("UPDATE `user` SET twofa_last_token = ? WHERE id = ? ", [
data.token,
socket.userID,
]);
callback({
ok: true,
token: jwt.sign({
@@ -428,7 +434,7 @@ exports.entryPage = "dashboard";
let verify = notp.totp.verify(token, user.twofa_secret, twofa_verification_opts);
if (verify && verify.delta == 0) {
if (user.twofa_last_token !== token && verify) {
callback({
ok: true,
valid: true,