Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix 2FA bypass via password reset #3715

Merged
merged 2 commits into from
Jul 25, 2023
Merged

Fix 2FA bypass via password reset #3715

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
967d9ff
Dont authenticate user after successful password reset #3714
into-the-v0id Jul 25, 2023
46f87ca
Merge branch 'main' into bugfix/2fa-bypass-using-password-reset
dessalines Jul 25, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
38 changes: 8 additions & 30 deletions crates/api/src/local_user/change_password_after_reset.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,15 +5,11 @@ use lemmy_api_common::{
person::{LoginResponse, PasswordChangeAfterReset},
utils::password_length_check,
};
use lemmy_db_schema::{
source::{local_user::LocalUser, password_reset_request::PasswordResetRequest},
RegistrationMode,
};
use lemmy_db_views::structs::SiteView;
use lemmy_utils::{
claims::Claims,
error::{LemmyError, LemmyErrorExt, LemmyErrorType},
use lemmy_db_schema::source::{
local_user::LocalUser,
password_reset_request::PasswordResetRequest,
};
use lemmy_utils::error::{LemmyError, LemmyErrorExt, LemmyErrorType};

#[async_trait::async_trait(?Send)]
impl Perform for PasswordChangeAfterReset {
Expand All @@ -38,30 +34,12 @@ impl Perform for PasswordChangeAfterReset {

// Update the user with the new password
let password = data.password.clone();
let updated_local_user =
LocalUser::update_password(&mut context.pool(), local_user_id, &password)
.await
.with_lemmy_type(LemmyErrorType::CouldntUpdateUser)?;

// Return the jwt if login is allowed
let site_view = SiteView::read_local(&mut context.pool()).await?;
let jwt = if site_view.local_site.registration_mode == RegistrationMode::RequireApplication
&& !updated_local_user.accepted_application
{
None
} else {
Some(
Claims::jwt(
updated_local_user.id.0,
&context.secret().jwt_secret,
&context.settings().hostname,
)?
.into(),
)
};
LocalUser::update_password(&mut context.pool(), local_user_id, &password)
.await
.with_lemmy_type(LemmyErrorType::CouldntUpdateUser)?;

Ok(LoginResponse {
jwt,
jwt: None,
verify_email_sent: false,
registration_created: false,
})
Expand Down