11af2592 · cryptotaxi247/MeshCentral

@@ -948,6 +948,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

948 req.session.loginmode = '4';

949 req.session.tokenemail = ((user.email != null) && (user.emailVerified == true) && (parent.mailserver != null) && (user.otpekey != null));

950 req.session.tokensms = ((user.phone != null) && (parent.smsserver != null));

951 + req.session.tokenuserid = userid;

952 req.session.tokenusername = xusername;

953 req.session.tokenpassword = xpassword;

954 if (direct === true) { handleRootRequestEx(req, res, domain); } else { res.redirect(domain.url + getQueryPortion(req)); }

@@ -1042,6 +1043,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

1043 parent.debug('web', 'handleLoginRequest: login ok, password change requested');

1044 req.session.loginmode = '6';

1045 req.session.messageid = 113; // Password change requested.

1046 + req.session.resettokenuserid = userid;

1047 req.session.resettokenusername = xusername;

1048 req.session.resettokenpassword = xpassword;

1049 if (direct === true) { handleRootRequestEx(req, res, domain); } else { res.redirect(domain.url + getQueryPortion(req)); }

@@ -1062,6 +1064,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

1064 //req.session.regenerate(function () {

1065 // Store the user's primary key in the session store to be retrieved, or in this case the entire user object

1066 delete req.session.loginmode;

1067 + delete req.session.tokenuserid;

1068 delete req.session.tokenusername;

1069 delete req.session.tokenpassword;

1070 delete req.session.tokenemail;

@@ -1254,8 +1257,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

1257 if ((domain == null) || (domain.auth == 'sspi') || (domain.auth == 'ldap') || (typeof req.body.rpassword1 != 'string') || (typeof req.body.rpassword2 != 'string') || (req.body.rpassword1 != req.body.rpassword2) || (typeof req.body.rpasswordhint != 'string') || (req.session == null) || (typeof req.session.resettokenusername != 'string') || (typeof req.session.resettokenpassword != 'string')) {

1258 parent.debug('web', 'handleResetPasswordRequest: checks failed');

1259 delete req.session.loginmode;

1260 + delete req.session.tokenuserid;

1261 delete req.session.tokenusername;

1262 delete req.session.tokenpassword;

1263 + delete req.session.resettokenuserid;

1264 delete req.session.resettokenusername;

1265 delete req.session.resettokenpassword;

1266 delete req.session.tokenemail;

@@ -1317,8 +1322,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

1322 // Failed, error out.

1323 parent.debug('web', 'handleResetPasswordRequest: failed authenticate()');

1324 delete req.session.loginmode;

1325 + delete req.session.tokenuserid;

1326 delete req.session.tokenusername;

1327 delete req.session.tokenpassword;

1328 + delete req.session.resettokenuserid;

1329 delete req.session.resettokenusername;

1330 delete req.session.resettokenpassword;

1331 delete req.session.tokenemail;

@@ -2268,8 +2275,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {

2275 // Send back the login application

2276 // If this is a 2 factor auth request, look for a hardware key challenge.

2277 // Normal login 2 factor request

2271 - if (req.session && (req.session.loginmode == '4') && (req.session.tokenusername)) {

2272 - var user = obj.users['user/' + domain.id + '/' + req.session.tokenusername.toLowerCase()];

2278 + if (req.session && (req.session.loginmode == '4') && (req.session.tokenuserid)) {

2279 + var user = obj.users[req.session.tokenuserid];

2280 if (user != null) {

2281 parent.debug('web', 'handleRootRequestEx: sending 2FA challenge.');

2282 getHardwareKeyChallenge(req, domain, user, function (hwchallenge) { handleRootRequestLogin(req, res, domain, hwchallenge, passRequirements); });

Fixed FIDO2 HW keys with LDAP.