If is user using 2FA the basic URL user and pass method fails.
https://github.com/Ylianst/MeshCentral/issues/4870 If user has 2FA enabled and tries to login with URL parameters then the login should fail.
jirijanata committed
Jul 5, 2023 at 19:15 UTC
3f0d9484b78a2d4906090382ffd3edd3dde1b5b6
1 file changed
+5
-1
webserver.js
+5
-1
@@ -2813,7 +2813,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2813
} else if (req.query.user && req.query.pass) {
2814
// User credentials are being passed in the URL. WARNING: Putting credentials in a URL is bad security... but people are requesting this option.
2815
obj.authenticate(req.query.user, req.query.pass, domain, function (err, userid, passhint, loginOptions) {
2816
- if ((userid != null) && (err == null)) {
2816
+ // 2FA is not supported in URL authentication method. If user has 2FA enabled, this login method fails.
2817
+ var user = obj.users[userid];
2818
+ if (checkUserOneTimePasswordRequired(domain, user, req, loginOptions) == true) {
2819
+ handleRootRequestEx(req, res, domain, direct);
2820
+ } else if ((userid != null) && (err == null)) {
2821
// Login success
2822
parent.debug('web', 'handleRootRequest: user/pass in URL auth ok.');
2823
req.session.userid = userid;