Attempt at a fix for #3344

Ylian Saint-Hilaire committed Dec 13, 2021 at 16:29 UTC 40f052e02778260dead512fa08b5fbdcadb21e2a
1 file changed +9 -6
meshuser.js
+9 -6
@@ -4641,16 +4641,19 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
4641 break;
4642 }
4643 case 'twoFactorCookie': {
4644 - // Do not allow this command when logged in using a login token
4645 - if (req.session.loginToken != null) break;
4644 + try {
4645 + // Do not allow this command when logged in using a login token
4646 + if (req.session.loginToken != null) break;
4647 +
4648 + // Do not allows this command is 2FA cookie duration is set to zero
4649 + if (domain.twofactorcookiedurationdays === 0) break;
4650
4647 - // Generate a two-factor cookie
4648 - if (((domain.twofactorcookiedurationdays == null) || (domain.twofactorcookiedurationdays > 0))) {
4651 + // Generate a two-factor cookie
4652 var maxCookieAge = domain.twofactorcookiedurationdays;
4650 - if (typeof maxCookieAge != 'number') { maxCookieAge = 30; }
4653 + if ((typeof maxCookieAge != 'number') || (maxCookieAge < 1)) { maxCookieAge = 30; }
4654 const twoFactorCookie = parent.parent.encodeCookie({ userid: user._id, expire: maxCookieAge * 24 * 60 /*, ip: req.clientIp*/ }, parent.parent.loginCookieEncryptionKey);
4655 try { ws.send(JSON.stringify({ action: 'twoFactorCookie', cookie: twoFactorCookie })); } catch (ex) { }
4653 - }
4656 + } catch (ex) { console.log(ex); }
4657 break;
4658 }
4659 case 'amtsetupbin': {