MeshCMD inner auth 2FA fixes.
Ylian Saint-Hilaire committed
Apr 2, 2021 at 22:35 UTC
6ddf4bd15168d39890f49ba244e6f0ba503cf7c7
3 files changed
+16
-7
agents/meshcmd.js
+5
-1
@@ -2023,8 +2023,12 @@ function OnServerWebSocket(msg, s, head) {
2023
if (command.msg == 'tokenrequired') {
2024
if (command.email2fasent === true) {
2025
console.log("Login token email sent.");
2026
- } else if (command.email2fa === true) {
2026
+ } else if ((command.email2fa === true) && (command.sms2fa === true)) {
2027
console.log("Login token required, use --token [token], or --emailtoken, --smstoken get a token.");
2028
+ } else if (command.sms2fa === true) {
2029
+ console.log("Login token required, use --token [token], or --smstoken get a token.");
2030
+ } else if (command.email2fa === true) {
2031
+ console.log("Login token required, use --token [token], or --emailtoken get a token.");
2032
} else {
2033
console.log("Login token required, use --token [token].");
2034
}
amtmanager.js
+1
-1
@@ -2293,7 +2293,7 @@ module.exports.CreateAmtManager = function (parent) {
2293
cert.XPrivateKey = keys[j]; // Link the certificate to the key pair
2294
}
2295
}
2296
- } catch (e) { console.log(e); }
2296
+ } catch (ex) { console.log(ex); }
2297
}
2298
}
2299
webserver.js
+10
-5
@@ -5782,12 +5782,17 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
5782
if ((err == null) && (user)) {
5783
// Check if a 2nd factor is needed
5784
var emailcheck = ((domain.mailserver != null) && (obj.parent.certificates.CommonName != null) && (obj.parent.certificates.CommonName.indexOf('.') != -1) && (obj.args.lanonly != true) && (domain.auth != 'sspi') && (domain.auth != 'ldap'))
5785
+
5786
+ // See if we support two-factor trusted cookies
5787
+ var twoFactorCookieDays = 30;
5788
+ if (typeof domain.twofactorcookiedurationdays == 'number') { twoFactorCookieDays = domain.twofactorcookiedurationdays; }
5789
+
5790
if (checkUserOneTimePasswordRequired(domain, user, req) == true) {
5791
// Figure out if email 2FA is allowed
5792
var email2fa = (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.email2factor != false)) && (domain.mailserver != null) && (user.otpekey != null));
5793
var sms2fa = (((typeof domain.passwordrequirements != 'object') || (domain.passwordrequirements.sms2factor != false)) && (parent.smsserver != null) && (user.phone != null));
5789
- if ((typeof req.query.token != 'string') || (req.query.token == '**email**') || (req.query.token == '**sms**')) {
5790
- if ((req.query.token == '**email**') && (email2fa == true)) {
5794
+ if ((typeof command.token != 'string') || (command.token == '**email**') || (command.token == '**sms**')) {
5795
+ if ((command.token == '**email**') && (email2fa == true)) {
5796
// Cause a token to be sent to the user's registered email
5797
user.otpekey = { k: obj.common.zeroPad(getRandomEightDigitInteger(), 8), d: Date.now() };
5798
obj.db.SetUser(user);
@@ -5795,7 +5800,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
5800
domain.mailserver.sendAccountLoginMail(domain, user.email, user.otpekey.k, obj.getLanguageCodes(req), req.query.key);
5801
// Ask for a login token & confirm email was sent
5802
try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'tokenrequired', email2fa: email2fa, sms2fa: sms2fa, email2fasent: true, twoFactorCookieDays: twoFactorCookieDays })); ws.close(); } catch (e) { }
5798
- } else if ((req.query.token == '**sms**') && (sms2fa == true)) {
5803
+ } else if ((command.token == '**sms**') && (sms2fa == true)) {
5804
// Cause a token to be sent to the user's phone number
5805
user.otpsms = { k: obj.common.zeroPad(getRandomSixDigitInteger(), 6), d: Date.now() };
5806
obj.db.SetUser(user);
@@ -5806,10 +5811,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
5811
} else {
5812
// Ask for a login token
5813
parent.debug('web', 'Asking for login token');
5809
- try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'tokenrequired', email2fa: email2fa, sms2fa: sms2fa, twoFactorCookieDays: twoFactorCookieDays })); ws.close(); } catch (e) { }
5814
+ try { ws.send(JSON.stringify({ action: 'close', cause: 'noauth', msg: 'tokenrequired', email2fa: email2fa, sms2fa: sms2fa, twoFactorCookieDays: twoFactorCookieDays })); ws.close(); } catch (ex) { console.log(ex); }
5815
}
5816
} else {
5812
- checkUserOneTimePassword(req, domain, user, req.query.token, null, function (result) {
5817
+ checkUserOneTimePassword(req, domain, user, command.token, null, function (result) {
5818
if (result == false) {
5819
// Failed, ask for a login token again
5820
parent.debug('web', 'Invalid login token, asking again');