fen/uptime-kuma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

invalidate used token

Browse source
This commit is contained in:
Andreas Brett 2021-10-19 00:42:33 +02:00
parent c6fc385289
commit acc2995d86
3 changed files with 18 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
db/patch-2fa-invalidate-used-token.sql Normal file
View file

@ -0,0 +1,7 @@
-- You should not modify if this have pushed to Github, unless it does serious wrong with the db.
BEGIN TRANSACTION;
ALTER TABLE user
ADD twofa_last_token VARCHAR(6);
COMMIT;

1
server/database.js
View file

@ -50,6 +50,7 @@ class Database {
"patch-group-table.sql": true, "patch-group-table.sql": true,
"patch-monitor-push_token.sql": true, "patch-monitor-push_token.sql": true,
"patch-http-monitor-method-body-and-headers.sql": true, "patch-http-monitor-method-body-and-headers.sql": true,
"patch-2fa-invalidate-used-token.sql": true,
} }
/** /**

14
server/server.js
View file

@ -265,7 +265,7 @@ exports.entryPage = "dashboard";
if (user) { if (user) {
afterLogin(socket, user); afterLogin(socket, user);
if (user.twofaStatus == 0) { if (user.twofa_status == 0) {
callback({ callback({
ok: true, ok: true,
token: jwt.sign({ token: jwt.sign({
@ -274,7 +274,7 @@ exports.entryPage = "dashboard";
}); });
} }
if (user.twofaStatus == 1 && !data.token) { if (user.twofa_status == 1 && !data.token) {
callback({ callback({
tokenRequired: true, tokenRequired: true,
}); });
@ -283,7 +283,13 @@ exports.entryPage = "dashboard";
if (data.token) { if (data.token) {
let verify = notp.totp.verify(data.token, user.twofa_secret, twofa_verification_opts); let verify = notp.totp.verify(data.token, user.twofa_secret, twofa_verification_opts);
if (verify && verify.delta == 0) { if (user.twofa_last_token !== data.token && verify) {
await R.exec("UPDATE `user` SET twofa_last_token = ? WHERE id = ? ", [
data.token,
socket.userID,
]);
callback({ callback({
ok: true, ok: true,
token: jwt.sign({ token: jwt.sign({
@ -401,7 +407,7 @@ exports.entryPage = "dashboard";
let verify = notp.totp.verify(token, user.twofa_secret, twofa_verification_opts); let verify = notp.totp.verify(token, user.twofa_secret, twofa_verification_opts);
if (verify && verify.delta == 0) { if (user.twofa_last_token !== token && verify) {
callback({ callback({
ok: true, ok: true,
valid: true, valid: true,