AppAPI: allowed to bypass Two-Factor

Signed-off-by: Alexander Piskun <bigcat88@icloud.com>

diff --git a/core/Middleware/TwoFactorMiddleware.php b/core/Middleware/TwoFactorMiddleware.php
index f421528dff718ec79de3572bdefa29594bee3d36..4b5618eb23d80d0341a8968810d7fd7728787237 100644 (file)
--- a/core/Middleware/TwoFactorMiddleware.php
+++ b/core/Middleware/TwoFactorMiddleware.php
@@ -100,7 +100,10 @@ class TwoFactorMiddleware extends Middleware {
                if ($this->userSession->isLoggedIn()) {
                        $user = $this->userSession->getUser();
 
-                       if ($this->session->exists('app_password') || $this->twoFactorManager->isTwoFactorAuthenticated($user)) {
+                       if ($this->session->exists('app_password')  // authenticated using an app password
+                               || $this->session->exists('app_api')  // authenticated using an AppAPI Auth
+                               || $this->twoFactorManager->isTwoFactorAuthenticated($user)) {
+
                                $this->checkTwoFactor($controller, $methodName, $user);
                        } elseif ($controller instanceof TwoFactorChallengeController) {
                                // Allow access to the two-factor controllers only if two-factor authentication

diff --git a/lib/private/Authentication/TwoFactorAuth/Manager.php b/lib/private/Authentication/TwoFactorAuth/Manager.php
index b0bb73c3115b51609e8335812545f25e1e5e8544..4defcb9a58502974b8683cb4b1591d2eb90264c3 100644 (file)
--- a/lib/private/Authentication/TwoFactorAuth/Manager.php
+++ b/lib/private/Authentication/TwoFactorAuth/Manager.php
@@ -318,8 +318,8 @@ class Manager {
                        return false;
                }
 
-               // If we are authenticated using an app password skip all this
-               if ($this->session->exists('app_password')) {
+               // If we are authenticated using an app password or AppAPI Auth, skip all this
+               if ($this->session->exists('app_password') || $this->session->get('app_api') === true) {
                        return false;
                }
 

diff --git a/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php b/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php
index 3c82878065e658cf5d9e67b55a1c0bfd4f3d2a04..a2655f58649e550a088db4ee11dcce18342ad509 100644 (file)
--- a/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php
+++ b/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php
@@ -629,13 +629,26 @@ class ManagerTest extends TestCase {
                                        return false;
                                } elseif ($var === 'app_password') {
                                        return false;
+                               } elseif ($var === 'app_api') {
+                                       return false;
                                }
                                return true;
                        });
+               $this->session->method('get')
+                       ->willReturnCallback(function ($var) {
+                               if ($var === Manager::SESSION_UID_KEY) {
+                                       return 'user';
+                               } elseif ($var === 'app_api') {
+                                       return true;
+                               }
+                               return null;
+                       });
                $this->session->expects($this->once())
                        ->method('get')
-                       ->with(Manager::SESSION_UID_DONE)
-                       ->willReturn('user');
+                       ->willReturnMap([
+                               [Manager::SESSION_UID_DONE, 'user'],
+                               ['app_api', true]
+                       ]);
 
                $this->assertFalse($this->manager->needsSecondFactor($user));
        }
@@ -695,8 +708,10 @@ class ManagerTest extends TestCase {
        public function testNeedsSecondFactorAppPassword() {
                $user = $this->createMock(IUser::class);
                $this->session->method('exists')
-                       ->with('app_password')
-                       ->willReturn(true);
+                       ->willReturnMap([
+                               ['app_password', true],
+                               ['app_api', true]
+                       ]);
 
                $this->assertFalse($this->manager->needsSecondFactor($user));
        }