From 26d343d33aa763b7126937680769525e51638b90 Mon Sep 17 00:00:00 2001 From: Alexander Piskun Date: Mon, 25 Dec 2023 18:12:54 +0300 Subject: [PATCH] AppAPI: allowed to bypass Two-Factor Signed-off-by: Alexander Piskun --- core/Middleware/TwoFactorMiddleware.php | 5 +++- .../Authentication/TwoFactorAuth/Manager.php | 4 ++-- .../TwoFactorAuth/ManagerTest.php | 23 +++++++++++++++---- 3 files changed, 25 insertions(+), 7 deletions(-) diff --git a/core/Middleware/TwoFactorMiddleware.php b/core/Middleware/TwoFactorMiddleware.php index f421528dff7..4b5618eb23d 100644 --- a/core/Middleware/TwoFactorMiddleware.php +++ b/core/Middleware/TwoFactorMiddleware.php @@ -100,7 +100,10 @@ class TwoFactorMiddleware extends Middleware { if ($this->userSession->isLoggedIn()) { $user = $this->userSession->getUser(); - if ($this->session->exists('app_password') || $this->twoFactorManager->isTwoFactorAuthenticated($user)) { + if ($this->session->exists('app_password') // authenticated using an app password + || $this->session->exists('app_api') // authenticated using an AppAPI Auth + || $this->twoFactorManager->isTwoFactorAuthenticated($user)) { + $this->checkTwoFactor($controller, $methodName, $user); } elseif ($controller instanceof TwoFactorChallengeController) { // Allow access to the two-factor controllers only if two-factor authentication diff --git a/lib/private/Authentication/TwoFactorAuth/Manager.php b/lib/private/Authentication/TwoFactorAuth/Manager.php index b0bb73c3115..4defcb9a585 100644 --- a/lib/private/Authentication/TwoFactorAuth/Manager.php +++ b/lib/private/Authentication/TwoFactorAuth/Manager.php @@ -318,8 +318,8 @@ class Manager { return false; } - // If we are authenticated using an app password skip all this - if ($this->session->exists('app_password')) { + // If we are authenticated using an app password or AppAPI Auth, skip all this + if ($this->session->exists('app_password') || $this->session->get('app_api') === true) { return false; } diff --git a/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php b/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php index 3c82878065e..a2655f58649 100644 --- a/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php +++ b/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php @@ -629,13 +629,26 @@ class ManagerTest extends TestCase { return false; } elseif ($var === 'app_password') { return false; + } elseif ($var === 'app_api') { + return false; } return true; }); + $this->session->method('get') + ->willReturnCallback(function ($var) { + if ($var === Manager::SESSION_UID_KEY) { + return 'user'; + } elseif ($var === 'app_api') { + return true; + } + return null; + }); $this->session->expects($this->once()) ->method('get') - ->with(Manager::SESSION_UID_DONE) - ->willReturn('user'); + ->willReturnMap([ + [Manager::SESSION_UID_DONE, 'user'], + ['app_api', true] + ]); $this->assertFalse($this->manager->needsSecondFactor($user)); } @@ -695,8 +708,10 @@ class ManagerTest extends TestCase { public function testNeedsSecondFactorAppPassword() { $user = $this->createMock(IUser::class); $this->session->method('exists') - ->with('app_password') - ->willReturn(true); + ->willReturnMap([ + ['app_password', true], + ['app_api', true] + ]); $this->assertFalse($this->manager->needsSecondFactor($user)); } -- 2.39.5