diff options
| author | zeripath <art27@cantab.net> | 2022-02-10 15:17:44 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-02-10 16:17:44 +0100 |
| commit | 2e317d3f6e2a613c2eeee6f6c69d990ec24cad3a (patch) | |
| tree | 6c2971b3f3c31871e074e9a81c3913064cdc77a2 /modules | |
| parent | ce69882180bb07d07d4e95ac0398b580484d27b5 (diff) | |
| download | gitea-2e317d3f6e2a613c2eeee6f6c69d990ec24cad3a.tar.gz gitea-2e317d3f6e2a613c2eeee6f6c69d990ec24cad3a.zip | |
Prevent security failure due to bad APP_ID (#18678) (#18682)
Backport #18678
WebAuthn may cause a security exception if the provided APP_ID is not allowed for the
current origin. Therefore we should reattempt authentication without the appid
extension.
Also we should allow [u2f] as-well as [U2F] sections.
Signed-off-by: Andrew Thornton <art27@cantab.net>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/setting/setting.go | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/modules/setting/setting.go b/modules/setting/setting.go index abd6716c74..3b21bcc768 100644 --- a/modules/setting/setting.go +++ b/modules/setting/setting.go @@ -1022,8 +1022,13 @@ func loadFromConf(allowEmpty bool, extraConfig string) { UI.CustomEmojisMap[emoji] = ":" + emoji + ":" } - sec = Cfg.Section("U2F") - U2F.AppID = sec.Key("APP_ID").MustString(strings.TrimSuffix(AppURL, "/")) + // FIXME: DEPRECATED to be removed in v1.18.0 + U2F.AppID = strings.TrimSuffix(AppURL, "/") + if Cfg.Section("U2F").HasKey("APP_ID") { + U2F.AppID = Cfg.Section("U2F").Key("APP_ID").MustString(strings.TrimSuffix(AppURL, "/")) + } else if Cfg.Section("u2f").HasKey("APP_ID") { + U2F.AppID = Cfg.Section("u2f").Key("APP_ID").MustString(strings.TrimSuffix(AppURL, "/")) + } } func parseAuthorizedPrincipalsAllow(values []string) ([]string, bool) { @@ -1162,7 +1167,6 @@ func MakeManifestData(appName, appURL, absoluteAssetURL string) []byte { }, }, }) - if err != nil { log.Error("unable to marshal manifest JSON. Error: %v", err) return make([]byte, 0) |