From 2e317d3f6e2a613c2eeee6f6c69d990ec24cad3a Mon Sep 17 00:00:00 2001 From: zeripath Date: Thu, 10 Feb 2022 15:17:44 +0000 Subject: Prevent security failure due to bad APP_ID (#18678) (#18682) Backport #18678 WebAuthn may cause a security exception if the provided APP_ID is not allowed for the current origin. Therefore we should reattempt authentication without the appid extension. Also we should allow [u2f] as-well as [U2F] sections. Signed-off-by: Andrew Thornton Co-authored-by: Lunny Xiao --- modules/setting/setting.go | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'modules') diff --git a/modules/setting/setting.go b/modules/setting/setting.go index abd6716c74..3b21bcc768 100644 --- a/modules/setting/setting.go +++ b/modules/setting/setting.go @@ -1022,8 +1022,13 @@ func loadFromConf(allowEmpty bool, extraConfig string) { UI.CustomEmojisMap[emoji] = ":" + emoji + ":" } - sec = Cfg.Section("U2F") - U2F.AppID = sec.Key("APP_ID").MustString(strings.TrimSuffix(AppURL, "/")) + // FIXME: DEPRECATED to be removed in v1.18.0 + U2F.AppID = strings.TrimSuffix(AppURL, "/") + if Cfg.Section("U2F").HasKey("APP_ID") { + U2F.AppID = Cfg.Section("U2F").Key("APP_ID").MustString(strings.TrimSuffix(AppURL, "/")) + } else if Cfg.Section("u2f").HasKey("APP_ID") { + U2F.AppID = Cfg.Section("u2f").Key("APP_ID").MustString(strings.TrimSuffix(AppURL, "/")) + } } func parseAuthorizedPrincipalsAllow(values []string) ([]string, bool) { @@ -1162,7 +1167,6 @@ func MakeManifestData(appName, appURL, absoluteAssetURL string) []byte { }, }, }) - if err != nil { log.Error("unable to marshal manifest JSON. Error: %v", err) return make([]byte, 0) -- cgit v1.2.3