beenull/power-mailinabox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Only update mru_token for matched mfa row

Browse source
This commit is contained in:
Felix Spöttel 2020-09-29 20:05:58 +02:00
parent be5032ffbe
commit ada2167d08
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
management/mfa.py
View file

@ -43,9 +43,9 @@ def enable_mfa(email, type, secret, token, label, env):
c.execute('INSERT INTO mfa (user_id, type, secret, label) VALUES (?, ?, ?, ?)', (get_user_id(email, c), type, secret, label)) c.execute('INSERT INTO mfa (user_id, type, secret, label) VALUES (?, ?, ?, ?)', (get_user_id(email, c), type, secret, label))
conn.commit() conn.commit()
def set_mru_token(email, token, env): def set_mru_token(email, mfa_id, token, env):
conn, c = open_database(env, with_connection=True) conn, c = open_database(env, with_connection=True)
c.execute('UPDATE mfa SET mru_token=? WHERE user_id=?', (token, get_user_id(email, c))) c.execute('UPDATE mfa SET mru_token=? WHERE user_id=? AND id=?', (token, get_user_id(email, c), mfa_id))
conn.commit() conn.commit()
def disable_mfa(email, mfa_id, env): def disable_mfa(email, mfa_id, env):
@ -127,7 +127,7 @@ def validate_auth_mfa(email, request, env):
continue continue
# On success, record the token to prevent a replay attack. # On success, record the token to prevent a replay attack.
set_mru_token(email, token, env) set_mru_token(email, mfa_mode['id'], token, env)
return (True, []) return (True, [])
# On a failed login, indicate failure and any hints for what the user can do instead. # On a failed login, indicate failure and any hints for what the user can do instead.