external/MeshCentral
1
0
Fork 0
mirror of https://github.com/Ylianst/MeshCentral.git synced 2025-02-12 11:01:52 +00:00
Code Issues Releases Wiki Activity

Merge pull request #5229 from jirijanata/master

Browse source 
Fix basic URL user/pass auth to fail if user has 2FA
This commit is contained in:
Ylian Saint-Hilaire 2023-07-16 12:43:11 -07:00 committed by GitHub
commit 3ea83158fb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
webserver.js
View file

@ -2813,7 +2813,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
} else if (req.query.user && req.query.pass) { } else if (req.query.user && req.query.pass) {
// User credentials are being passed in the URL. WARNING: Putting credentials in a URL is bad security... but people are requesting this option. // User credentials are being passed in the URL. WARNING: Putting credentials in a URL is bad security... but people are requesting this option.
obj.authenticate(req.query.user, req.query.pass, domain, function (err, userid, passhint, loginOptions) { obj.authenticate(req.query.user, req.query.pass, domain, function (err, userid, passhint, loginOptions) {
if ((userid != null) && (err == null)) { // 2FA is not supported in URL authentication method. If user has 2FA enabled, this login method fails.
var user = obj.users[userid];
if (checkUserOneTimePasswordRequired(domain, user, req, loginOptions) == true) {
handleRootRequestEx(req, res, domain, direct);
} else if ((userid != null) && (err == null)) {
// Login success // Login success
parent.debug('web', 'handleRootRequest: user/pass in URL auth ok.'); parent.debug('web', 'handleRootRequest: user/pass in URL auth ok.');
req.session.userid = userid; req.session.userid = userid;