lamassu/lamassu-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: temp two factor secret checking on two factor reset

Browse source
This commit is contained in:
Sérgio Salgado 2021-04-19 16:46:43 +01:00 • committed by Josh Harvey
parent 928caaf167
commit 357fe75427
2 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/new-admin/graphql/modules/authentication.js
View file

@ -272,8 +272,12 @@ const reset2FA = (token, userID, code, secret, context) => {
return users.getUserById(userID)
.then(user => {
destroySessionIfSameUser(context, user)
return users.reset2FASecret(token, user.id, secret).then(() => true)
if (user.temp_twofa_code !== secret) {
throw new authErrors.InvalidTwoFactorError()
}
return users.reset2FASecret(token, user.id, secret)
})
.then(() => true)
.catch(err => console.error(err))
}