lamassu/lamassu-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: temp two factor secret checking on two factor reset

Browse source
This commit is contained in:
Sérgio Salgado 2021-04-19 16:46:43 +01:00 • committed by Josh Harvey
parent 928caaf167
commit 357fe75427
2 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/users.js
View file

@ -89,7 +89,7 @@ function reset2FASecret (token, id, secret) {
return validateAuthToken(token, 'reset_twofa').then(res => {
if (!res.success) throw new Error('Failed to verify 2FA reset token')
return db.tx(t => {
const q1 = t.none('UPDATE users SET twofa_code=$1 WHERE id=$2', [secret, id])
const q1 = t.none('UPDATE users SET twofa_code=$1, temp_twofa_code=NULL WHERE id=$2', [secret, id])
const q2 = t.none(`DELETE FROM user_sessions WHERE sess -> 'user' ->> 'id'=$1`, [id])
const q3 = t.none(`DELETE FROM auth_tokens WHERE token=$1 and type='reset_twofa'`, [token])
return t.batch([q1, q2, q3])