From de13b90e1f435cddcff3f26588825bbde5f37038 Mon Sep 17 00:00:00 2001 From: Alexander Piskun Date: Mon, 25 Dec 2023 18:12:54 +0300 Subject: [PATCH] AppAPI: allowed to bypass Two-Factor Signed-off-by: Alexander Piskun --- core/Middleware/TwoFactorMiddleware.php | 5 +++- .../Authentication/TwoFactorAuth/Manager.php | 4 ++-- .../TwoFactorAuth/ManagerTest.php | 23 +++++++++++++++---- 3 files changed, 25 insertions(+), 7 deletions(-) diff --git a/core/Middleware/TwoFactorMiddleware.php b/core/Middleware/TwoFactorMiddleware.php index 0ea21ce78ded5..d08efe12cce2f 100644 --- a/core/Middleware/TwoFactorMiddleware.php +++ b/core/Middleware/TwoFactorMiddleware.php @@ -124,7 +124,10 @@ public function beforeController($controller, $methodName) { if ($this->userSession->isLoggedIn()) { $user = $this->userSession->getUser(); - if ($this->session->exists('app_password') || $this->twoFactorManager->isTwoFactorAuthenticated($user)) { + if ($this->session->exists('app_password') // authenticated using an app password + || $this->session->exists('app_api') // authenticated using an AppAPI Auth + || $this->twoFactorManager->isTwoFactorAuthenticated($user)) { + $this->checkTwoFactor($controller, $methodName, $user); } elseif ($controller instanceof TwoFactorChallengeController) { // Allow access to the two-factor controllers only if two-factor authentication diff --git a/lib/private/Authentication/TwoFactorAuth/Manager.php b/lib/private/Authentication/TwoFactorAuth/Manager.php index 7e115cf9b4221..b43be868be9af 100644 --- a/lib/private/Authentication/TwoFactorAuth/Manager.php +++ b/lib/private/Authentication/TwoFactorAuth/Manager.php @@ -335,8 +335,8 @@ public function needsSecondFactor(IUser $user = null): bool { return false; } - // If we are authenticated using an app password skip all this - if ($this->session->exists('app_password')) { + // If we are authenticated using an app password or AppAPI Auth, skip all this + if ($this->session->exists('app_password') || $this->session->get('app_api') === true) { return false; } diff --git a/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php b/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php index da11b11e53780..0a57276cd655b 100644 --- a/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php +++ b/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php @@ -636,13 +636,26 @@ public function testNeedsSecondFactorSessionAuth() { return false; } elseif ($var === 'app_password') { return false; + } elseif ($var === 'app_api') { + return false; } return true; }); + $this->session->method('get') + ->willReturnCallback(function ($var) { + if ($var === Manager::SESSION_UID_KEY) { + return 'user'; + } elseif ($var === 'app_api') { + return true; + } + return null; + }); $this->session->expects($this->once()) ->method('get') - ->with(Manager::SESSION_UID_DONE) - ->willReturn('user'); + ->willReturnMap([ + [Manager::SESSION_UID_DONE, 'user'], + ['app_api', true] + ]); $this->assertFalse($this->manager->needsSecondFactor($user)); } @@ -702,8 +715,10 @@ public function testNeedsSecondFactorInvalidToken() { public function testNeedsSecondFactorAppPassword() { $user = $this->createMock(IUser::class); $this->session->method('exists') - ->with('app_password') - ->willReturn(true); + ->willReturnMap([ + ['app_password', true], + ['app_api', true] + ]); $this->assertFalse($this->manager->needsSecondFactor($user)); }