mirror/Notes
1
0
Fork 0
mirror of https://github.com/TriliumNext/Notes.git synced 2026-02-17 19:58:46 -06:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1597 from TriliumNext/hotfix/totp-validation-bypass

Browse Source 
hotfix(auth): fix TOTP validation bypass issue
This commit is contained in:
JYC333
2025-04-02 11:42:38 +02:00
committed by GitHub
parent 9a5793dfdd 30fb754a5f
commit 9f3076755c
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/routes/login.ts
View File

@@ -77,11 +77,6 @@ function login(req: Request, res: Response) {
const submittedPassword = req.body.password;
const submittedTotpToken = req.body.totpToken;
if (!verifyPassword(submittedPassword)) {
sendLoginError(req, res, 'password');
return;
}
if (totp.isTotpEnabled()) {
if (!verifyTOTP(submittedTotpToken)) {
sendLoginError(req, res, 'totp');
@@ -89,6 +84,11 @@ function login(req: Request, res: Response) {
}
}
if (!verifyPassword(submittedPassword)) {
sendLoginError(req, res, 'password');
return;
}
const rememberMe = req.body.rememberMe;
req.session.regenerate(() => {