diff options
| author | Daniel García <[email protected]> | 2024-11-15 11:26:06 +0100 |
|---|---|---|
| committer | GitHub <[email protected]> | 2024-11-15 11:26:06 +0100 |
| commit | 548db625615175df8030968212dae617fb20e969 (patch) | |
| tree | 8f9ce3878429eafb3890adbe053e948cc07c84c4 | |
| parent | f819e6c728dcbf9a3a27fb603c76e8ea7697953d (diff) | |
| parent | 0d16b38a68c702e7f300a64f9e55d897916ae238 (diff) | |
| download | vaultwarden-ssh_keys.tar.gz vaultwarden-ssh_keys.zip | |
Merge branch 'main' into ssh_keysssh_keys
| -rw-r--r-- | src/api/core/accounts.rs | 10 | ||||
| -rw-r--r-- | src/api/identity.rs | 4 |
2 files changed, 12 insertions, 2 deletions
diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs index 1e89ea93..87e44529 100644 --- a/src/api/core/accounts.rs +++ b/src/api/core/accounts.rs @@ -1253,11 +1253,19 @@ async fn put_auth_request( err!("AuthRequest doesn't exist", "User uuid's do not match") } + if auth_request.approved.is_some() { + err!("An authentication request with the same device already exists") + } + + let response_date = Utc::now().naive_utc(); + let response_date_utc = format_date(&response_date); + if data.request_approved { auth_request.approved = Some(data.request_approved); auth_request.enc_key = Some(data.key); auth_request.master_password_hash = data.master_password_hash; auth_request.response_device_id = Some(data.device_identifier.clone()); + auth_request.response_date = Some(response_date); auth_request.save(&mut conn).await?; ant.send_auth_response(&auth_request.user_uuid, &auth_request.uuid).await; @@ -1267,8 +1275,6 @@ async fn put_auth_request( auth_request.delete(&mut conn).await?; } - let response_date_utc = auth_request.response_date.map(|response_date| format_date(&response_date)); - Ok(Json(json!({ "id": uuid, "publicKey": auth_request.public_key, diff --git a/src/api/identity.rs b/src/api/identity.rs index f2618164..445d61fd 100644 --- a/src/api/identity.rs +++ b/src/api/identity.rs @@ -190,8 +190,12 @@ async fn _password_login( ) }; + let expiration_time = auth_request.creation_date + chrono::Duration::minutes(5); + let request_expired = Utc::now().naive_utc() >= expiration_time; + if auth_request.user_uuid != user.uuid || !auth_request.approved.unwrap_or(false) + || request_expired || ip.ip.to_string() != auth_request.request_ip || !auth_request.check_access_code(password) { |