mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Error out early on an expired token 

Fixes #12131

If we hit an expired token there is no need to continue checking. Since
we know it is a token.

We also should not register this with the bruteforce throttler as it is
actually a valid token. Just expired. Instead the authentication should
fail. And buisness continues as usual.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
This commit is contained in:
Roeland Jago Douma 2018-10-30 13:19:59 +01:00
parent 674930da7f
commit 2223d19997
No known key found for this signature in database
GPG Key ID: F941078878347C0C
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
lib/private/User/Session.php
View File

@ -38,6 +38,7 @@
namespace OC\User; namespace OC\User;
use OC; use OC;
use OC\Authentication\Exceptions\ExpiredTokenException;
use OC\Authentication\Exceptions\InvalidTokenException; use OC\Authentication\Exceptions\InvalidTokenException;
use OC\Authentication\Exceptions\PasswordlessTokenException; use OC\Authentication\Exceptions\PasswordlessTokenException;
use OC\Authentication\Exceptions\PasswordLoginForbiddenException; use OC\Authentication\Exceptions\PasswordLoginForbiddenException;
@ -401,7 +402,13 @@ class Session implements IUserSession, Emitter {
$this->manager->emit('\OC\User', 'preLogin', array($user, $password)); $this->manager->emit('\OC\User', 'preLogin', array($user, $password));
} }
$isTokenPassword = $this->isTokenPassword($password); try {
$isTokenPassword = $this->isTokenPassword($password);
} catch (ExpiredTokenException $e) {
// Just return on an expired token no need to check further or record a failed login
return false;
}
if (!$isTokenPassword && $this->isTokenAuthEnforced()) { if (!$isTokenPassword && $this->isTokenAuthEnforced()) {
throw new PasswordLoginForbiddenException(); throw new PasswordLoginForbiddenException();
} }
@ -474,11 +481,14 @@ class Session implements IUserSession, Emitter {
* *
* @param string $password * @param string $password
* @return boolean * @return boolean
* @throws ExpiredTokenException
*/ */
public function isTokenPassword($password) { public function isTokenPassword($password) {
try { try {
$this->tokenProvider->getToken($password); $this->tokenProvider->getToken($password);
return true; return true;
} catch (ExpiredTokenException $e) {
throw $e;
} catch (InvalidTokenException $ex) { } catch (InvalidTokenException $ex) {
return false; return false;
} }