diff options
| author | Roeland Jago Douma <roeland@famdouma.nl> | 2019-01-28 18:12:06 +0300 |
|---|---|---|
| committer | Roeland Jago Douma <roeland@famdouma.nl> | 2019-01-30 12:45:02 +0300 |
| commit | 0a17836fec59120cef54cdacf1535d45013dd6f8 (patch) | |
| tree | 2a637030afd6c6ec6e4e610215e842a9911f9035 /core | |
| parent | 9cbcf03a78c59f289440a22337eef13a4b2a3b5b (diff) | |
Clean pending 2FA authentication on password reset
When a password is reste we should make sure that all users are properly
logged in. Pending states should be cleared. For example a session where
the 2FA code is not entered yet should be cleared.
The token is now removed so the session will be killed the next time
this is checked (within 5 minutes).
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Diffstat (limited to 'core')
| -rw-r--r-- | core/Controller/LostController.php | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/core/Controller/LostController.php b/core/Controller/LostController.php index d30c6ae1ebd..4fdb63484f5 100644 --- a/core/Controller/LostController.php +++ b/core/Controller/LostController.php @@ -31,6 +31,7 @@ namespace OC\Core\Controller; +use OC\Authentication\TwoFactorAuth\Manager; use OC\HintException; use \OCP\AppFramework\Controller; use OCP\AppFramework\Http\JSONResponse; @@ -57,7 +58,6 @@ use OCP\Security\ISecureRandom; * @package OC\Core\Controller */ class LostController extends Controller { - /** @var IURLGenerator */ protected $urlGenerator; /** @var IUserManager */ @@ -80,6 +80,8 @@ class LostController extends Controller { protected $timeFactory; /** @var ICrypto */ protected $crypto; + /** @var Manager */ + private $twoFactorManager; /** * @param string $appName @@ -108,7 +110,8 @@ class LostController extends Controller { IManager $encryptionManager, IMailer $mailer, ITimeFactory $timeFactory, - ICrypto $crypto) { + ICrypto $crypto, + Manager $twoFactorManager) { parent::__construct($appName, $request); $this->urlGenerator = $urlGenerator; $this->userManager = $userManager; @@ -121,6 +124,7 @@ class LostController extends Controller { $this->mailer = $mailer; $this->timeFactory = $timeFactory; $this->crypto = $crypto; + $this->twoFactorManager = $twoFactorManager; } /** @@ -283,6 +287,8 @@ class LostController extends Controller { \OC_Hook::emit('\OC\Core\LostPassword\Controller\LostController', 'post_passwordReset', array('uid' => $userId, 'password' => $password)); + $this->twoFactorManager->clearTwoFactorPending($userId); + $this->config->deleteUserValue($userId, 'core', 'lostpassword'); @\OC::$server->getUserSession()->unsetMagicInCookie(); } catch (HintException $e){ |