nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-04-05 05:00:19 -05:00
Code

Allow bypass of captcha token if the device is known (#1626)

Browse Source
This commit is contained in:
Matt Gibson 2021-10-08 18:59:35 -05:00 committed by GitHub
parent ee7b608a46
commit 8a5a371a8f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/Core/IdentityServer/BaseRequestValidator.cs
View File

@ -471,12 +471,18 @@ namespace Bit.Core.IdentityServer
}
}
protected async Task<bool> KnownDeviceAsync(User user, ValidatedTokenRequest request) =>
(await GetKnownDeviceAsync(user, request)) != default;
protected async Task<Device> GetKnownDeviceAsync(User user, ValidatedTokenRequest request) =>
await _deviceRepository.GetByIdentifierAsync(GetDeviceFromRequest(request).Identifier, user.Id);
private async Task<Device> SaveDeviceAsync(User user, ValidatedTokenRequest request)
{
var device = GetDeviceFromRequest(request);
if (device != null)
{
var existingDevice = await _deviceRepository.GetByIdentifierAsync(device.Identifier, user.Id);
var existingDevice = await GetKnownDeviceAsync(user, request);
if (existingDevice == null)
{
device.UserId = user.Id;

5
src/Core/IdentityServer/ResourceOwnerPasswordValidator.cs
View File

@ -58,9 +58,10 @@ namespace Bit.Core.IdentityServer
}
string bypassToken = null;
if (_captchaValidationService.RequireCaptchaValidation(_currentContext))
var user = await _userManager.FindByEmailAsync(context.UserName.ToLowerInvariant());
var unknownDevice = !await KnownDeviceAsync(user, context.Request);
if (!unknownDevice && _captchaValidationService.RequireCaptchaValidation(_currentContext))
{
var user = await _userManager.FindByEmailAsync(context.UserName.ToLowerInvariant());
var captchaResponse = context.Request.Raw["captchaResponse"]?.ToString();
if (string.IsNullOrWhiteSpace(captchaResponse))