nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-04-05 21:18:13 -05:00
Code

Allow bypass of captcha token if the device is known (#1626)

Browse Source
This commit is contained in:
Matt Gibson 2021-10-08 18:59:35 -05:00 committed by GitHub
parent ee7b608a46
commit 8a5a371a8f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/Core/IdentityServer/BaseRequestValidator.cs
View File

@ -471,12 +471,18 @@ namespace Bit.Core.IdentityServer
} }
} }
protected async Task<bool> KnownDeviceAsync(User user, ValidatedTokenRequest request) =>
(await GetKnownDeviceAsync(user, request)) != default;
protected async Task<Device> GetKnownDeviceAsync(User user, ValidatedTokenRequest request) =>
await _deviceRepository.GetByIdentifierAsync(GetDeviceFromRequest(request).Identifier, user.Id);
private async Task<Device> SaveDeviceAsync(User user, ValidatedTokenRequest request) private async Task<Device> SaveDeviceAsync(User user, ValidatedTokenRequest request)
{ {
var device = GetDeviceFromRequest(request); var device = GetDeviceFromRequest(request);
if (device != null) if (device != null)
{ {
var existingDevice = await _deviceRepository.GetByIdentifierAsync(device.Identifier, user.Id); var existingDevice = await GetKnownDeviceAsync(user, request);
if (existingDevice == null) if (existingDevice == null)
{ {
device.UserId = user.Id; device.UserId = user.Id;

5
src/Core/IdentityServer/ResourceOwnerPasswordValidator.cs
View File

@ -58,9 +58,10 @@ namespace Bit.Core.IdentityServer
} }
string bypassToken = null; string bypassToken = null;
if (_captchaValidationService.RequireCaptchaValidation(_currentContext)) var user = await _userManager.FindByEmailAsync(context.UserName.ToLowerInvariant());
var unknownDevice = !await KnownDeviceAsync(user, context.Request);
if (!unknownDevice && _captchaValidationService.RequireCaptchaValidation(_currentContext))
{ {
var user = await _userManager.FindByEmailAsync(context.UserName.ToLowerInvariant());
var captchaResponse = context.Request.Raw["captchaResponse"]?.ToString(); var captchaResponse = context.Request.Raw["captchaResponse"]?.ToString();
if (string.IsNullOrWhiteSpace(captchaResponse)) if (string.IsNullOrWhiteSpace(captchaResponse))