AppAPI: allowed to bypass Two-Factor

Signed-off-by: Alexander Piskun <bigcat88@icloud.com>
nextcloud · Dec 28, 2023 · 489b816 · 489b816
1 parent 17cb5da
commit 489b816
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 3 deletions.
diff --git a/core/Middleware/TwoFactorMiddleware.php b/core/Middleware/TwoFactorMiddleware.php
@@ -100,7 +100,10 @@ public function beforeController($controller, $methodName) {
 		if ($this->userSession->isLoggedIn()) {
 			$user = $this->userSession->getUser();
 
-			if ($this->session->exists('app_password') || $this->twoFactorManager->isTwoFactorAuthenticated($user)) {
+			if ($this->session->exists('app_password')  // authenticated using an app password
+				|| $this->session->exists('app_api')  // authenticated using an AppAPI Auth
+				|| $this->twoFactorManager->isTwoFactorAuthenticated($user)) {
+
 				$this->checkTwoFactor($controller, $methodName, $user);
 			} elseif ($controller instanceof TwoFactorChallengeController) {
 				// Allow access to the two-factor controllers only if two-factor authentication

diff --git a/lib/private/Authentication/TwoFactorAuth/Manager.php b/lib/private/Authentication/TwoFactorAuth/Manager.php
@@ -318,8 +318,8 @@ public function needsSecondFactor(IUser $user = null): bool {
 			return false;
 		}
 
-		// If we are authenticated using an app password skip all this
-		if ($this->session->exists('app_password')) {
+		// If we are authenticated using an app password or AppAPI Auth, skip all this
+		if ($this->session->exists('app_password') || $this->session->get('app_api') === true) {
 			return false;
 		}
 

diff --git a/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php b/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php
@@ -636,6 +636,10 @@ public function testNeedsSecondFactorSessionAuth() {
 			->method('get')
 			->with(Manager::SESSION_UID_DONE)
 			->willReturn('user');
+		$this->session->expects($this->once())
+			->method('get')
+			->with('app_api')
+			->willReturn(false);
 
 		$this->assertFalse($this->manager->needsSecondFactor($user));
 	}