AppAPI: allowed to bypass Two-Factor

nextcloud · Dec 25, 2023 · f096201 · f096201
1 parent 17cb5da
commit f096201
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/core/Middleware/TwoFactorMiddleware.php b/core/Middleware/TwoFactorMiddleware.php
@@ -100,7 +100,10 @@ public function beforeController($controller, $methodName) {
 		if ($this->userSession->isLoggedIn()) {
 			$user = $this->userSession->getUser();
 
-			if ($this->session->exists('app_password') || $this->twoFactorManager->isTwoFactorAuthenticated($user)) {
+			if ($this->session->exists('app_password')
+				|| $this->session->exists('app_api')
+				|| $this->twoFactorManager->isTwoFactorAuthenticated($user)) {
+
 				$this->checkTwoFactor($controller, $methodName, $user);
 			} elseif ($controller instanceof TwoFactorChallengeController) {
 				// Allow access to the two-factor controllers only if two-factor authentication

diff --git a/lib/private/Authentication/TwoFactorAuth/Manager.php b/lib/private/Authentication/TwoFactorAuth/Manager.php
@@ -319,7 +319,7 @@ public function needsSecondFactor(IUser $user = null): bool {
 		}
 
 		// If we are authenticated using an app password skip all this
-		if ($this->session->exists('app_password')) {
+		if ($this->session->exists('app_password') || $this->session->get('app_api') === true) {
 			return false;
 		}