Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: edge cases

Browse Source
This commit is contained in:
loks0n
2023-10-09 14:49:07 +01:00
parent e94631f730
commit c4e82e4191
3 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/api/account.php
+7 -4
View File
@@ -1140,11 +1140,13 @@ App::put('/v1/account/sessions/token')
->action(function (string $userId, string $secret, Request $request, Response $response, Document $user, Database $dbForProject, Document $project, Locale $locale, Reader $geodb, Event $events) {
/** @var Utopia\Database\Document $user */
$userFromRequest = Authorization::skip(fn () => $dbForProject->getDocument('users', $userId));
if ($userFromRequest->isEmpty()) {
throw new Exception(Exception::USER_NOT_FOUND);
}
$verifiedToken = Auth::tokenVerify($userFromRequest->getAttribute('tokens', []), null, $secret);
if (!$verifiedToken) {
throw new Exception(Exception::USER_INVALID_TOKEN);
}
@@ -1156,15 +1158,13 @@ App::put('/v1/account/sessions/token')
$record = $geodb->get($request->getIP());
$secret = Auth::tokenGenerator();
$expire = DateTime::formatTz(DateTime::addSeconds(new \DateTime(), $duration));
$provider = Auth::getSessionProviderByTokenType($verifiedToken->getAttribute('type'));
$session = new Document(array_merge(
[
'$id' => ID::unique(),
'userId' => $user->getId(),
'userInternalId' => $user->getInternalId(),
'provider' => Auth::SESSION_PROVIDER_UNIVERSAL,
'provider' => Auth::getSessionProviderByTokenType($verifiedToken->getAttribute('type')),
'secret' => Auth::hash($secret), // One way hash encryption to protect DB leak
'userAgent' => $request->getUserAgent('UNKNOWN'),
'ip' => $request->getIP(),
@@ -1185,7 +1185,7 @@ App::put('/v1/account/sessions/token')
]));
$dbForProject->deleteCachedDocument('users', $user->getId());
$dbForProject->deleteDocument('tokens', $token);
Authorization::skip(fn () => $dbForProject->deleteDocument('tokens', $verifiedToken->getId()));
$dbForProject->deleteCachedDocument('users', $user->getId());
try {
@@ -3147,3 +3147,6 @@ App::put('/v1/account/verification/phone')
$response->dynamic($verificationDocument, Response::MODEL_TOKEN);
});
app/controllers/api/users.php
+5 -2
View File
@@ -1107,7 +1107,7 @@ App::post('/v1/users/:userId/tokens')
throw new Exception(Exception::USER_NOT_FOUND);
}
$loginSecret = Auth::tokenGenerator();
$secret = Auth::tokenGenerator();
$expire = DateTime::formatTz(DateTime::addSeconds(new \DateTime(), Auth::TOKEN_EXPIRATION_CONFIRM));
$token = new Document([
@@ -1115,13 +1115,16 @@ App::post('/v1/users/:userId/tokens')
'userId' => $user->getId(),
'userInternalId' => $user->getInternalId(),
'type' => Auth::TOKEN_TYPE_UNIVERSAL,
'secret' => Auth::hash($loginSecret), // One way hash encryption to protect DB leak
'secret' => Auth::hash($secret), // One way hash encryption to protect DB leak
'expire' => $expire,
'userAgent' => 'UNKNOWN',
'ip' => 'UNKNOWN',
]);
$token = $dbForProject->createDocument('tokens', $token);
$dbForProject->deleteCachedDocument('users', $user->getId());
$token->setAttribute('secret', $secret);
$events
->setParam('userId', $user->getId())
src/Appwrite/Auth/Auth.php
+2 -1
View File
@@ -340,7 +340,8 @@ class Auth
if (
$token->isSet('secret') &&
$token->isSet('expire') &&
($type === null || $token->isSet('type') && $token->getAttribute('type') === $type) &&
$token->isSet('type') &&
($type === null || $token->getAttribute('type') === $type) &&
$token->getAttribute('secret') === self::hash($secret) &&
DateTime::formatTz($token->getAttribute('expire')) >= DateTime::formatTz(DateTime::now())
) {