AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Authorize only API tokens when 2FA is enabled

Browse Source
This commit is contained in:
Frédéric Guillot
2019-02-01 15:40:35 -08:00
parent fa08493348
commit 233fd1a8a1
4 changed files with 31 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
app/Api/Middleware/AuthenticationMiddleware.php
View File

@@ -5,6 +5,7 @@ namespace Kanboard\Api\Middleware;
use JsonRPC\Exception\AccessDeniedException;
use JsonRPC\Exception\AuthenticationFailureException;
use JsonRPC\MiddlewareInterface;
use Kanboard\Auth\ApiAccessTokenAuth;
use Kanboard\Core\Base;
/**
@@ -48,9 +49,21 @@ class AuthenticationMiddleware extends Base implements MiddlewareInterface
*/
private function isUserAuthenticated($username, $password)
{
return $username !== 'jsonrpc' &&
! $this->userLockingModel->isLocked($username) &&
$this->authenticationManager->passwordAuthentication($username, $password);
if ($username === 'jsonrpc') {
return false;
}
if ($this->userLockingModel->isLocked($username)) {
return false;
}
if ($this->userModel->has2FA($username)) {
$this->logger->info('This API user ('.$username.') as 2FA enabled: only API keys are authorized');
$this->authenticationManager->reset();
$this->authenticationManager->register(new ApiAccessTokenAuth($this->container));
}
return $this->authenticationManager->passwordAuthentication($username, $password);
}
/**