gaschz/trilium
1
0
Fork 0
mirror of https://github.com/zadam/trilium.git synced 2025-06-06 18:08:33 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Added secret validation

Browse Source
This commit is contained in:
Brandon 2024-05-03 16:37:14 -07:00
parent f8d1d553df
commit 18a2305c35
2 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/public/app/widgets/type_widgets/options/multi_factor_authentication.js
View File

@ -111,7 +111,17 @@ export default class MultiFactorAuthenticationOptions extends OptionsWidget {
} }
save() { save() {
// TODO: CHECK VALIDITY OF SECRET const key = this.$totpSecretInput.val();
const regex = /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]+/;
if (key.length != 52) {
toastService.showError("Invalid Secret", 2000);
return;
}
if (regex.test(key)) {
toastService.showError("Invalid Secret", 2000);
return;
}
server server
.post("totp/set", { .post("totp/set", {

15
src/routes/api/totp.ts
View File

@ -1,13 +1,10 @@
import options = require("../../services/options"); import options = require("../../services/options");
import totp_secret = require("../../services/encryption/totp_secret"); import totp_secret = require("../../services/encryption/totp_secret");
import { Request } from "express"; import { Request } from "express";
import totp_fs = require("../../services/totp_secret") import totp_fs = require("../../services/totp_secret");
const speakeasy = require("speakeasy"); const speakeasy = require("speakeasy");
function verifyOTPToken(guessedToken: any) { function verifyOTPToken(guessedToken: any) {
console.log("[" + guessedToken + "]");
console.log(typeof guessedToken);
const tokenValidates = speakeasy.totp.verify({ const tokenValidates = speakeasy.totp.verify({
secret: process.env.MFA_SECRET, secret: process.env.MFA_SECRET,
encoding: "base32", encoding: "base32",
@ -39,13 +36,15 @@ function disableTOTP() {
} }
function setTotpSecret(req: Request) { function setTotpSecret(req: Request) {
// TODO: CHECK VALIDITY OF SECRET const regex = /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]+/;
options.setOption if (req.body.secret.length != 52) return;
totp_fs.saveTotpSecret(req.body.secret) if (regex.test(req.body.secret)) return;
totp_fs.saveTotpSecret(req.body.secret);
} }
function getSecret() { function getSecret() {
return totp_fs.getTotpSecret() return totp_fs.getTotpSecret();
} }
export = { export = {