ari/arimelody.me
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fixed critical login TOTP bypass bug! whoops!!!!!

Browse source
This commit is contained in:
ari melody 2025-01-26 23:41:35 +00:00
parent 2e93c3c5e5
commit 656501e69f
Signed by: ari
GPG key ID: CF99829C92678188
6 changed files with 150 additions and 92 deletions
Download patch file Download diff file Expand all files Collapse all files

11
controller/session.go
View file

@ -49,6 +49,17 @@ func CreateSession(db *sqlx.DB, userAgent string) (*model.Session, error) {
// return err
// }
func SetSessionAttemptAccount(db *sqlx.DB, session *model.Session, account *model.Account) error {
var err error
session.AttemptAccount = account
if account == nil {
_, err = db.Exec("UPDATE session SET attempt_account=NULL WHERE token=$1", session.Token)
} else {
_, err = db.Exec("UPDATE session SET attempt_account=$2 WHERE token=$1", session.Token, account.ID)
}
return err
}
func SetSessionAccount(db *sqlx.DB, session *model.Session, account *model.Account) error {
var err error
session.Account = account