saret/vaultwarden
1
0 Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.wiki.git synced 2026-11-02 02:46:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

Check the auth request owner and state in send-email-login

Browse Source
This commit is contained in:
Daniel García committed 2026-11-01 15:18:17 +01:00
1 parent e056359a42
commit bb1ff81ea0
1 file changed
+13 -5
Download Patch File Download Diff File Expand all files Collapse all files
src/api/core/two_factor/email.rs
+13 -5
View File
@@ -84,18 +84,26 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
)
}
} else if let Some(auth_request_id) = auth_request_id {
let Some(auth_request) = AuthRequest::find_by_uuid(auth_request_id, &conn).await else {
err!("AuthRequest doesn't exist", "User not found")
};
let Some(code) = &data.auth_request_access_code else {
err!("no auth request access code")
};
let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, &conn).await
else {
err!("AuthRequest doesn't exist", "Invalid auth request or does not belong to user")
};
if auth_request.device_type != client_headers.device_type
let request_expired = Utc::now().naive_utc() >= auth_request.creation_date + TimeDelta::minutes(5);
if !auth_request.approved.unwrap_or(false)
|| auth_request.authentication_date.is_some()
|| request_expired
|| auth_request.device_type != client_headers.device_type
|| auth_request.request_ip != client_headers.ip.ip.to_string()
|| !auth_request.check_access_code(code)
{
err!("AuthRequest doesn't exist", "Invalid device, IP or code")
err!(
"AuthRequest doesn't exist",
"Auth request not approved, already used or expired, or invalid device, IP or code"
)
}
} else if let Some(device_identifier) = &data.device_identifier {
// iOS/Android SSO logins send the email and device id but no password hash,