Dekescordes/spacebar
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #1193 from DEVTomatoCake/fix/forgot-password-security

Browse Source
This commit is contained in:
Madeline 2024-08-22 09:51:00 +10:00 committed by GitHub
commit b63f285fc1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 13 additions and 53 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
src/api/routes/auth/forgot.ts
View File

@ -1,31 +1,24 @@
/* /*
Spacebar: A FOSS re-implementation and extension of the Discord.com backend. Spacebar: A FOSS re-implementation and extension of the Discord.com backend.
Copyright (C) 2023 Spacebar and Spacebar Contributors Copyright (C) 2023 Spacebar and Spacebar Contributors
This program is free software: you can redistribute it and/or modify This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as published it under the terms of the GNU Affero General Public License as published
by the Free Software Foundation, either version 3 of the License, or by the Free Software Foundation, either version 3 of the License, or
(at your option) any later version. (at your option) any later version.
This program is distributed in the hope that it will be useful, This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details. GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>. along with this program. If not, see <https://www.gnu.org/licenses/>.
*/ */
import { getIpAdress, route, verifyCaptcha } from "@spacebar/api"; import { getIpAdress, route, verifyCaptcha } from "@spacebar/api";
import { import { Config, Email, ForgotPasswordSchema, User } from "@spacebar/util";
Config,
Email,
FieldErrors,
ForgotPasswordSchema,
User,
} from "@spacebar/util";
import { Request, Response, Router } from "express"; import { Request, Response, Router } from "express";
import { HTTPError } from "lambert-server";
const router = Router(); const router = Router();
router.post( router.post(
@ -37,9 +30,6 @@ router.post(
400: { 400: {
body: "APIErrorOrCaptchaResponse", body: "APIErrorOrCaptchaResponse",
}, },
500: {
body: "APIErrorResponse",
},
}, },
}), }),
async (req: Request, res: Response) => { async (req: Request, res: Response) => {
@ -71,50 +61,20 @@ router.post(
} }
} }
const user = await User.findOneOrFail({ res.sendStatus(204);
const user = await User.findOne({
where: [{ phone: login }, { email: login }], where: [{ phone: login }, { email: login }],
select: ["username", "id", "disabled", "deleted", "email"], select: ["username", "id", "email"],
relations: ["security_keys"], }).catch(() => {});
}).catch(() => {
throw FieldErrors({
login: {
message: req.t("auth:password_reset.EMAIL_DOES_NOT_EXIST"),
code: "EMAIL_DOES_NOT_EXIST",
},
});
});
if (!user.email) if (user && user.email) {
throw FieldErrors({ Email.sendResetPassword(user, user.email).catch((e) => {
login: {
message:
"This account does not have an email address associated with it.",
code: "NO_EMAIL",
},
});
if (user.deleted)
return res.status(400).json({
message: "This account is scheduled for deletion.",
code: 20011,
});
if (user.disabled)
return res.status(400).json({
message: req.t("auth:login.ACCOUNT_DISABLED"),
code: 20013,
});
return await Email.sendResetPassword(user, user.email)
.then(() => {
return res.sendStatus(204);
})
.catch((e) => {
console.error( console.error(
`Failed to send password reset email to ${user.username}#${user.discriminator}: ${e}`, `Failed to send password reset email to ${user.username}#${user.discriminator} (${user.id}): ${e}`,
); );
throw new HTTPError("Failed to send password reset email", 500);
}); });
}
}, },
); );