lato 3.22.2 → 3.23.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 97c06009567898ffba7a3b34ace5ab8de7d896f19708d371839f5194589df395
-  data.tar.gz: 21d2297e40a0d97e46f343413114fdbebebc0bfa40b53d567cb63229a3bc5055
+  metadata.gz: 926e453e02a52408f23980d6ed7e0e74c40de3f4e5841a911420ea1b3df25128
+  data.tar.gz: 179a8b9e1959c8c734e92a17eec7c30e640da7f65df7b266e35f8f257d75094b
 SHA512:
-  metadata.gz: 4cc47fd5c9ec4cc561a31348e637c93ccf3f6a63203d236fa88c309008412f336e450b539428e2ea1c2d4e57b6c28f6c685bc39d77b90fac14bf04d9b125f2cf
-  data.tar.gz: ca60c0153ea46ea522403fab3d49e64b89297d3af97c157ccfc94cd0b94e2ab93d6343ab643387d2321f9048d8f9e3770e5fdb647f262ecaf9bba414b7443ea5
+  metadata.gz: ed3a9f66a07bac72a2bba82dcfb2db645574b0c26e5860bccb72f21da54a14fc273554935408226365bcbc3b17b64b559298c7e32c4a3a0eae815271c0086c37
+  data.tar.gz: 02b9de09b5551dec982080c649f0e767faf3cb75c8c735fae962a30249095e3129ec7d2aa76cbdac8417931b1f1acea88f2a84691a492604aa81368610b9d5b8

data/app/controllers/concerns/lato/sessionable.rb

@@ -47,7 +47,13 @@ module Lato
     end
 
     def session_create(user_id)
-      cookies.encrypted[:lato_session] = { value: Lato::Session.generate_session_per_user(user_id), expires: Lato.config.session_lifetime.from_now }
+      # httponly keeps the cookie out of reach of injected scripts; secure avoids leaking it over plain HTTP.
+      cookies.encrypted[:lato_session] = {
+        value: Lato::Session.generate_session_per_user(user_id),
+        expires: Lato.config.session_lifetime.from_now,
+        httponly: true,
+        secure: request.ssl?
+      }
       @session = Lato::Session.new(cookies.encrypted[:lato_session])
 
       true

data/app/controllers/lato/application_controller.rb

@@ -10,7 +10,6 @@ module Lato
 
     around_action :catch_exceptions
 
-    before_action :override_request_remote_ip
     before_action :set_default_locale
 
     def index
@@ -39,13 +38,6 @@ module Lato
 
     protected
 
-    # This method override the request remote ip with the X-Forwarded-For header if exists.
-    # This method is used to get the real ip of the user when the application is behind a proxy.
-    # For example if the application is behind a nginx proxy the request.remote_ip will be the ip of the proxy and not the ip of the user.
-    def override_request_remote_ip
-      request.remote_ip = request.headers['X-Forwarded-For'].split(',').first if request.headers['X-Forwarded-For']
-    end
-
     # This method set the default locale for the application.
     # The default locale is the locale of the user if exists, otherwise is the default locale of the application.
     def set_default_locale

data/app/controllers/lato/authentication_controller.rb

@@ -1,10 +1,11 @@
 module Lato
   class AuthenticationController < ApplicationController
-    before_action :limit_requests, only: %i[signin_action signup_action accept_invitation_action recover_password_action update_password_action]
+    before_action :limit_requests, only: %i[signin_action signup_action accept_invitation_action recover_password_action update_password_action verify_email_action authenticator_action webauthn_action]
     before_action :not_authenticate_session, only: %i[signin signin_action signup signup_action accept_invitation accept_invitation_action]
     before_action :authenticate_session, only: %i[signout signout_action]
 
-    before_action :find_user, only: %i[verify_email verify_email_action update_password update_password_action]
+    before_action :find_user, only: %i[verify_email verify_email_action]
+    before_action :find_recover_password_user, only: %i[update_password update_password_action]
     before_action :find_invitation, only: %i[accept_invitation accept_invitation_action]
     before_action :find_authentication_user, only: %i[authentication_method authentication_method_action webauthn webauthn_action]
 
@@ -33,8 +34,9 @@ module Lato
         ))
           redirect_path = determine_authentication_redirect(@user)
           if redirect_path
+            # Second factor still pending: expose only where to continue, not user data.
             format.html { redirect_to redirect_path }
-            format.json { render json: @user }
+            format.json { render json: { redirect: redirect_path } }
           else
             session_create(@user.id)
             format.html { redirect_to lato.root_path }
@@ -145,11 +147,14 @@ module Lato
 
     def recover_password_action
       @user = Lato::User.new
+      return unless verify_hcaptcha(:recover_password)
 
       respond_to do |format|
         if @user.request_recover_password(params.require(:user).permit(:email))
-          format.html { redirect_to lato.authentication_update_password_path(id: @user.id) }
-          format.json { render json: @user }
+          # Same response whether the email is registered or not: the user is tracked in session, not in the URL.
+          session[:recover_password_email] = @user.email
+          format.html { redirect_to lato.authentication_update_password_path, notice: I18n.t('lato.authentication_controller.recover_password_action_notice') }
+          format.json { render json: {} }
         else
           format.html { render :recover_password, status: :unprocessable_entity }
           format.json { render json: @user.errors, status: :unprocessable_entity }
@@ -164,10 +169,12 @@ module Lato
 
     def update_password_action
       respond_to do |format|
-        if @user.update_password(params.require(:user).permit(:code, :password, :password_confirmation))
+        if @recover_password_user.update_password(params.require(:user).permit(:code, :password, :password_confirmation))
+          session[:recover_password_email] = nil
           format.html { redirect_to lato.authentication_signin_path, notice: I18n.t('lato.authentication_controller.update_password_action_notice') }
-          format.json { render json: @user }
+          format.json { render json: {} }
         else
+          @user.errors.merge!(@recover_password_user.errors)
           format.html { render :update_password, status: :unprocessable_entity }
           format.json { render json: @user.errors, status: :unprocessable_entity }
         end
@@ -283,6 +290,16 @@ module Lato
       respond_to_with_not_found unless @user
     end
 
+    # Unknown emails get a blank user: the code check fails like for a wrong code, without revealing anything.
+    # Views always get a blank @user: a persisted record would change the rendered form (id, method) and leak existence.
+    def find_recover_password_user
+      email = session[:recover_password_email]
+      return redirect_to lato.authentication_recover_password_path if email.blank?
+
+      @recover_password_user = Lato::User.find_by(email: email) || Lato::User.new
+      @user = Lato::User.new
+    end
+
     def find_invitation
       @invitation = Lato::Invitation.find_by(id: params[:id], accepted_code: params[:accepted_code])
       respond_to_with_not_found unless @invitation

data/app/models/lato/user.rb

@@ -65,6 +65,18 @@ module Lato
       webauthn_id.present? && webauthn_public_key.present?
     end
 
+    # Serialization
+    ##
+
+    # Credentials and second factor secrets must never leave the server (e.g. through `render json: user`).
+    SENSITIVE_ATTRIBUTES = %w[password_digest authenticator_secret webauthn_id webauthn_public_key].freeze
+
+    def serializable_hash(options = nil)
+      options = (options || {}).dup
+      options[:except] = Array(options[:except]).map(&:to_s) | SENSITIVE_ATTRIBUTES
+      super(options)
+    end
+
     # Helpers
     ##
 
@@ -117,14 +129,11 @@ module Lato
     def signin(params)
       self.email = params[:email]
 
-      user = Lato::User.find_by(email: params[:email])
-      unless user
-        errors.add(:email, :not_correct)
-        return
-      end
-
-      unless user.authenticate(params[:password])
-        errors.add(:password, :not_correct)
+      # Same error and similar timing for unknown email and wrong password, so signin can not be used to enumerate users.
+      user = Lato::User.find_by(email: normalize_email(params[:email]))
+      authenticated = user ? user.authenticate(params[:password].to_s) : dummy_password_check(params[:password])
+      unless authenticated
+        errors.add(:base, :credentials_not_correct)
         return
       end
 
@@ -211,7 +220,7 @@ module Lato
         return
       end
 
-      unless email_verification_code == params[:code]
+      unless ActiveSupport::SecurityUtils.secure_compare(email_verification_code, params[:code].to_s)
         errors.add(:base, :email_verification_code_invalid)
         return
       end
@@ -223,42 +232,41 @@ module Lato
       true
     end
 
+    # NOTE: Always succeeds for a well formed email, registered or not, so the response can not be used to enumerate users.
     def request_recover_password(params)
-      user = Lato::User.find_by(email: params[:email])
-      unless user
-        errors.add(:email, :not_registered)
+      self.email = normalize_email(params[:email])
+      if email.blank?
+        errors.add(:email, :blank)
         return
       end
 
-      code = SecureRandom.hex.upcase
-      delivery = Lato::UserMailer.password_update_mail(user.id, code).deliver_now
-      unless delivery
-        errors.add(:base, :email_sending_error)
-        return
-      end
+      user = Lato::User.find_by(email: email)
+      return true unless user
 
-      self.id = user.id
-      reload
+      # Per-user throttle: avoid mail bombing a victim, the previous code stays valid.
+      return true if user.c_password_update_semaphore
 
-      c_password_update_code(code)
+      code = SecureRandom.hex.upcase
+      user.c_password_update_code(code)
+      user.c_password_update_semaphore(true)
+
+      # Async delivery keeps response time independent from email existence.
+      Lato::UserMailer.password_update_mail(user.id, code).deliver_later
 
       true
     end
 
     def update_password(params)
-      password_update_code = c_password_update_code
+      password_update_code = new_record? ? nil : c_password_update_code
 
-      if password_update_code.blank?
-        errors.add(:base, :password_update_code_expired)
-        return
-      end
-
-      unless password_update_code == params[:code]
+      # Single error for missing, expired or wrong code: distinct messages would reveal which emails are registered.
+      if password_update_code.blank? || !ActiveSupport::SecurityUtils.secure_compare(password_update_code, params[:code].to_s)
         errors.add(:base, :password_update_code_invalid)
         return
       end
 
       c_password_update_code('')
+      c_password_update_semaphore(false)
 
       update(params.permit(:password, :password_confirmation).merge(
         authenticator_secret: nil, # Reset authenticator secret when password is updated
@@ -467,8 +475,34 @@ module Lato
       value
     end
 
+    def c_password_update_semaphore(value = nil)
+      cache_key = "Lato::User/c_password_update_semaphore/#{id}"
+      return Rails.cache.read(cache_key) if value.nil?
+
+      Rails.cache.write(cache_key, value, expires_in: 2.minutes)
+      value
+    end
+
     private
 
+    def normalize_email(value)
+      value.to_s.downcase.strip
+    end
+
+    # Spend the same bcrypt cost as a real check when the user does not exist.
+    def dummy_password_check(password)
+      BCrypt::Password.new(self.class.dummy_password_digest).is_password?(password.to_s)
+      false
+    end
+
+    # Same cost used by has_secure_password, so the dummy check takes as long as a real one.
+    def self.dummy_password_digest
+      @dummy_password_digest ||= BCrypt::Password.create(
+        SecureRandom.hex,
+        cost: ActiveModel::SecurePassword.min_cost ? BCrypt::Engine::MIN_COST : BCrypt::Engine.cost
+      )
+    end
+
     def webauthn_user_handle
       Digest::SHA256.digest("lato-user-#{id}")
     end

data/app/views/lato/authentication/_form-recover-password.html.erb

@@ -13,6 +13,8 @@ user ||= Lato::User.new
       <%= lato_form_item_input_email form, :email, required: true %>
     </div>
 
+    <%= render 'lato/authentication/hcaptcha' %>
+
     <div>
       <%= lato_form_submit form, I18n.t('lato.next'), class: %w[d-block w-100] %>
     </div>

data/app/views/lato/authentication/_form-update-password.html.erb

@@ -5,7 +5,7 @@ user ||= Lato::User.new
 %>
 
 <%= turbo_frame_tag 'authentication_form-update-password' do %>
-  <%= form_with model: user, url: lato.authentication_update_password_action_path(id: user.id), data: { turbo_frame: '_self', controller: 'lato-form' } do |form| %>
+  <%= form_with model: user, url: lato.authentication_update_password_action_path, method: :patch, data: { turbo_frame: '_self', controller: 'lato-form' } do |form| %>
     <%= lato_form_errors user, class: %w[mb-3] %>
     
     <div class="mb-3">

data/config/locales/en.yml

@@ -116,6 +116,7 @@ en:
     authentication_controller:
       verify_email_action_notice: Successfully verified email address
       update_password_action_notice: Your password has been successfully updated
+      recover_password_action_notice: If the email is registered you will receive a verification code shortly
 
   activerecord:
     attributes:
@@ -138,7 +139,8 @@ en:
               email_verification_code_expired: Email verification code has expired
               email_verification_code_invalid: Email verification code is invalid
               password_update_code_expired: Verification code has expired
-              password_update_code_invalid: Verification code is invalid
+              password_update_code_invalid: Verification code is invalid or expired
+              credentials_not_correct: Email or password not correct
               privacy_policy_invalid: To accept the privacy policy you must select the confirmation checkbox
               terms_and_conditions_invalid: To accept the terms and conditions you must select the confirmation checkbox
               web3_address_invalid: The address you send is not corretly signed

data/config/locales/fr.yml

@@ -118,6 +118,7 @@ fr:
     authentication_controller:
       verify_email_action_notice: Adresse e-mail vérifiée avec succès
       update_password_action_notice: Votre mot de passe a été mis à jour avec succès
+      recover_password_action_notice: Si l'adresse e-mail est enregistrée, vous recevrez bientôt un code de vérification
 
   activerecord:
     attributes:
@@ -145,7 +146,8 @@ fr:
               email_verification_code_expired: Le code de vérification de l'e-mail a expiré
               email_verification_code_invalid: Le code de vérification de l'e-mail n'est pas valide
               password_update_code_expired: Le code de vérification a expiré
-              password_update_code_invalid: Le code de vérification n'est pas valide
+              password_update_code_invalid: Le code de vérification n'est pas valide ou a expiré
+              credentials_not_correct: E-mail ou mot de passe incorrect
               privacy_policy_invalid: Pour accepter la politique de confidentialité, vous devez cocher la case de confirmation
               terms_and_conditions_invalid: Pour accepter les conditions générales, vous devez cocher la case de confirmation
               invitation_invalid: Invitation non valide

data/config/locales/it.yml

@@ -118,6 +118,7 @@ it:
     authentication_controller:
       verify_email_action_notice: Indirizzo email verificato correttamente
       update_password_action_notice: La tua password è stata aggiornata correttamente
+      recover_password_action_notice: Se l'email è registrata riceverai a breve un codice di verifica
 
   activerecord:
     attributes:
@@ -145,7 +146,8 @@ it:
               email_verification_code_expired: Il codice di verifica email risulta scaduto
               email_verification_code_invalid: Il codice di verifica email non risulta valido
               password_update_code_expired: Il codice di verifica risulta scaduto
-              password_update_code_invalid: Il codice di verifica non risulta valido
+              password_update_code_invalid: Il codice di verifica non risulta valido o è scaduto
+              credentials_not_correct: Email o password non corretti
               privacy_policy_invalid: Per accettare la privacy policy devi selezionare la checkbox di conferma
               terms_and_conditions_invalid: Per accettare i termini e condizioni devi selezionare la checkbox di conferma
               invitation_invalid: Invito non valido

data/config/locales/ro.yml

@@ -118,6 +118,7 @@ ro:
     authentication_controller:
       verify_email_action_notice: Adresa de email a fost verificată cu succes
       update_password_action_notice: Parola ta a fost actualizată cu succes
+      recover_password_action_notice: Dacă adresa de email este înregistrată, vei primi în curând un cod de verificare
 
   activerecord:
     attributes:
@@ -145,7 +146,8 @@ ro:
               email_verification_code_expired: Codul de verificare email a expirat
               email_verification_code_invalid: Codul de verificare email nu este valid
               password_update_code_expired: Codul de verificare a expirat
-              password_update_code_invalid: Codul de verificare nu este valid
+              password_update_code_invalid: Codul de verificare nu este valid sau a expirat
+              credentials_not_correct: Email sau parolă incorectă
               privacy_policy_invalid: Pentru a accepta politica de confidențialitate trebuie să bifezi căsuța de confirmare
               terms_and_conditions_invalid: Pentru a accepta termenii și condițiile trebuie să bifezi căsuța de confirmare
               invitation_invalid: Invitație nevalidă

data/lib/lato/version.rb

@@ -1,3 +1,3 @@
 module Lato
-  VERSION = "3.22.2"
+  VERSION = "3.23.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lato
 version: !ruby/object:Gem::Version
-  version: 3.22.2
+  version: 3.23.0
 platform: ruby
 authors:
 - Gregorio Galante