rodauth 2.46.0 → 2.47.0

data/lib/rodauth/features/login.rb

@@ -15,7 +15,7 @@ module Rodauth
     auth_value_method :login_error_status, 401
     translatable_method :login_form_footer_links_heading, '<h2 class="rodauth-login-form-footer-links-heading">Other Options</h2>'
     auth_value_method :login_return_to_requested_location?, false
-    auth_value_method :login_return_to_requested_location_max_path_size, 2048
+    def_deprecated_alias :return_to_path_max_size, :login_return_to_requested_location_max_path_size
     auth_value_method :use_multi_phase_login?, false
 
     session_key :login_redirect_session_key, :login_redirect
@@ -106,14 +106,14 @@ module Rodauth
     end
 
     def login_required
-      if login_return_to_requested_location? && (path = login_return_to_requested_location_path) && path.bytesize <= login_return_to_requested_location_max_path_size
-        set_session_value(login_redirect_session_key, path)
+      if login_return_to_requested_location?
+        set_session_return_to_path(login_redirect_session_key, login_return_to_requested_location_path)
       end
       super
     end
 
     def login_return_to_requested_location_path
-      request.fullpath if request.get?
+      request.fullpath
     end
 
     def after_login_entered_during_multi_phase_login
@@ -153,6 +153,14 @@ module Rodauth
       login_path
     end
 
+    def post_configure
+      # RODAUTH3: Remove
+      super
+      if method(:already_logged_in).owner == Rodauth::Base
+        missing_recommended_configuration("The Rodauth 'already_logged_in' configuration method was not used. Use the configuration method to define the behavior when accessing a page while logged in that is expected to be accessed when not logged in (safest to halt or redirect).")
+      end
+    end
+
     private
 
     def _login_response

data/lib/rodauth/features/login_password_requirements_base.rb

@@ -12,7 +12,7 @@ module Rodauth
     translatable_method :logins_do_not_match_message, 'logins do not match'
     auth_value_method :password_confirm_param, 'password-confirm'
     auth_value_method :password_minimum_length, 6
-    auth_value_method :password_maximum_bytes, nil
+    auth_value_method :password_maximum_bytes, nil # RODAUTH3: 72 if bcrypt is used
     auth_value_method :password_maximum_length, nil
     translatable_method :passwords_do_not_match_message, 'passwords do not match'
     auth_value_method :require_email_address_logins?, true
@@ -67,13 +67,39 @@ module Rodauth
     def set_password(password)
       hash = password_hash(password)
       if account_password_hash_column
-        update_account(account_password_hash_column=>hash)
-      elsif password_hash_ds.update(password_hash_column=>hash) == 0
-        # This shouldn't raise a uniqueness error, as the update should only fail for a new user,
-        # and an existing user should always have a valid password hash row.  If this does
-        # fail, retrying it will cause problems, it will override a concurrently running update
-        # with potentially a different password.
-        db[password_hash_table].insert(password_hash_id_column=>account_id, password_hash_column=>hash)
+        ds = account_ds
+
+        if @existing_password_hash_or_salt
+          ds = ds.where(account_password_hash_column => @existing_password_hash_or_salt)
+        end
+
+        unless update_account({account_password_hash_column=>hash}, ds) == 1
+          raise SetPasswordFailure, "set_password did not update password, either due to missing account, or concurrent password change"
+        end
+      else
+        ph_ds = ds = password_hash_ds
+        if @existing_password_hash_or_salt
+          existing_expression = if use_database_authentication_functions?
+            Sequel.function(function_name(:rodauth_get_salt), :id)
+          # :nocov:
+          else
+            password_hash_column
+          # :nocov:
+          end
+          ds = ds.where(existing_expression => @existing_password_hash_or_salt)
+        end
+
+        if ds.update(password_hash_column=>hash) == 0
+          if ph_ds.empty?
+            # This shouldn't raise a uniqueness error, as the update should only fail for a new user,
+            # and an existing user should always have a valid password hash row.  If this does
+            # fail, retrying it will cause problems, it will override a concurrently running update
+            # with potentially a different password.
+            db[password_hash_table].insert(password_hash_id_column=>account_id, password_hash_column=>hash)
+          else
+            raise SetPasswordFailure, "set_password did not update password due to concurrent password change"
+          end
+        end
       end
       hash
     end
@@ -174,7 +200,7 @@ module Rodauth
       elsif password_maximum_length && password_maximum_length < password.length
         set_password_requirement_error_message(:password_too_long, password_too_long_message)
         false
-      elsif password_maximum_bytes && password_maximum_bytes < password.bytesize
+      elsif password_maximum_bytes && password_maximum_bytes < password_bytesize(password)
         set_password_requirement_error_message(:password_too_many_bytes, password_too_many_bytes_message)
         false
       else
@@ -182,6 +208,10 @@ module Rodauth
       end
     end
 
+    def password_bytesize(password)
+      password.bytesize
+    end
+
     def password_does_not_contain_null_byte?(password)
       return true unless password.include?("\0")
       set_password_requirement_error_message(:password_contains_null_byte, contains_null_byte_message)

data/lib/rodauth/features/otp.rb

@@ -5,7 +5,7 @@ require 'rqrcode'
 
 module Rodauth
   Feature.define(:otp, :Otp) do
-    depends :two_factor_base
+    depends :two_factor_base, :require_domain, :require_hmac_secret
 
     additional_form_tags 'otp_disable'
     additional_form_tags 'otp_auth'
@@ -127,13 +127,18 @@ module Rodauth
       end
 
       r.post do
-        if otp_valid_code?(param(otp_auth_param)) && otp_update_last_use
-          before_otp_authentication
-          two_factor_authenticate('totp')
+        transaction do
+          otp_key_ds.for_update.first
+
+          if otp_valid_code?(param(otp_auth_param)) && otp_update_last_use
+            before_otp_authentication
+            two_factor_authenticate('totp')
+          end
+
+          otp_record_authentication_failure
+          after_otp_authentication_failure
         end
 
-        otp_record_authentication_failure
-        after_otp_authentication_failure
         set_response_error_reason_status(:invalid_otp_auth_code, invalid_key_error_status)
         set_field_error(otp_auth_param, otp_invalid_auth_code_message)
         set_error_flash otp_auth_error_flash
@@ -265,15 +270,19 @@ module Rodauth
       return false unless otp_exists?
       ot_pass = ot_pass.gsub(/\s+/, '')
       if drift = otp_drift
+        # :nocov:
         if otp.respond_to?(:verify_with_drift)
-          # :nocov:
           otp.verify_with_drift(ot_pass, drift)
-          # :nocov:
+        # :nocov:
         else
-          otp.verify(ot_pass, :drift_behind=>drift, :drift_ahead=>drift)
+          otp.verify(ot_pass, :drift_behind=>drift, :drift_ahead=>drift, :after=>otp_last_use)
         end
-      else
+      # :nocov:
+      elsif otp.respond_to?(:verify_with_drift)
         otp.verify(ot_pass)
+      # :nocov:
+      else
+        otp.verify(ot_pass, :after=>otp_last_use)
       end
     end
 

data/lib/rodauth/features/password_expiration.rb

@@ -70,7 +70,6 @@ module Rodauth
         return password_changed_at + require_password_change_after < Time.now.to_i
       end
 
-      account_from_session
       if password_changed_at = get_password_changed_at
         set_session_value(password_changed_at_session_key, password_changed_at.to_i)
         password_changed_at + require_password_change_after < Time.now

data/lib/rodauth/features/password_grace_period.rb

@@ -33,6 +33,13 @@ module Rodauth
 
     private
 
+    def new_password_matches_current_password?(_)
+      if v = super
+        session.delete(last_password_entry_session_key)
+      end
+      v
+    end
+
     def after_create_account
       super if defined?(super)
       @last_password_entry = Time.now.to_i

data/lib/rodauth/features/password_pepper.rb

@@ -12,7 +12,11 @@ module Rodauth
 
     def password_match?(password)
       if (result = super) && @previous_pepper_matched && password_pepper_update?
-        set_password(password)
+        begin
+          set_password(password)
+        rescue Rodauth::SetPasswordFailure
+          return false
+        end
       end
 
       result
@@ -24,6 +28,12 @@ module Rodauth
 
     private
 
+    def password_bytesize(password)
+      n = super 
+      n += password_pepper.bytesize if password_pepper
+      n
+    end
+
     def password_hash_match?(hash, password)
       return super if password_pepper.nil?
 

data/lib/rodauth/features/recovery_codes.rb

@@ -162,7 +162,10 @@ module Rodauth
     def recovery_code_match?(code)
       recovery_codes.each do |s|
         if timing_safe_eql?(code, s)
-          recovery_codes_ds.where(recovery_codes_column=>code).delete
+          unless recovery_codes_ds.where(recovery_codes_column=>code).delete == 1
+            return false
+          end
+
           if recovery_codes_primary?
             add_recovery_code
           end

data/lib/rodauth/features/remember.rb

@@ -2,6 +2,8 @@
 
 module Rodauth
   Feature.define(:remember, :Remember) do
+    depends :require_hmac_secret
+
     notice_flash "Your remember setting has been updated"
     error_flash "There was an error updating your remember setting"
     loaded_templates %w'remember'

data/lib/rodauth/features/require_domain.rb

@@ -0,0 +1,12 @@
+# frozen-string-literal: true
+
+module Rodauth
+  Feature.define(:require_domain, :RequireDomain) do
+    def post_configure
+      super
+      if method(:domain).owner == Rodauth::Base
+        missing_recommended_configuration("The Rodauth 'domain' configuration method was not used. This can potentially leave the application vulnerable to requests that use malicious or invalid domains.")
+      end
+    end
+  end
+end

data/lib/rodauth/features/require_hmac_secret.rb

@@ -0,0 +1,12 @@
+# frozen-string-literal: true
+
+module Rodauth
+  Feature.define(:require_hmac_secret, :RequireHmacSecret) do
+    def post_configure
+      super
+      if method(:hmac_secret).owner == Rodauth::Base
+        missing_recommended_configuration("The Rodauth 'hmac_secret' configuration method was not used. This significantly reduces Rodauth's security. Consult the Rodauth README for what this method does, and set an appropriate value.")
+      end
+    end
+  end
+end

data/lib/rodauth/features/reset_password.rb

@@ -120,29 +120,26 @@ module Rodauth
       end
 
       r.post do
-        key = session[reset_password_session_key] || param(reset_password_key_param)
-        unless account_from_reset_password_key(key)
-          set_redirect_error_status(invalid_key_error_status)
-          set_error_reason :invalid_reset_password_key
-          set_redirect_error_flash reset_password_error_flash
-          redirect reset_password_email_sent_redirect
-        end
-
+        key = session_param(reset_password_session_key, reset_password_key_param)
+        select_key_for_update!
         password = param(password_param)
+
         catch_error do
-          unless password_meets_requirements?(password)
-            throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
-          end
+          transaction do
+            handle_invalid_reset_password_key unless key && account_from_reset_password_key(key)
 
-          if password_match?(password) 
-            throw_error_reason(:same_as_existing_password, invalid_field_error_status, password_param, same_as_existing_password_message)
-          end
+            unless password_meets_requirements?(password)
+              throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
+            end
 
-          if require_password_confirmation? && password != param(password_confirm_param)
-            throw_error_reason(:passwords_do_not_match, unmatched_field_error_status, password_param, passwords_do_not_match_message)
-          end
+            if password_match?(password) 
+              throw_error_reason(:same_as_existing_password, invalid_field_error_status, password_param, same_as_existing_password_message)
+            end
+
+            if require_password_confirmation? && password != param(password_confirm_param)
+              throw_error_reason(:passwords_do_not_match, unmatched_field_error_status, password_param, passwords_do_not_match_message)
+            end
 
-          transaction do
             before_reset_password
             set_password(password)
             clear_tokens(:reset_password)
@@ -184,7 +181,7 @@ module Rodauth
     end
 
     def account_from_reset_password_key(key)
-      @account = _account_from_reset_password_key(key)
+      set_account(_account_from_reset_password_key(key), :reset_password)
     end
 
     def reset_password_email_link
@@ -199,7 +196,7 @@ module Rodauth
     def get_reset_password_key(id)
       ds = password_reset_ds(id)
       ds.where(Sequel::CURRENT_TIMESTAMP > reset_password_deadline_column).delete
-      ds.get(reset_password_key_column)
+      apply_key_for_update(ds).get(reset_password_key_column)
     end
 
     def set_reset_password_email_last_sent
@@ -267,5 +264,13 @@ module Rodauth
     def reset_password_account_status_value
       account_open_status_value
     end
+
+    def handle_invalid_reset_password_key
+      remove_session_value(reset_password_session_key)
+      set_redirect_error_status(invalid_key_error_status)
+      set_error_reason :invalid_reset_password_key
+      set_redirect_error_flash reset_password_error_flash
+      redirect reset_password_email_sent_redirect
+    end
   end
 end

data/lib/rodauth/features/single_session.rb

@@ -2,6 +2,8 @@
 
 module Rodauth
   Feature.define(:single_session, :SingleSession) do
+    depends :require_hmac_secret
+
     error_flash 'This session has been logged out as another session has become active'
     redirect
 
@@ -29,13 +31,15 @@ module Rodauth
       single_session_key = session[single_session_session_key]
       current_key = single_session_ds.get(single_session_key_column)
       if single_session_key.nil?
-        unless current_key
+        if current_key
+          false
+        else
           # No row exists for this user, indicating the feature has never
           # been used, so it is OK to treat the current session as a new
           # session.
           update_single_session_key
+          true
         end
-        true
       elsif current_key
         if hmac_secret && !(valid = timing_safe_eql?(single_session_key, hmac = compute_hmac(current_key)))
           if hmac_secret_rotation? && (valid = timing_safe_eql?(single_session_key, compute_old_hmac(current_key)))

data/lib/rodauth/features/sms_codes.rb

@@ -2,7 +2,7 @@
 
 module Rodauth
   Feature.define(:sms_codes, :SmsCodes) do
-    depends :two_factor_base
+    depends :two_factor_base, :require_domain
 
     additional_form_tags 'sms_auth'
     additional_form_tags 'sms_confirm'
@@ -176,6 +176,9 @@ module Rodauth
 
       r.post do
         transaction do
+          @sms = sms_ds.for_update.first
+          require_sms_available
+
           if sms_code_match?(param(sms_code_param))
             before_sms_auth
             sms_remove_failures

data/lib/rodauth/features/two_factor_base.rb

@@ -158,7 +158,7 @@ module Rodauth
     def require_two_factor_authenticated
       unless two_factor_authenticated?
         if two_factor_auth_return_to_requested_location?
-          set_session_value(two_factor_auth_redirect_session_key, request.fullpath)
+          set_session_return_to_path(two_factor_auth_redirect_session_key)
         end
         set_redirect_error_status(two_factor_need_authentication_error_status)
         set_error_reason :two_factor_need_authentication
@@ -262,6 +262,7 @@ module Rodauth
     end
 
     def two_factor_update_session(auth_type)
+      raise Error, "attempt to have two factor authentication using same factor" if authenticated_by.include?(auth_type)
       authenticated_by << auth_type
       set_session_value(two_factor_setup_session_key, true)
     end

data/lib/rodauth/features/update_password_hash.rb

@@ -9,7 +9,11 @@ module Rodauth
     def password_match?(password)
       if (result = super) && update_password_hash?
         @update_password_hash = false
-        set_password(password)
+        begin
+          set_password(password)
+        rescue Rodauth::SetPasswordFailure
+          return false
+        end
       end
 
       result

data/lib/rodauth/features/verify_account.rb

@@ -114,30 +114,30 @@ module Rodauth
       end
 
       r.post do
-        key = session[verify_account_session_key] || param(verify_account_key_param)
-        unless account_from_verify_account_key(key)
-          set_redirect_error_status(invalid_key_error_status)
-          set_error_reason :invalid_verify_account_key
-          set_redirect_error_flash verify_account_error_flash
-          redirect verify_account_redirect
-        end
+        key = session_param(verify_account_session_key, verify_account_key_param)
+        select_key_for_update!
 
         catch_error do
-          if verify_account_set_password?
-            password = param(password_param)
+          transaction do
+            handle_invalid_verify_account_key unless key && account_from_verify_account_key(key)
 
-            if require_password_confirmation? && password != param(password_confirm_param)
-              throw_error_reason(:passwords_do_not_match, unmatched_field_error_status, password_param, passwords_do_not_match_message)
-            end
+            if verify_account_set_password?
+              password = param(password_param)
+
+              if require_password_confirmation? && password != param(password_confirm_param)
+                throw_error_reason(:passwords_do_not_match, unmatched_field_error_status, password_param, passwords_do_not_match_message)
+              end
 
-            unless password_meets_requirements?(password)
-              throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
+              unless password_meets_requirements?(password)
+                throw_error_status(invalid_field_error_status, password_param, password_does_not_meet_requirements_message)
+              end
             end
-          end
 
-          transaction do
             before_verify_account
-            verify_account
+            unless verify_account
+              remove_verify_account_key
+              handle_invalid_verify_account_key
+            end
             if verify_account_set_password?
               set_password(password)
             end
@@ -171,7 +171,8 @@ module Rodauth
     end
 
     def verify_account
-      update_account(account_status_column=>account_open_status_value) == 1
+      ds = account_ds.where(account_status_column=>account_unverified_status_value)
+      update_account({account_status_column=>account_open_status_value}, ds) == 1
     end
 
     def verify_account_email_resend
@@ -196,7 +197,7 @@ module Rodauth
     end
 
     def account_from_verify_account_key(key)
-      @account = _account_from_verify_account_key(key)
+      set_account(_account_from_verify_account_key(key), :verify_account)
     end
 
     def account_initial_status_value
@@ -208,7 +209,7 @@ module Rodauth
     end
 
     def get_verify_account_key(id)
-      verify_account_ds(id).get(verify_account_key_column)
+      apply_key_for_update(verify_account_ds(id)).get(verify_account_key_column)
     end
 
     def skip_status_checks?
@@ -318,5 +319,13 @@ module Rodauth
     def _account_from_verify_account_key(token)
       account_from_key(token, account_unverified_status_value){|id| get_verify_account_key(id)}
     end
+
+    def handle_invalid_verify_account_key
+      remove_session_value(verify_account_session_key)
+      set_redirect_error_status(invalid_key_error_status)
+      set_error_reason :invalid_verify_account_key
+      set_redirect_error_flash verify_account_error_flash
+      redirect verify_account_redirect
+    end
   end
 end

data/lib/rodauth/features/verify_login_change.rb

@@ -74,15 +74,18 @@ module Rodauth
       end
 
       r.post do
-        key = session[verify_login_change_session_key] || param(verify_login_change_key_param)
-        unless account_from_verify_login_change_key(key)
-          set_redirect_error_status(invalid_key_error_status)
-          set_error_reason :invalid_verify_login_change_key
-          set_redirect_error_flash verify_login_change_error_flash
-          redirect verify_login_change_redirect
-        end
+        key = session_param(verify_login_change_session_key, verify_login_change_key_param)
+        remove_session_value(verify_login_change_session_key)
+        select_key_for_update!
 
         transaction do
+          unless key && account_from_verify_login_change_key(key)
+            set_redirect_error_status(invalid_key_error_status)
+            set_error_reason :invalid_verify_login_change_key
+            set_redirect_error_flash verify_login_change_error_flash
+            redirect verify_login_change_redirect
+          end
+
           before_verify_login_change
           unless verify_login_change
             set_redirect_error_status(invalid_key_error_status)
@@ -98,7 +101,6 @@ module Rodauth
           autologin_session('verify_login_change')
         end
 
-        remove_session_value(verify_login_change_session_key)
         verify_login_change_response
       end
     end
@@ -120,7 +122,7 @@ module Rodauth
     end
 
     def account_from_verify_login_change_key(key)
-      @account = _account_from_verify_login_change_key(key)
+      set_account(_account_from_verify_login_change_key(key), :verify_login_change)
     end
 
     def send_verify_login_change_email(login)
@@ -132,7 +134,9 @@ module Rodauth
     end
 
     def get_verify_login_change_login_and_key(id)
-      verify_login_change_ds(id).get([verify_login_change_login_column, verify_login_change_key_column])
+      ds = verify_login_change_ds(id)
+      ds.where(Sequel::CURRENT_TIMESTAMP > verify_login_change_deadline_column).delete
+      apply_key_for_update(ds).get([verify_login_change_login_column, verify_login_change_key_column])
     end
 
     def change_login_notice_flash
@@ -210,10 +214,14 @@ module Rodauth
     end
 
     def _account_from_verify_login_change_key(token)
-      account_from_key(token) do |id|
+      account_from_key(token, verify_login_change_account_status_value) do |id|
         @verify_login_change_new_login, key = get_verify_login_change_login_and_key(id)
         key
       end
     end
+
+    def verify_login_change_account_status_value
+      account_open_status_value
+    end
   end
 end

data/lib/rodauth/features/webauthn.rb

@@ -4,7 +4,7 @@ require 'webauthn'
 
 module Rodauth
   Feature.define(:webauthn, :Webauthn) do
-    depends :two_factor_base
+    depends :two_factor_base, :require_domain, :require_hmac_secret
 
     loaded_templates %w'webauthn-setup webauthn-auth webauthn-remove'
 
@@ -164,7 +164,7 @@ module Rodauth
     end
     
     route(:webauthn_setup) do |r|
-      require_authentication unless two_factor_login_type_match?('webauthn')
+      require_authentication unless webauthn_modification_authenticated?
       require_account_session
       before_webauthn_setup_route
 
@@ -185,7 +185,7 @@ module Rodauth
               raise Sequel::Rollback
             end
 
-            unless two_factor_authenticated?
+            if !two_factor_authenticated? && !authenticated_by.include?('webauthn')
               webauthn_update_session(webauthn_credential.id)
               two_factor_update_session('webauthn')
             end
@@ -205,7 +205,7 @@ module Rodauth
     end
 
     route(:webauthn_remove) do |r|
-      require_authentication unless two_factor_login_type_match?('webauthn')
+      require_authentication unless webauthn_modification_authenticated?
       require_account_session
       require_webauthn_setup
       before_webauthn_remove_route
@@ -469,6 +469,11 @@ module Rodauth
     # :nocov:
     end
 
+    def webauthn_modification_authenticated?
+      two_factor_login_type_match?('webauthn') &&
+        (!uses_two_factor_authentication? || two_factor_modifications_require_password?)
+    end
+
     def _two_factor_auth_links
       links = super
       links << [10, webauthn_auth_path, webauthn_auth_link_text] if webauthn_setup? && !two_factor_login_type_match?('webauthn')
@@ -501,7 +506,7 @@ module Rodauth
     end
 
     def webauthn_account_id
-      session_value
+      account_id_or_session_value
     end
 
     def webauthn_user_ids_ds

data/lib/rodauth/features/webauthn_login.rb

@@ -76,7 +76,7 @@ module Rodauth
     end
 
     def account_from_webauthn_login
-      account_from_login(login_param_value)
+      @account_retrieval_type == :login ? @account : account_from_login(login_param_value)
     end
 
     def webauthn_login_options?
@@ -91,14 +91,5 @@ module Rodauth
       end
       forms
     end
-
-    def webauthn_account_id
-      case @current_route
-      when :login, :webauthn_login, nil # nil for internal request
-        account_id
-      else
-        super
-      end
-    end
   end
 end