uffd 2.3.0__tar.gz → 2.3.2__tar.gz

{uffd-2.3.0/uffd.egg-info → uffd-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: uffd
-Version: 2.3.0
+Version: 2.3.2
 Summary: Web-based user management and single sign-on software
 Home-page: https://git.cccv.de/uffd/uffd
 Author: CCCV
@@ -47,6 +47,17 @@ Requires-Dist: urllib3==1.24.1
 Requires-Dist: Werkzeug==0.14.1
 Requires-Dist: python-dateutil==2.7.3
 Requires-Dist: Mako==1.0.7
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
 
 **DO NOT INSTALL FROM PIP FOR PRODUCTION DEPLOYMENTS**, see [Deployment](#Deployment) for more information.
 

uffd-2.3.2/tests/test_secure_redirect.py

@@ -0,0 +1,16 @@
+from uffd.secure_redirect import secure_local_redirect
+
+from tests.utils import UffdTestCase
+
+class TestSecureRedirect(UffdTestCase):
+	def test_valid(self):
+		self.assertEqual(secure_local_redirect('/').location, '/')
+		self.assertEqual(secure_local_redirect('/foo/bar?foo=bar').location, '/foo/bar?foo=bar')
+
+	def test_invalid(self):
+		self.assertEqual(secure_local_redirect('example.com/foo').location, '/')
+		self.assertEqual(secure_local_redirect('https://example.com/foo').location, '/')
+		self.assertEqual(secure_local_redirect('https%3A%2F%2Fexample.com/foo').location, '/')
+		self.assertEqual(secure_local_redirect('//example.com/foo').location, '/')
+		self.assertEqual(secure_local_redirect('/\\example.com/foo').location, '/')
+		self.assertEqual(secure_local_redirect('/%2Fexample.com/foo').location, '/')

uffd-2.3.2/uffd/migrations/versions/a9b449776953_add_mfa_method_totp_last_counter.py

@@ -0,0 +1,51 @@
+"""Add mfa_method.totp_last_counter
+
+Revision ID: a9b449776953
+Revises: 23293f32b503
+Create Date: 2023-11-07 12:09:23.843865
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = 'a9b449776953'
+down_revision = '23293f32b503'
+branch_labels = None
+depends_on = None
+
+def upgrade():
+	meta = sa.MetaData(bind=op.get_bind())
+	mfa_method = sa.Table('mfa_method', meta,
+		sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+		sa.Column('type', sa.Enum('RECOVERY_CODE', 'TOTP', 'WEBAUTHN', create_constraint=True, name='ck_mfa_method_type'), nullable=False),
+		sa.Column('created', sa.DateTime(), nullable=False),
+		sa.Column('name', sa.String(length=128), nullable=True),
+		sa.Column('user_id', sa.Integer(), nullable=False),
+		sa.Column('recovery_salt', sa.String(length=64), nullable=True),
+		sa.Column('recovery_hash', sa.String(length=256), nullable=True),
+		sa.Column('totp_key', sa.String(length=64), nullable=True),
+		sa.Column('webauthn_cred', sa.Text(), nullable=True),
+		sa.ForeignKeyConstraint(['user_id'], ['user.id'], name=op.f('fk_mfa_method_user_id_user'), onupdate='CASCADE', ondelete='CASCADE'),
+		sa.PrimaryKeyConstraint('id', name=op.f('pk_mfa_method'))
+	)
+	with op.batch_alter_table('mfa_method', copy_from=mfa_method) as batch_op:
+		batch_op.add_column(sa.Column('totp_last_counter', sa.Integer(), nullable=True))
+
+def downgrade():
+	meta = sa.MetaData(bind=op.get_bind())
+	mfa_method = sa.Table('mfa_method', meta,
+		sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+		sa.Column('type', sa.Enum('RECOVERY_CODE', 'TOTP', 'WEBAUTHN', create_constraint=True, name='ck_mfa_method_type'), nullable=False),
+		sa.Column('created', sa.DateTime(), nullable=False),
+		sa.Column('name', sa.String(length=128), nullable=True),
+		sa.Column('user_id', sa.Integer(), nullable=False),
+		sa.Column('recovery_salt', sa.String(length=64), nullable=True),
+		sa.Column('recovery_hash', sa.String(length=256), nullable=True),
+		sa.Column('totp_key', sa.String(length=64), nullable=True),
+		sa.Column('totp_last_counter', sa.Integer(), nullable=True),
+		sa.Column('webauthn_cred', sa.Text(), nullable=True),
+		sa.ForeignKeyConstraint(['user_id'], ['user.id'], name=op.f('fk_mfa_method_user_id_user'), onupdate='CASCADE', ondelete='CASCADE'),
+		sa.PrimaryKeyConstraint('id', name=op.f('pk_mfa_method'))
+	)
+	with op.batch_alter_table('mfa_method', copy_from=mfa_method) as batch_op:
+		batch_op.drop_column('totp_last_counter')

{uffd-2.3.0 → uffd-2.3.2}/uffd/models/mfa.py

@@ -79,6 +79,7 @@ def _hotp(counter, key, digits=6):
 
 class TOTPMethod(MFAMethod):
 	key = Column('totp_key', String(64))
+	last_counter = Column('totp_last_counter', Integer())
 	user = relationship('User', backref='mfa_totp_methods')
 
 	__mapper_args__ = {
@@ -120,10 +121,13 @@ class TOTPMethod(MFAMethod):
 		:param code: String of digits (as entered by the user)
 
 		:returns: True if code is valid, False otherwise'''
-		counter = int(time.time()/30)
-		for valid_code in [_hotp(counter-1, self.raw_key), _hotp(counter, self.raw_key)]:
-			if secrets.compare_digest(code, valid_code):
-				return True
+		current_counter = int(time.time()/30)
+		for counter in (current_counter - 1, current_counter):
+			if counter > (self.last_counter or 0):
+				valid_code = _hotp(counter, self.raw_key)
+				if secrets.compare_digest(code, valid_code):
+					self.last_counter = counter
+					return True
 		return False
 
 class WebauthnMethod(MFAMethod):

uffd-2.3.2/uffd/secure_redirect.py

@@ -0,0 +1,9 @@
+import re
+
+from flask import redirect
+
+def secure_local_redirect(target):
+	# Only accept local and absolute URLs
+	if not re.match('^/[a-zA-Z0-9]', target):
+		target = '/'
+	return redirect(target)

{uffd-2.3.0 → uffd-2.3.2}/uffd/views/mfa.py

@@ -215,6 +215,7 @@ def auth_finish():
 		return redirect(url_for('mfa.auth', ref=request.values.get('ref')))
 	for method in request.user_pre_mfa.mfa_totp_methods:
 		if method.verify(request.form['code']):
+			db.session.commit()
 			session['user_mfa'] = True
 			set_request_user()
 			return secure_local_redirect(request.values.get('ref', url_for('index')))

{uffd-2.3.0 → uffd-2.3.2}/uffd/views/oauth2.py

@@ -92,7 +92,15 @@ class UffdRequestValidator(oauthlib.oauth2.RequestValidator):
 		return True
 
 	def invalidate_authorization_code(self, client_id, code, oauthreq, *args, **kwargs):
-		OAuth2Grant.query.filter_by(client=oauthreq.client, code=code).delete()
+		if '-' not in code:
+			return
+		grant_id, grant_code = code.split('-', 2)
+		grant = OAuth2Grant.query.get(grant_id)
+		if not grant or grant.client != oauthreq.client:
+			return
+		if not secrets.compare_digest(grant.code, grant_code):
+			return
+		db.session.delete(grant)
 		db.session.commit()
 
 	def save_bearer_token(self, token_data, oauthreq, *args, **kwargs):

{uffd-2.3.0 → uffd-2.3.2}/uffd/views/selfservice.py

@@ -106,6 +106,7 @@ def token_password(token_id, token):
 
 @bp.route("/email/new", methods=['POST'])
 @login_required(selfservice_acl_check)
+@csrf_protect(blueprint=bp)
 def add_email():
 	email = UserEmail(user=request.user)
 	if not email.set_address(request.form['address']):
@@ -154,6 +155,7 @@ def verify_email(secret, email_id=None, legacy_id=None):
 
 @bp.route("/email/<int:email_id>/retry")
 @login_required(selfservice_acl_check)
+@csrf_protect(blueprint=bp)
 def retry_email_verification(email_id):
 	email = UserEmail.query.filter_by(id=email_id, user=request.user, verified=False).first_or_404()
 	secret = email.start_verification()
@@ -166,6 +168,7 @@ def retry_email_verification(email_id):
 
 @bp.route("/email/<int:email_id>/delete", methods=['POST', 'GET'])
 @login_required(selfservice_acl_check)
+@csrf_protect(blueprint=bp)
 def delete_email(email_id):
 	email = UserEmail.query.filter_by(id=email_id, user=request.user).first_or_404()
 	try:
@@ -179,6 +182,7 @@ def delete_email(email_id):
 
 @bp.route("/email/preferences", methods=['POST'])
 @login_required(selfservice_acl_check)
+@csrf_protect(blueprint=bp)
 def update_email_preferences():
 	verified_emails = UserEmail.query.filter_by(user=request.user, verified=True)
 	request.user.primary_email = verified_emails.filter_by(id=request.form['primary_email']).one()

{uffd-2.3.0 → uffd-2.3.2/uffd.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.4
 Name: uffd
-Version: 2.3.0
+Version: 2.3.2
 Summary: Web-based user management and single sign-on software
 Home-page: https://git.cccv.de/uffd/uffd
 Author: CCCV
@@ -47,6 +47,17 @@ Requires-Dist: urllib3==1.24.1
 Requires-Dist: Werkzeug==0.14.1
 Requires-Dist: python-dateutil==2.7.3
 Requires-Dist: Mako==1.0.7
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
 
 **DO NOT INSTALL FROM PIP FOR PRODUCTION DEPLOYMENTS**, see [Deployment](#Deployment) for more information.
 

{uffd-2.3.0 → uffd-2.3.2}/uffd.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ tests/test_csrf.py
 tests/test_password_hash.py
 tests/test_ratelimit.py
 tests/test_remailer.py
+tests/test_secure_redirect.py
 tests/test_tasks.py
 tests/test_utils.py
 uffd/__init__.py
@@ -58,6 +59,7 @@ uffd/migrations/versions/a29870f95175_initial_migration.py
 uffd/migrations/versions/a594d3b3e05b_added_role_locked.py
 uffd/migrations/versions/a60ce68b9214_fix_not_null_on_role_groups_group_id.py
 uffd/migrations/versions/a8c6b6e91c28_device_login.py
+uffd/migrations/versions/a9b449776953_add_mfa_method_totp_last_counter.py
 uffd/migrations/versions/aeb07202a6c8_locking_and_new_id_allocation.py
 uffd/migrations/versions/af07cea65391_unified_password_hashing_for_user_and_signup.py
 uffd/migrations/versions/aff5f350dcdf_added_role_is_default.py

uffd-2.3.0/uffd/secure_redirect.py

@@ -1,7 +0,0 @@
-from flask import redirect
-
-def secure_local_redirect(target):
-	# Reject URLs that include a scheme or host part
-	if not target.startswith('/') or target.startswith('//'):
-		target = '/'
-	return redirect(target)