Fix GHSA-vx32-x96w-qq65

app/controllers/auth/sessions_controller.rb

@@ -51,8 +51,14 @@ class Auth::SessionsController < Devise::SessionsController
   def find_user_from_params
     user   = User.authenticate_with_ldap(user_params) if Devise.ldap_authentication
     user ||= User.authenticate_with_pam(user_params) if Devise.pam_authentication
-    user ||= User.find_for_authentication(email: user_params[:email])
-    user
+
+    if user.present?
+      @password_verified_externally = true
+      return user
+    end
+
+    user = User.find_for_authentication(email: user_params[:email])
+    user if user&.encrypted_password.present?
   end
 
   def user_params

app/controllers/concerns/auth/two_factor_authentication_concern.rb

@@ -38,7 +38,7 @@ module Auth::TwoFactorAuthenticationConcern
   def authenticate_with_two_factor
     if user_params[:email].present?
       user = self.resource = find_user_from_params
-      prompt_for_two_factor(user) if user&.external_or_valid_password?(user_params[:password])
+      prompt_for_two_factor(user) if user && (@password_verified_externally || user.valid_password?(user_params[:password]))
     elsif session[:attempt_user_id]
       user = self.resource = User.find_by(id: session[:attempt_user_id])
       return if user.nil?

app/models/user.rb

@@ -317,13 +317,6 @@ class User < ApplicationRecord
     super
   end
 
-  def external_or_valid_password?(compare_password)
-    # If encrypted_password is blank, we got the user from LDAP or PAM,
-    # so credentials are already valid
-
-    encrypted_password.blank? || valid_password?(compare_password)
-  end
-
   def send_reset_password_instructions
     return false if encrypted_password.blank?
 

spec/lib/mastodon/cli/accounts_spec.rb

@@ -374,7 +374,7 @@ RSpec.describe Mastodon::CLI::Accounts do
             .to output_results(new_password)
 
           expect(user).to have_received(:change_password!).with(new_password)
-          expect(user.reload).to_not be_external_or_valid_password(original_password)
+          expect(user.reload).to_not be_valid_password(original_password)
         end
       end
 

spec/models/user_spec.rb

@@ -462,7 +462,7 @@ RSpec.describe User do
         .and remove_user_web_subscriptions
 
       expect(user)
-        .to_not be_external_or_valid_password(original_password)
+        .to_not be_valid_password(original_password)
       expect { session_activation.reload }
         .to raise_error(ActiveRecord::RecordNotFound)
       expect { web_push_subscription.reload }

spec/requests/auth/passwords_spec.rb

@@ -27,7 +27,7 @@ RSpec.describe 'Auth Passwords' do
 
         expect(User.find(user.id))
           .to be_present
-          .and be_external_or_valid_password(user.password)
+          .and be_valid_password(user.password)
       end
     end
   end