From f7cf4e4dd21e96a120bd07853b13effe0a84d90d Mon Sep 17 00:00:00 2001 From: Claire Date: Thu, 27 Aug 2026 15:48:53 +0200 Subject: [PATCH] Fix GHSA-vx32-x96w-qq65 --- app/controllers/auth/sessions_controller.rb | 10 ++++++++-- .../concerns/auth/two_factor_authentication_concern.rb | 2 +- app/models/user.rb | 7 ------- spec/lib/mastodon/cli/accounts_spec.rb | 2 +- spec/models/user_spec.rb | 2 +- spec/requests/auth/passwords_spec.rb | 2 +- 6 files changed, 12 insertions(+), 13 deletions(-) diff --git a/app/controllers/auth/sessions_controller.rb b/app/controllers/auth/sessions_controller.rb index 67bee2344ef..3d757be6795 100644 --- a/app/controllers/auth/sessions_controller.rb +++ b/app/controllers/auth/sessions_controller.rb @@ -51,8 +51,14 @@ class Auth::SessionsController < Devise::SessionsController def find_user_from_params user = User.authenticate_with_ldap(user_params) if Devise.ldap_authentication user ||= User.authenticate_with_pam(user_params) if Devise.pam_authentication - user ||= User.find_for_authentication(email: user_params[:email]) - user + + if user.present? + @password_verified_externally = true + return user + end + + user = User.find_for_authentication(email: user_params[:email]) + user if user&.encrypted_password.present? end def user_params diff --git a/app/controllers/concerns/auth/two_factor_authentication_concern.rb b/app/controllers/concerns/auth/two_factor_authentication_concern.rb index 0fb11428dca..5dca3be67e3 100644 --- a/app/controllers/concerns/auth/two_factor_authentication_concern.rb +++ b/app/controllers/concerns/auth/two_factor_authentication_concern.rb @@ -38,7 +38,7 @@ module Auth::TwoFactorAuthenticationConcern def authenticate_with_two_factor if user_params[:email].present? user = self.resource = find_user_from_params - prompt_for_two_factor(user) if user&.external_or_valid_password?(user_params[:password]) + prompt_for_two_factor(user) if user && (@password_verified_externally || user.valid_password?(user_params[:password])) elsif session[:attempt_user_id] user = self.resource = User.find_by(id: session[:attempt_user_id]) return if user.nil? diff --git a/app/models/user.rb b/app/models/user.rb index 774aff58b24..9170fdd5e29 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -317,13 +317,6 @@ class User < ApplicationRecord super end - def external_or_valid_password?(compare_password) - # If encrypted_password is blank, we got the user from LDAP or PAM, - # so credentials are already valid - - encrypted_password.blank? || valid_password?(compare_password) - end - def send_reset_password_instructions return false if encrypted_password.blank? diff --git a/spec/lib/mastodon/cli/accounts_spec.rb b/spec/lib/mastodon/cli/accounts_spec.rb index 927c6ca8deb..bd25d926f46 100644 --- a/spec/lib/mastodon/cli/accounts_spec.rb +++ b/spec/lib/mastodon/cli/accounts_spec.rb @@ -374,7 +374,7 @@ RSpec.describe Mastodon::CLI::Accounts do .to output_results(new_password) expect(user).to have_received(:change_password!).with(new_password) - expect(user.reload).to_not be_external_or_valid_password(original_password) + expect(user.reload).to_not be_valid_password(original_password) end end diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index 35f0b987614..2b5021176f3 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -462,7 +462,7 @@ RSpec.describe User do .and remove_user_web_subscriptions expect(user) - .to_not be_external_or_valid_password(original_password) + .to_not be_valid_password(original_password) expect { session_activation.reload } .to raise_error(ActiveRecord::RecordNotFound) expect { web_push_subscription.reload } diff --git a/spec/requests/auth/passwords_spec.rb b/spec/requests/auth/passwords_spec.rb index feefd945876..6da0f6d05da 100644 --- a/spec/requests/auth/passwords_spec.rb +++ b/spec/requests/auth/passwords_spec.rb @@ -27,7 +27,7 @@ RSpec.describe 'Auth Passwords' do expect(User.find(user.id)) .to be_present - .and be_external_or_valid_password(user.password) + .and be_valid_password(user.password) end end end