Ensure that 2fa is checked on reset-password

routers/user/auth.go

@@ -1284,7 +1284,7 @@ func ForgotPasswdPost(ctx *context.Context) {
  ctx.HTML(200, tplForgotPassword)
 }
 
-func commonResetPassword(ctx *context.Context) *models.User {
+func commonResetPassword(ctx *context.Context) (*models.User, *models.TwoFactor) {
  code := ctx.Query("code")
 
  ctx.Data["Title"] = ctx.Tr("auth.reset_password")
@@ -1296,39 +1296,56 @@ func commonResetPassword(ctx *context.Context) *models.User {
 
  if len(code) == 0 {
  ctx.Flash.Error(ctx.Tr("auth.invalid_code"))
- return nil
+ return nil, nil
  }
 
  // Fail early, don't frustrate the user
  u := models.VerifyUserActiveCode(code)
  if u == nil {
  ctx.Flash.Error(ctx.Tr("auth.invalid_code"))
- return nil
+ return nil, nil
+ }
+
+ twofa, err := models.GetTwoFactorByUID(u.ID)
+ if err != nil {
+ if !models.IsErrTwoFactorNotEnrolled(err) {
+ ctx.Error(http.StatusInternalServerError, "CommonResetPassword", err.Error())
+ return nil, nil
+ }
+ } else {
+ ctx.Data["has_two_factor"] = true
+ ctx.Data["scratch_code"] = ctx.QueryBool("scratch_code")
  }
 
  // Show the user that they are affecting the account that they intended to
  ctx.Data["user_email"] = u.Email
 
  if nil != ctx.User && u.ID != ctx.User.ID {
  ctx.Flash.Error(ctx.Tr("auth.reset_password_wrong_user", ctx.User.Email, u.Email))
- return nil
+ return nil, nil
  }
 
- return u
+ return u, twofa
 }
 
 // ResetPasswd render the account recovery page
 func ResetPasswd(ctx *context.Context) {
  ctx.Data["IsResetForm"] = true
 
  commonResetPassword(ctx)
+ if ctx.Written() {
+ return
+ }
 
  ctx.HTML(200, tplResetPassword)
 }
 
 // ResetPasswdPost response from account recovery request
 func ResetPasswdPost(ctx *context.Context) {
- u := commonResetPassword(ctx)
+ u, twofa := commonResetPassword(ctx)
+ if ctx.Written() {
+ return
+ }
 
  if u == nil {
  // Flash error has been set
@@ -1350,6 +1367,39 @@ func ResetPasswdPost(ctx *context.Context) {
  return
  }
 
+ // Handle two-factor
+ regenerateScratchToken := false
+ if twofa != nil {
+ if ctx.QueryBool("scratch_code") {
+ if !twofa.VerifyScratchToken(ctx.Query("token")) {
+ ctx.Data["IsResetForm"] = true
+ ctx.Data["Err_Token"] = true
+ ctx.RenderWithErr(ctx.Tr("auth.twofa_scratch_token_incorrect"), tplResetPassword, nil)
+ return
+ }
+ regenerateScratchToken = true
+ } else {
+ passcode := ctx.Query("passcode")
+ ok, err := twofa.ValidateTOTP(passcode)
+ if err != nil {
+ ctx.Error(http.StatusInternalServerError, "ValidateTOTP", err.Error())
+ return
+ }
+ if !ok || twofa.LastUsedPasscode == passcode {
+ ctx.Data["IsResetForm"] = true
+ ctx.Data["Err_Passcode"] = true
+ ctx.RenderWithErr(ctx.Tr("auth.twofa_passcode_incorrect"), tplResetPassword, nil)
+ return
+ }
+
+ twofa.LastUsedPasscode = passcode
+ if err = models.UpdateTwoFactor(twofa); err != nil {
+ ctx.ServerError("ResetPasswdPost: UpdateTwoFactor", err)
+ return
+ }
+ }
+ }
+
  var err error
  if u.Rands, err = models.GetUserSalt(); err != nil {
  ctx.ServerError("UpdateUser", err)
@@ -1359,7 +1409,6 @@ func ResetPasswdPost(ctx *context.Context) {
  ctx.ServerError("UpdateUser", err)
  return
  }
-
  u.HashPassword(passwd)
  u.MustChangePassword = false
  if err := models.UpdateUserCols(u, "must_change_password", "passwd", "rands", "salt"); err != nil {
@@ -1368,9 +1417,27 @@ func ResetPasswdPost(ctx *context.Context) {
  }
 
  log.Trace("User password reset: %s", u.Name)
-
  ctx.Data["IsResetFailed"] = true
  remember := len(ctx.Query("remember")) != 0
+
+ if regenerateScratchToken {
+ // Invalidate the scratch token.
+ _, err = twofa.GenerateScratchToken()
+ if err != nil {
+ ctx.ServerError("UserSignIn", err)
+ return
+ }
+ if err = models.UpdateTwoFactor(twofa); err != nil {
+ ctx.ServerError("UserSignIn", err)
+ return
+ }
+
+ handleSignInFull(ctx, u, remember, false)
+ ctx.Flash.Info(ctx.Tr("auth.twofa_scratch_used"))
+ ctx.Redirect(setting.AppSubURL + "/user/settings/security")
+ return
+ }
+
  handleSignInFull(ctx, u, remember, true)
 }
 

templates/user/auth/reset_passwd.tmpl

@@ -18,7 +18,7 @@
  {{end}}
  {{if .IsResetForm}}
  <div class="required inline field {{if .Err_Password}}error{{end}}">
- <label for="password">{{.i18n.Tr "password"}}</label>
+ <label for="password">{{.i18n.Tr "settings.new_password"}}</label>
  <input id="password" name="password" type="password" value="{{.password}}" autocomplete="off" autofocus required>
  </div>
  {{if not .user_signed_in}}
@@ -30,10 +30,31 @@
  </div>
  </div>
  {{end}}
+ {{if .has_two_factor}}
+ <h4 class="ui dividing header">
+ {{.i18n.Tr "twofa"}}
+ </h4>
+ <div class="ui warning visible message">{{.i18n.Tr "settings.twofa_is_enrolled" | Str2html }}</div>
+ {{if .scratch_code}}
+ <div class="required inline field {{if .Err_Token}}error{{end}}">
+ <label for="token">{{.i18n.Tr "auth.scratch_code"}}</label>
+ <input id="token" name="token" type="text" autocomplete="off" autofocus required>
+ </div>
+ <input type="hidden" name="scratch_code" value="true">
+ {{else}}
+ <div class="required inline field {{if .Err_Passcode}}error{{end}}">
+ <label for="passcode">{{.i18n.Tr "passcode"}}</label>
+ <input id="passcode" name="passcode" type="number" autocomplete="off" autofocus required>
+ </div>
+ {{end}}
+ {{end}}
  <div class="ui divider"></div>
  <div class="inline field">
  <label></label>
  <button class="ui blue button">{{.i18n.Tr "auth.reset_password_helper"}}</button>
+ {{if and .has_two_factor (not .scratch_code)}}
+ <a href="{{.Link}}?code={{.Code}}&amp;scratch_code=true">{{.i18n.Tr "auth.use_scratch_code" | Str2html}}</a>
+ {{end}}
  </div>
  {{else}}
  <p class="center">{{.i18n.Tr "auth.invalid_code"}}</p>