Dereku/snappymail
0
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-11-04 03:18:49 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions
7379 commits 9 branches 204 tags 84 MiB
Commit graph

38 commits

Author SHA1 Message Date
djmaze
fcf45b51ac Merge remote-tracking branch 'ghsa-crj4-pmx2-cxqm/advisory-fix-1' 2026-11-03 15:23:55 +01:00
djmaze
a67c85885e @ZaphodB fix(security): two-factor-auth could be switched off with only a session 
With 2-step verification enabled, these plugin actions needed nothing but a
session (and the CSRF token that comes with it):

- EnableTwoFactor with Enable=0 switched it off,
- ClearTwoFactorInfo deleted it,
- CreateTwoFactorSecret overwrote the secret with Enable false, i.e. also
  switched it off,
- ShowTwoFactorSecret returned the secret and QR code.

A stolen cookie or an unlocked machine was enough to drop or copy the second
factor. While 2FA is enabled, all four now require a current TOTP or backup
code, checked as at login; a backup code used here is spent. Enabling and the
first setup are unchanged. Backup codes come from random_int() instead of rand().

The settings page asks for the code (the existing "Verification Code" label)
before those actions and sends it. A refused change reloads the real state;
before, any error made the page show 2FA as not configured. A cancelled or
refused "off" puts the checkbox back. TwoFactorAuthSettings.min.js, which is
what is served, is now the same file as the source rather than a separate
hand-minified copy.

test/two-factor-reauth.php drives the real gate with storage and provider
stubbed: open while not enabled; refused with no, a wrong or an unknown backup
code while enabled; allowed with a valid TOTP or backup code, which is spent.
 2026-10-27 22:27:03 +01:00
the-djmaze
343ef172d1 Resolve #2008 2026-10-24 14:52:36 +02:00
the-djmaze
2a56595cf9 Rename languages in extensions 2024-03-29 01:06:47 +01:00
the-djmaze
dceb5fca41 Resolve #1439 2024-02-15 23:56:26 +01:00
the-djmaze
7135af995d Extend example extension code with more details 2023-11-27 01:51:23 +01:00
the-djmaze
1bf252ad7e Revert #1241 due to #1283 2023-10-24 00:42:04 +02:00
the-djmaze
9a4b73e819 Resolve #1270 2023-10-08 14:59:03 +02:00
the-djmaze
d4e76fb42c Improved solution for #1241 2023-10-02 16:36:22 +02:00
the-djmaze
edad4ac025 Resolve #1241 2023-10-02 16:15:29 +02:00
the-djmaze
d0e6a78f72 Bump version #1251 2023-10-02 15:22:24 +02:00
tinola
231480e775 update version number 2023-07-07 17:13:44 +02:00
the-djmaze
103b431780 Bugfix: GetActionParam() failed 2023-04-11 13:57:28 +02:00
the-djmaze
e35fbea415 Security: disable spellcheck everywhere by default due to Chrome/Edge sending data you enter to their servers. 2022-09-20 12:26:12 +02:00
the-djmaze
656c5f2a3e Bugfix: 2FA enforcement #349 2022-05-20 12:36:30 +02:00
the-djmaze
310a88b0a5 Resolve TOTP QR code not readable #360 2022-05-02 20:02:53 +02:00
the-djmaze
a06b59784a Changes for #349 2022-04-29 13:23:04 +02:00
the-djmaze
8b3cfc7a67 Add support for global 2FA enforcement #349 2022-04-25 16:21:16 +02:00
the-djmaze
375f715b78 TOTP plugin improved QRCode view 2022-04-25 15:20:37 +02:00
the-djmaze
4f2f2dd485 Resolve #263 2022-03-04 11:53:36 +01:00
the-djmaze
fe0f6af9f4 Renamed closeCommand() to close() because it has no command feature anymore 2022-03-04 09:21:24 +01:00
the-djmaze
3f801cb762 TOTP extension v2.13 2022-02-28 14:55:00 +01:00
the-djmaze
7265cf03d9 https://github.com/the-djmaze/snappymail/issues/236#issuecomment-1041465503 2022-02-16 15:01:26 +01:00
the-djmaze
ab95a6ccb3 Forgot to make release, see #236 2022-02-16 10:19:57 +01:00
djmaze
17932f2905 Bugfix: broken TOTP plugin 2021-11-18 13:51:11 +01:00
djmaze
346829be38 v2.9.2 2021-11-17 14:20:04 +01:00
djmaze
7ede8eeb4a Better solution for #150 2021-10-04 13:53:59 +02:00
David Härdeman
4e28a7bb7b [snappymail] More changes to use the word "extensions" rather than plugins/packages 2021-08-27 23:49:03 +02:00
djmaze
b7cb990b00 v2.6.0 2021-07-28 16:11:59 +02:00
djmaze
55a581f922 Resolved Issue #84 2021-07-23 16:21:06 +02:00
djmaze
d1f43f49b7 Cleanup plugin languages 2021-07-23 16:18:23 +02:00
djmaze
8b760ef0d1 Get this plugin working 2021-07-23 15:58:54 +02:00
djmaze
2d1f99a8ce Get 2FA plugin somesort of working 2021-07-23 13:36:38 +02:00
djmaze
7d61f40fff improved some 2fa code based onmaster source changes 2021-07-22 22:14:26 +02:00
djmaze
2ed328d07c Improved 2fa plugin 2021-04-14 15:33:37 +02:00
djmaze
7621ecbf2a improve 2fa plugin 2021-04-14 15:24:57 +02:00
djmaze
54d2fb93cc Prepare more 2fa data 2021-04-14 10:11:09 +02:00
djmaze
d9bab28bfe #84 as plugin 2021-04-13 11:42:06 +02:00