From ffad3f83fe97a6eb9943de4e004e49ac1590d2e4 Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Thu, 7 May 2020 16:32:28 +0200 Subject: [PATCH] Validate app password on alternative login Fixes #20838 Signed-off-by: Roeland Jago Douma --- core/Controller/ClientFlowLoginController.php | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/core/Controller/ClientFlowLoginController.php b/core/Controller/ClientFlowLoginController.php index d5beded9581..80cf94a7900 100644 --- a/core/Controller/ClientFlowLoginController.php +++ b/core/Controller/ClientFlowLoginController.php @@ -377,6 +377,24 @@ class ClientFlowLoginController extends Controller { return $this->stateTokenForbiddenResponse(); } + try { + $token = $this->tokenProvider->getToken($password); + if ($token->getLoginName() !== $user) { + throw new InvalidTokenException('login name does not match'); + } + } catch (InvalidTokenException $e) { + $response = new StandaloneTemplateResponse( + $this->appName, + '403', + [ + 'message' => $this->l10n->t('Invalid app password'), + ], + 'guest' + ); + $response->setStatus(Http::STATUS_FORBIDDEN); + return $response; + } + $redirectUri = 'nc://login/server:' . $this->getServerPath() . '&user:' . urlencode($user) . '&password:' . urlencode($password); return new Http\RedirectResponse($redirectUri); }