mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-09-23 06:04:17 +00:00
c8a3a2d723
The confirmation gate in updateSetting only covered the true -> false transition, so a settings save that kept twoFactorEnable=true while carrying a non-blank twoFactorToken silently rebound the authenticator. preserveRedactedSecrets restores the stored secret only when the submitted one is blank, so a non-blank value went straight through without any branch asking for a code. Not reachable pre-auth or cross-site (CSRFMiddleware rejects unsafe methods without the session token), but it matters after a session hijack or with an admin API token, which sets api_authed and short-circuits the CSRF check: the attacker gains persistence and locks the legitimate operator out of their own authenticator. Now a code is required whenever 2FA is currently on and the submitted secret differs from the stored one. Enabling from off is untouched, as no code exists yet to verify, and a blank secret still means "unchanged", so the panel's normal save path is unaffected. Reported by @n0ctal (GHSA-xqqw-jqqv-99h6). |
||
|---|---|---|
| .. | ||
| api.go | ||
| api_auth_test.go | ||
| base.go | ||
| client.go | ||
| dist.go | ||
| dist_test.go | ||
| geodata_test.go | ||
| group.go | ||
| host.go | ||
| host_test.go | ||
| inbound.go | ||
| index.go | ||
| login_limiter.go | ||
| login_limiter_test.go | ||
| node.go | ||
| node_credentials_writeonly_test.go | ||
| panel_update_test.go | ||
| pwa.go | ||
| pwa_test.go | ||
| server.go | ||
| setting.go | ||
| setting_test.go | ||
| spa.go | ||
| spa_test.go | ||
| util.go | ||
| util_test.go | ||
| websocket.go | ||
| xray_setting.go | ||
| xray_setting_warp_test.go | ||