self-hosted/mailcow-dockerized
1
0
Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2024-12-10 10:40:15 +02:00
Code Issues Releases Activity

restrict webauthn-tfa-get-args sql query

Browse Source
This commit is contained in:
FreddleSpl0it 2022-05-18 10:03:10 +02:00
parent 4ec982163e
commit 7d5990bf0f
No known key found for this signature in database
GPG Key ID: F1B3BE8A3BBA3451
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
data/web/json_api.php
View File

@ -452,8 +452,11 @@ if (isset($_GET['query'])) {
}
break;
case "webauthn-tfa-get-args":
$stmt = $pdo->prepare("SELECT `keyHandle` FROM `tfa` WHERE username = :username AND authmech = `webauthn`");
$stmt->execute(array(':username' => $_SESSION['pending_mailcow_cc_username']));
$stmt = $pdo->prepare("SELECT `keyHandle` FROM `tfa` WHERE username = :username AND authmech = :authmech");
$stmt->execute(array(
':username' => $_SESSION['pending_mailcow_cc_username'],
':authmech' => 'webauthn'
));
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
if (count($rows) == 0) {
print(json_encode(array(