This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch db/8603
in repository https://gitbox.apache.org/repos/asf/allura.git
The following commit(s) were added to refs/heads/db/8603 by this push:
new 191be4fee [#8603] check multifactor login mode
191be4fee is described below
commit 191be4feeb921d64e01eaf2e0085fec1bf82e677
Author: Dave Brondsema <[email protected]>
AuthorDate: Tue May 12 16:15:09 2026 -0400
[#8603] check multifactor login mode
---
Allura/allura/controllers/auth.py | 2 ++
Allura/allura/tests/functional/test_auth.py | 24 ++++++++++++++++++++++++
2 files changed, 26 insertions(+)
diff --git a/Allura/allura/controllers/auth.py
b/Allura/allura/controllers/auth.py
index 7aedac3da..a500df93d 100644
--- a/Allura/allura/controllers/auth.py
+++ b/Allura/allura/controllers/auth.py
@@ -464,6 +464,8 @@ def do_multifactor(self, code, mode, **kwargs):
recovery = RecoveryCodeService.get()
recovery.verify_and_remove_code(user, code)
h.auditlog_user('Logged in using a multifactor recovery code',
user=user)
+ else:
+ raise InvalidToken('Invalid multifactor mode')
except (InvalidToken, InvalidRecoveryCode):
request.validation.errors['code'] = 'Invalid code, please try
again.'
h.auditlog_user('Multifactor login - invalid code', user=user)
diff --git a/Allura/allura/tests/functional/test_auth.py
b/Allura/allura/tests/functional/test_auth.py
index 3893a4bda..c088c0d79 100644
--- a/Allura/allura/tests/functional/test_auth.py
+++ b/Allura/allura/tests/functional/test_auth.py
@@ -3320,6 +3320,30 @@ def test_login_recovery_code(self):
# confirm code used up
assert recovery_code not in RecoveryCodeService().get().get_codes(user)
+ def test_login_invalid_mode(self):
+ self._init_totp()
+
+ # so test-admin isn't automatically logged in for all requests
+ self.app.extra_environ = {'disable_auth_magic': 'True'}
+
+ # regular login
+ r = self.app.get('/auth/?return_to=/p/foo')
+ encoded = self.app.antispam_field_names(r.form)
+ r.form[encoded['username']] = 'test-admin'
+ r.form[encoded['password']] = 'foo'
+ r = r.form.submit()
+
+ # check results
+ assert r.location.endswith('/auth/multifactor?return_to=%2Fp%2Ffoo'), r
+ r = r.follow()
+ assert not r.session.get('username')
+
+ # change login mode
+ r.form['mode'] = 'bogus'
+ r.form['code'] = 'invalid-code'
+ r = r.form.submit()
+ assert not r.session.get('username')
+
@patch('allura.lib.plugin.AuthenticationProvider.hibp_password_check_enabled',
Mock(return_value=True))
def test_login_totp_with_hibp(self):
# this is essentially the same as regular TOTP test, just making sure
that HIBP doesn't get in the way
