This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit 6754e9c9fca927a74c9a30790ada9a5efcca950f Author: Dave Brondsema <[email protected]> AuthorDate: Tue May 12 16:15:09 2026 -0400 [#8603] check multifactor login mode --- Allura/allura/controllers/auth.py | 2 ++ Allura/allura/tests/functional/test_auth.py | 24 ++++++++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/Allura/allura/controllers/auth.py b/Allura/allura/controllers/auth.py index 7aedac3da..a500df93d 100644 --- a/Allura/allura/controllers/auth.py +++ b/Allura/allura/controllers/auth.py @@ -464,6 +464,8 @@ def do_multifactor(self, code, mode, **kwargs): recovery = RecoveryCodeService.get() recovery.verify_and_remove_code(user, code) h.auditlog_user('Logged in using a multifactor recovery code', user=user) + else: + raise InvalidToken('Invalid multifactor mode') except (InvalidToken, InvalidRecoveryCode): request.validation.errors['code'] = 'Invalid code, please try again.' h.auditlog_user('Multifactor login - invalid code', user=user) diff --git a/Allura/allura/tests/functional/test_auth.py b/Allura/allura/tests/functional/test_auth.py index 3893a4bda..c088c0d79 100644 --- a/Allura/allura/tests/functional/test_auth.py +++ b/Allura/allura/tests/functional/test_auth.py @@ -3320,6 +3320,30 @@ def test_login_recovery_code(self): # confirm code used up assert recovery_code not in RecoveryCodeService().get().get_codes(user) + def test_login_invalid_mode(self): + self._init_totp() + + # so test-admin isn't automatically logged in for all requests + self.app.extra_environ = {'disable_auth_magic': 'True'} + + # regular login + r = self.app.get('/auth/?return_to=/p/foo') + encoded = self.app.antispam_field_names(r.form) + r.form[encoded['username']] = 'test-admin' + r.form[encoded['password']] = 'foo' + r = r.form.submit() + + # check results + assert r.location.endswith('/auth/multifactor?return_to=%2Fp%2Ffoo'), r + r = r.follow() + assert not r.session.get('username') + + # change login mode + r.form['mode'] = 'bogus' + r.form['code'] = 'invalid-code' + r = r.form.submit() + assert not r.session.get('username') + @patch('allura.lib.plugin.AuthenticationProvider.hibp_password_check_enabled', Mock(return_value=True)) def test_login_totp_with_hibp(self): # this is essentially the same as regular TOTP test, just making sure that HIBP doesn't get in the way
