Infra-Mirrors/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2024-10-01 05:36:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Verified mfa session expires on logout

Browse Source 
Since sessions are invalidated upon logout.
This commit is contained in:
Dan Brown 2021-08-07 21:53:13 +01:00
parent 39a205ed28
commit ef9354a0cb
No known key found for this signature in database
GPG Key ID: 46D9F943C24A2EF9
2 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
app/Auth/Access/LoginService.php
View File

@ -38,14 +38,6 @@ class LoginService
$this->setLastLoginAttemptedForUser($user, $method);
throw new StoppedAuthenticationException($user, $this);
// TODO - Does 'remember' still work? Probably not right now.
// TODO - Need to clear MFA sessions out upon logout
// Old MFA middleware todos:
// TODO - Handle email confirmation handling
// Left BookStack\Http\Middleware\Authenticate@emailConfirmationErrorResponse in which needs
// be removed as an example of old behaviour.
}
$this->clearLastLoginAttempted();

13
tests/Auth/AuthTest.php
View File

@ -2,6 +2,7 @@
namespace Tests\Auth;
use BookStack\Auth\Access\Mfa\MfaSession;
use BookStack\Auth\Role;
use BookStack\Auth\User;
use BookStack\Entities\Models\Page;
@ -326,6 +327,18 @@ class AuthTest extends BrowserKitTest
->seePageIs('/login');
}
public function test_mfa_session_cleared_on_logout()
{
$user = $this->getEditor();
$mfaSession = $this->app->make(MfaSession::class);
$mfaSession->markVerifiedForUser($user);;
$this->assertTrue($mfaSession->isVerifiedForUser($user));
$this->asAdmin()->visit('/logout');
$this->assertFalse($mfaSession->isVerifiedForUser($user));
}
public function test_reset_password_flow()
{
Notification::fake();