Revert "Add missing admin action files and navigation links"
This reverts commit 41be6835bf.
This commit is contained in:
1 parent
4a1e1115b3
commit
4d515bc400
338 files changed
+5949
-28144
No files matched your search
+7
-11
@@ -23,18 +23,12 @@ async function verify2faCode(userId: number, code: string): Promise<boolean> {
|
||||
if (!appKey) throw new Error("APP_KEY not configured");
|
||||
const secret = new LaravelEncrypter(appKey).decrypt(user.twoFactorSecret);
|
||||
if (verifyTotp(code, secret)) return true;
|
||||
} catch {
|
||||
/* fall through to recovery */
|
||||
}
|
||||
} catch { /* fall through to recovery */ }
|
||||
|
||||
// Try recovery codes
|
||||
if (user.twoFactorRecoveryCodes) {
|
||||
let codes: string[];
|
||||
try {
|
||||
codes = JSON.parse(user.twoFactorRecoveryCodes) as string[];
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
try { codes = JSON.parse(user.twoFactorRecoveryCodes) as string[]; } catch { return false; }
|
||||
const idx = codes.indexOf(code);
|
||||
if (idx !== -1) {
|
||||
codes.splice(idx, 1);
|
||||
@@ -73,9 +67,11 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
|
||||
const user = await prisma.user.findUnique({ where: { username } });
|
||||
if (!user) {
|
||||
// Prevent timing-based enumeration: always run a dummy hash check.
|
||||
await checkLogin(password, "$2y$12$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcd", {
|
||||
convertPasswords: false,
|
||||
});
|
||||
await checkLogin(
|
||||
password,
|
||||
"$2y$12$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcd",
|
||||
{ convertPasswords: false },
|
||||
);
|
||||
return null;
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user