public nobgit read

NobMail

Based on mailcow: dockerized

Languages

Repository composition by tracked source files.

PHP

PHP 49% JavaScript 35% HTML 9% CSS 4% Shell 2% Python 1% Lua 0% Perl 0% Ruby 0% SCSS 0%

Create file Wiki Documentation

Clone

https://nobgit.com/orgs/nobgit/nobmail.git

ssh://[email protected]:2222/orgs/nobgit/nobmail.git

Commit

restrict webauthn-tfa-get-args sql query

7d5990bf

FreddleSpl0it <[email protected]> 4 years, 2 months ago

data/web/json_api.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Diff

diff --git a/data/web/json_api.php b/data/web/json_api.php
index 53e47af6..2c8f13fb 100644
--- a/data/web/json_api.php
+++ b/data/web/json_api.php
@@ -452,8 +452,11 @@ if (isset($_GET['query'])) {
           }
         break;
         case "webauthn-tfa-get-args":
-          $stmt = $pdo->prepare("SELECT `keyHandle` FROM `tfa` WHERE username = :username AND authmech = `webauthn`");
-          $stmt->execute(array(':username' => $_SESSION['pending_mailcow_cc_username']));
+          $stmt = $pdo->prepare("SELECT `keyHandle` FROM `tfa` WHERE username = :username AND authmech = :authmech");
+          $stmt->execute(array(
+            ':username' => $_SESSION['pending_mailcow_cc_username'],
+            ':authmech' => 'webauthn'
+          ));
           $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
           if (count($rows) == 0) {
             print(json_encode(array(