diff options
| -rw-r--r-- | routes/users.ts | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/routes/users.ts b/routes/users.ts index d1c2bd96..f088d011 100644 --- a/routes/users.ts +++ b/routes/users.ts @@ -161,13 +161,15 @@ export default { async update(req, res) { const { user, body } = req; try { - const { id: tokid } = jwt.verify(req.headers.authorization.split(" ")[1], config.jwt); + const { id: tokid } = jwt.verify( + req.headers.authorization.split(" ")[1], + config.jwt, + ); l("updating user", user.username, tokid); const { confirm, password, pin, newpin, username } = body; let exists; - let { pubkey } = body; if (pubkey) { exists = await getUser(pubkey); @@ -295,7 +297,10 @@ export default { )) ) { // warn("invalid username or password attempt", username); - await appendFile("failedlogins.txt", `${Date.now()} : ${username} : ${password}\n`); + await appendFile( + "failedlogins.txt", + `${Date.now()} : ${username} : ${password}\n`, + ); return res.code(401).send({}); } @@ -333,10 +338,14 @@ export default { const { event, challenge, twofa } = req.body; const ip = req.headers["cf-connecting-ip"]; const c = await g(`challenge:${challenge}`); - const { pubkey: key } = event; + const { pubkey: key, kind } = event; + if (kind !== 27235) fail("Invalid event"); if (!c) fail("Invalid or expired login challenge"); - if (!verifyEvent(event) || event.content !== challenge) + if ( + !verifyEvent(event) || + event.tags.find((t) => t[0] === "challenge")?.[1] !== challenge + ) fail("Invalid signature or challenge mismatch."); let user = await getUser(key); |