Drive/roundcubemail-plugins-kolab
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

2FA: Add missing login_lc config handling

Browse source 
Fixes 2FA bypass by using upper-case letter in the username
This commit is contained in:
Aleksander Machniak 2021-06-08 10:37:26 +02:00
parent fddfa1f24a
commit 5a94fd8bc6
1 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
plugins/kolab_2fa/kolab_2fa.php
View file

@ -89,6 +89,19 @@ class kolab_2fa extends rcube_plugin
$a_host = parse_url($args['host']);
$hostname = $_SESSION['hostname'] = $a_host['host'] ?: $args['host'];
// Convert username to lowercase. Copied from rcmail::login()
$login_lc = $rcmail->config->get('login_lc', 2);
if ($login_lc) {
if ($login_lc == 2 || $login_lc === true) {
$args['user'] = mb_strtolower($args['user']);
}
else if (strpos($args['user'], '@')) {
// lowercase domain name
list($local, $domain) = explode('@', $args['user']);
$args['user'] = $local . '@' . mb_strtolower($domain);
}
}
// 1. find user record (and its prefs) before IMAP login
if ($user = rcube_user::query($args['user'], $hostname)) {
$rcmail->config->set_user_prefs($user->get_prefs());