From c35c4b5abc8c3e0ae727f1f692cbb8198666191b Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Thu, 6 Aug 2026 18:04:50 +0200 Subject: [PATCH] fix: Handle 2fa enforcement earlier Signed-off-by: Joas Schilling --- lib/private/User/Session.php | 9 ++++----- tests/lib/User/SessionTest.php | 22 ++++++++++++++++++++-- 2 files changed, 24 insertions(+), 7 deletions(-) diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php index b14e090cdacba..0ac7b7d500104 100644 --- a/lib/private/User/Session.php +++ b/lib/private/User/Session.php @@ -429,10 +429,8 @@ public function logClientIn($user, return false; } - if (!$isTokenPassword && $this->isTokenAuthEnforced()) { - throw new PasswordLoginForbiddenException(); - } - if (!$isTokenPassword && $this->isTwoFactorEnforced($user)) { + if (!$isTokenPassword && ($this->isTokenAuthEnforced() || $this->isTwoFactorEnforced($user))) { + $this->handleLoginFailed($throttler, $currentDelay, $remoteAddress, $user, $password); throw new PasswordLoginForbiddenException(); } @@ -612,7 +610,8 @@ public function tryBasicAuthLogin(IRequest $request, // If credentials were provided, they need to be valid, otherwise we do boom throw new LoginException(); } catch (PasswordLoginForbiddenException $ex) { - // Nothing to do + // If credentials were provided, they need to be valid, otherwise we do boom + throw new LoginException(previous: $ex); } } return false; diff --git a/tests/lib/User/SessionTest.php b/tests/lib/User/SessionTest.php index b3c2876b59e29..50f471cfc6817 100644 --- a/tests/lib/User/SessionTest.php +++ b/tests/lib/User/SessionTest.php @@ -442,7 +442,7 @@ public function testLogClientInNoTokenPasswordWith2fa() { ->method('getRemoteAddress') ->willReturn('192.168.0.1'); $this->throttler - ->expects($this->once()) + ->expects($this->exactly(2)) ->method('sleepDelayOrThrowOnMax') ->with('192.168.0.1'); $this->throttler @@ -451,6 +451,15 @@ public function testLogClientInNoTokenPasswordWith2fa() { ->with('192.168.0.1') ->willReturn(0); + $this->throttler + ->expects($this->once()) + ->method('registerAttempt') + ->with('login', '192.168.0.1', ['user' => 'john']); + $this->dispatcher + ->expects($this->once()) + ->method('dispatchTyped') + ->with(new LoginFailed('john', 'doe')); + $userSession->logClientIn('john', 'doe', $request, $this->throttler); } @@ -554,7 +563,7 @@ public function testLogClientInNoTokenPasswordNo2fa() { ->method('getRemoteAddress') ->willReturn('192.168.0.1'); $this->throttler - ->expects($this->once()) + ->expects($this->exactly(2)) ->method('sleepDelayOrThrowOnMax') ->with('192.168.0.1'); $this->throttler @@ -563,6 +572,15 @@ public function testLogClientInNoTokenPasswordNo2fa() { ->with('192.168.0.1') ->willReturn(0); + $this->throttler + ->expects($this->once()) + ->method('registerAttempt') + ->with('login', '192.168.0.1', ['user' => 'john']); + $this->dispatcher + ->expects($this->once()) + ->method('dispatchTyped') + ->with(new LoginFailed('john', 'doe')); + $userSession->logClientIn('john', 'doe', $request, $this->throttler); }