From 708f97aee5b35bcdc22cae3e32d499d52a1de760 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Thu, 6 Aug 2026 18:04:50 +0200 Subject: [PATCH] fix: Handle 2fa enforcement earlier Signed-off-by: Joas Schilling --- lib/private/User/Session.php | 9 ++++----- tests/lib/User/SessionTest.php | 22 ++++++++++++++++++++-- 2 files changed, 24 insertions(+), 7 deletions(-) diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php index c31481fa4b34d..7ee798a141402 100644 --- a/lib/private/User/Session.php +++ b/lib/private/User/Session.php @@ -449,10 +449,8 @@ public function logClientIn($user, return false; } - if (!$isTokenPassword && $this->isTokenAuthEnforced()) { - throw new PasswordLoginForbiddenException(); - } - if (!$isTokenPassword && $this->isTwoFactorEnforced($user)) { + if (!$isTokenPassword && ($this->isTokenAuthEnforced() || $this->isTwoFactorEnforced($user))) { + $this->handleLoginFailed($throttler, $currentDelay, $remoteAddress, $user, $password); throw new PasswordLoginForbiddenException(); } @@ -632,7 +630,8 @@ public function tryBasicAuthLogin(IRequest $request, // If credentials were provided, they need to be valid, otherwise we do boom throw new LoginException(); } catch (PasswordLoginForbiddenException $ex) { - // Nothing to do + // If credentials were provided, they need to be valid, otherwise we do boom + throw new LoginException(previous: $ex); } } return false; diff --git a/tests/lib/User/SessionTest.php b/tests/lib/User/SessionTest.php index 5603525af8462..77ee11f0b68da 100644 --- a/tests/lib/User/SessionTest.php +++ b/tests/lib/User/SessionTest.php @@ -361,7 +361,7 @@ public function testLogClientInNoTokenPasswordWith2fa() { ->method('getRemoteAddress') ->willReturn('192.168.0.1'); $this->throttler - ->expects($this->once()) + ->expects($this->exactly(2)) ->method('sleepDelayOrThrowOnMax') ->with('192.168.0.1'); $this->throttler @@ -370,6 +370,15 @@ public function testLogClientInNoTokenPasswordWith2fa() { ->with('192.168.0.1') ->willReturn(0); + $this->throttler + ->expects($this->once()) + ->method('registerAttempt') + ->with('login', '192.168.0.1', ['user' => 'john']); + $this->dispatcher + ->expects($this->once()) + ->method('dispatchTyped') + ->with(new LoginFailed('john', 'doe')); + $userSession->logClientIn('john', 'doe', $request, $this->throttler); } @@ -473,7 +482,7 @@ public function testLogClientInNoTokenPasswordNo2fa() { ->method('getRemoteAddress') ->willReturn('192.168.0.1'); $this->throttler - ->expects($this->once()) + ->expects($this->exactly(2)) ->method('sleepDelayOrThrowOnMax') ->with('192.168.0.1'); $this->throttler @@ -482,6 +491,15 @@ public function testLogClientInNoTokenPasswordNo2fa() { ->with('192.168.0.1') ->willReturn(0); + $this->throttler + ->expects($this->once()) + ->method('registerAttempt') + ->with('login', '192.168.0.1', ['user' => 'john']); + $this->dispatcher + ->expects($this->once()) + ->method('dispatchTyped') + ->with(new LoginFailed('john', 'doe')); + $userSession->logClientIn('john', 'doe', $request, $this->throttler); }