fix some TOTP codes not working when combined with password

meower-media · Aug 8, 2024 · 9fc6096 · 9fc6096
1 parent f1c353f
commit 9fc6096
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/rest_api/auth.py b/rest_api/auth.py
@@ -60,11 +60,12 @@ async def login(data: AuthRequest):
                     password_valid = security.check_password_hash(data.password, account["pswd"])
             elif not data.totp_code:
                 try:
-                    data.totp_code = int(data.password[-6:])
+                    data.totp_code = data.password[-6:]
                     data.password = data.password[:-6]
                 except: pass
                 else:
-                    password_valid = security.check_password_hash(data.password, account["pswd"])
+                    if re.fullmatch(security.TOTP_REGEX, data.totp_code):
+                        password_valid = security.check_password_hash(data.password, account["pswd"])
 
         # Abort if password is invalid
         if not password_valid:

diff --git a/security.py b/security.py
@@ -38,6 +38,7 @@
 
 
 USERNAME_REGEX = "[a-zA-Z0-9-_]{1,20}"
+TOTP_REGEX = "[0-9]{6}"
 BCRYPT_SALT_ROUNDS = 14
 TOKEN_BYTES = 64