diff options
| author | Robert Speicher <robert@gitlab.com> | 2018-03-01 19:22:56 +0000 |
|---|---|---|
| committer | Robert Speicher <robert@gitlab.com> | 2018-03-01 19:22:56 +0000 |
| commit | 070cb7eecd99a1a855a1d0d6e3bed8f8c6caa7d8 (patch) | |
| tree | ca08abef5460f805a3953d7907a844bcbbb4d935 | |
| parent | 586669a02ee7a18635d8e590117ac9e2bd9b62f4 (diff) | |
| parent | c95d5315c12ade3ab285a4dafc0583c8e2068d14 (diff) | |
| download | gitlab-ce-070cb7eecd99a1a855a1d0d6e3bed8f8c6caa7d8.tar.gz | |
Merge branch '10-3-stable-patch-8' into '10-3-stable'
Prepare 10.3.8
See merge request gitlab/gitlabhq!2340
| -rw-r--r-- | GITLAB_PAGES_VERSION | 2 | ||||
| -rw-r--r-- | app/controllers/concerns/authenticates_with_two_factor.rb | 1 | ||||
| -rw-r--r-- | changelogs/unreleased/sh-fix-otp-backup-code-invalidation.yml | 5 | ||||
| -rw-r--r-- | spec/features/login_spec.rb | 12 |
4 files changed, 19 insertions, 1 deletions
diff --git a/GITLAB_PAGES_VERSION b/GITLAB_PAGES_VERSION index a918a2aa18d..ee6cdce3c29 100644 --- a/GITLAB_PAGES_VERSION +++ b/GITLAB_PAGES_VERSION @@ -1 +1 @@ -0.6.0 +0.6.1 diff --git a/app/controllers/concerns/authenticates_with_two_factor.rb b/app/controllers/concerns/authenticates_with_two_factor.rb index db8c362f125..2753f83c3cf 100644 --- a/app/controllers/concerns/authenticates_with_two_factor.rb +++ b/app/controllers/concerns/authenticates_with_two_factor.rb @@ -56,6 +56,7 @@ module AuthenticatesWithTwoFactor session.delete(:otp_user_id) remember_me(user) if user_params[:remember_me] == '1' + user.save! sign_in(user) else user.increment_failed_attempts! diff --git a/changelogs/unreleased/sh-fix-otp-backup-code-invalidation.yml b/changelogs/unreleased/sh-fix-otp-backup-code-invalidation.yml new file mode 100644 index 00000000000..cedb09c9a7a --- /dev/null +++ b/changelogs/unreleased/sh-fix-otp-backup-code-invalidation.yml @@ -0,0 +1,5 @@ +--- +title: Ensure that OTP backup codes are always invalidated +merge_request: +author: +type: security diff --git a/spec/features/login_spec.rb b/spec/features/login_spec.rb index 6dfabcc7225..1a4b26b2822 100644 --- a/spec/features/login_spec.rb +++ b/spec/features/login_spec.rb @@ -125,6 +125,18 @@ feature 'Login' do expect { enter_code(codes.sample) } .to change { user.reload.otp_backup_codes.size }.by(-1) end + + it 'invalidates backup codes twice in a row' do + random_code = codes.delete(codes.sample) + expect { enter_code(random_code) } + .to change { user.reload.otp_backup_codes.size }.by(-1) + + gitlab_sign_out + gitlab_sign_in(user) + + expect { enter_code(codes.sample) } + .to change { user.reload.otp_backup_codes.size }.by(-1) + end end context 'with invalid code' do |