sendnrw/pocket-id
2
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-07-17 00:09:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: login code null submission and login code length check (#1512)

Browse Source 
Co-authored-by: james <james@goldfish.net>
Co-authored-by: Kyle Mendell <kmendell@ofkm.us>
This commit is contained in:
James18232
2026-06-21 04:42:50 +10:00
committed by GitHub
parent f673a91a67
commit 2e77d57282
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
backend/internal/controller/user_controller.go
View File

@@ -508,8 +508,15 @@ func (uc *UserController) RequestOneTimeAccessEmailAsAdminHandler(c *gin.Context
// @Success 200 {object} dto.UserDto
// @Router /api/one-time-access-token/{token} [post]
func (uc *UserController) exchangeOneTimeAccessTokenHandler(c *gin.Context) {
loginCode := c.Param("token")
// reject invalid length login codes
if len(loginCode) != 6 && len(loginCode) != 16 {
_ = c.Error(&common.TokenInvalidOrExpiredError{})
return
}
deviceToken, _ := c.Cookie(cookie.DeviceTokenCookieName)
user, token, err := uc.oneTimeAccessService.ExchangeOneTimeAccessToken(c.Request.Context(), c.Param("token"), deviceToken, c.ClientIP(), c.Request.UserAgent())
user, token, err := uc.oneTimeAccessService.ExchangeOneTimeAccessToken(c.Request.Context(), loginCode, deviceToken, c.ClientIP(), c.Request.UserAgent())
if err != nil {
_ = c.Error(err)
return

1
frontend/src/routes/login/alternative/code/+page.svelte
View File

@@ -27,6 +27,7 @@
});
async function authenticate() {
if (!code?.trim()) return;
isLoading = true;
try {
const user = await userService.exchangeOneTimeAccessToken(code);