dkforest

commit ff3f9656d2371aefe04cf58640c0d44bed17ea6c
parent 20fc5525c39f1c7a86d22f6affcadc04e821bfea
Author: n0tr1v <n0tr1v@protonmail.com>
Date:   Tue,  6 Jun 2023 20:05:34 -0700

remove captcha for gpg 2fa. instead limit attempts possible on it to 3

Diffstat:
M
pkg/web/handlers/data.go
 | 
5
-----
M
pkg/web/handlers/handlers.go
 | 
19
++++---------------
M
pkg/web/public/views/pages/sessions-gpg-two-factor.gohtml
 | 
12
+-----------

3 files changed, 5 insertions(+), 31 deletions(-)
diff --git a/pkg/web/handlers/data.go b/pkg/web/handlers/data.go
@@ -45,14 +45,9 @@ type sessionsTwoFactorData struct {
 }
 
 type sessionsGpgTwoFactorData struct {
-	Autofocus        int64
 	Token            string
 	EncryptedMessage string
 	Code             string
-	CaptchaRequired  bool
-	ErrCaptcha       string
-	CaptchaID        string
-	CaptchaImg       string
 	Error            string
 	ErrorCode        string
 }
diff --git a/pkg/web/handlers/handlers.go b/pkg/web/handlers/handlers.go
@@ -450,7 +450,6 @@ func SessionsGpgTwoFactorHandler(c echo.Context, step1 bool, token string) error
 	}
 
 	var data sessionsGpgTwoFactorData
-	data.Autofocus = 1
 	data.Token = token
 
 	if step1 {
@@ -471,20 +470,10 @@ func SessionsGpgTwoFactorHandler(c echo.Context, step1 bool, token string) error
 	data.Code = c.Request().PostFormValue("pgp_code")
 	if data.Code != pgpToken.Value {
 		item.Attempt++
-		if item.Attempt > 4 {
-			data.CaptchaRequired = true
-			data.Autofocus = 2
-			data.CaptchaID, data.CaptchaImg = captcha.New()
-			captchaID := c.Request().PostFormValue("captcha_id")
-			captchaInput := c.Request().PostFormValue("captcha")
-			if captchaInput == "" {
-				return c.Render(http.StatusOK, "sessions-gpg-two-factor", data)
-			} else {
-				if err := hutils.CaptchaVerifyString(c, captchaID, captchaInput); err != nil {
-					data.ErrCaptcha = "Invalid captcha"
-					return c.Render(http.StatusOK, "sessions-gpg-two-factor", data)
-				}
-			}
+		if item.Attempt >= 4 {
+			pgpTokenCache.Delete(user.ID)
+			partialAuthCache.Delete(token)
+			return c.Redirect(http.StatusFound, "/")
 		}
 		data.ErrorCode = "invalid code"
 		return c.Render(http.StatusOK, "sessions-gpg-two-factor", data)
diff --git a/pkg/web/public/views/pages/sessions-gpg-two-factor.gohtml b/pkg/web/public/views/pages/sessions-gpg-two-factor.gohtml
@@ -21,21 +21,11 @@
                         </div>
                         <div class="form-group">
                             <label for="pgp_code">{{ t "Your decrypted code" . }}</label>
-                            <input name="pgp_code" id="pgp_code" value="{{ .Data.Code }}" type="text" class="form-control{{ if .Data.ErrorCode }} is-invalid{{ end }}" autocomplete="off" autocorrect="off" autocapitalize="none"{{ if eq .Data.Autofocus 1 }} autofocus{{ end }} />
+                            <input name="pgp_code" id="pgp_code" value="{{ .Data.Code }}" type="text" class="form-control{{ if .Data.ErrorCode }} is-invalid{{ end }}" autocomplete="off" autocorrect="off" autocapitalize="none" autofocus />
                             {{ if .Data.ErrorCode }}
                                 <div class="invalid-feedback">{{ .Data.ErrorCode }}</div>
                             {{ end }}
                         </div>
-                        {{ if .Data.CaptchaRequired }}
-                            <input type="hidden" name="captcha_id" value="{{ .Data.CaptchaID }}" />
-                            <div class="form-group">
-                                <div class="mb-2 text-center">
-                                    <img src="data:image/png;base64,{{ .Data.CaptchaImg }}" alt="captcha" style="background-color: hsl(0, 0%, 90%);" class="captcha-img" />
-                                </div>
-                                <input class="form-control{{ if .Data.ErrCaptcha }} is-invalid{{ end }}" placeholder="{{ t "Captcha" . }}" name="captcha" type="text" maxlength="6" required{{ if eq .Data.Autofocus 2 }} autofocus{{ end }} autocomplete="off" />
-                                {{ if .Data.ErrCaptcha }}<div class="invalid-feedback d-block">{{ .Data.ErrCaptcha }}</div>{{ end }}
-                            </div>
-                        {{ end }}
                         <div class="form-group">
                             <input type="submit" value="{{ t "Continue login" . }}" class="btn btn-primary" />
                             <a href="/settings/pgp" class="btn btn-secondary">{{ t "Cancel" . }}</a>