gsadmin/BetterDesk
1
0
Fork 0
mirror of https://github.com/UNITRONIX/BetterDesk.git synced 2026-09-10 01:27:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Serialize TOTP recovery codes before saving

Browse Source 
Convert recovery code arrays to JSON strings before storing in the database to ensure consistent storage across adapters. Updates enableTotp and useRecoveryCode in both SQLite and Postgres adapters (web-nodejs/services/dbAdapter.js) to stringify arrays while leaving existing strings untouched.
This commit is contained in:
UNITRONIX
2026-03-14 12:20:18 +01:00
parent 556fad94bf
commit 6785063faa
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web-nodejs/services/dbAdapter.js
+6 -4
View File
@@ -1027,13 +1027,15 @@ function createSqliteAdapter(config) {
openAuth().prepare('UPDATE users SET totp_secret = ? WHERE id = ?').run(secret, userId);
},
async enableTotp(userId, recoveryCodes) {
openAuth().prepare('UPDATE users SET totp_enabled = 1, totp_recovery_codes = ? WHERE id = ?').run(recoveryCodes, userId);
const codesJson = Array.isArray(recoveryCodes) ? JSON.stringify(recoveryCodes) : recoveryCodes;
openAuth().prepare('UPDATE users SET totp_enabled = 1, totp_recovery_codes = ? WHERE id = ?').run(codesJson, userId);
},
async disableTotp(userId) {
openAuth().prepare('UPDATE users SET totp_enabled = 0, totp_secret = NULL, totp_recovery_codes = NULL WHERE id = ?').run(userId);
},
async useRecoveryCode(userId, updatedCodes) {
openAuth().prepare('UPDATE users SET totp_recovery_codes = ? WHERE id = ?').run(updatedCodes, userId);
const codesJson = Array.isArray(updatedCodes) ? JSON.stringify(updatedCodes) : updatedCodes;
openAuth().prepare('UPDATE users SET totp_recovery_codes = ? WHERE id = ?').run(codesJson, userId);
},
// ---- Access tokens ----
@@ -3257,9 +3259,9 @@ function createPostgresAdapter() {
// ---- TOTP ----
async saveTotpSecret(userId, secret) { await q('UPDATE users SET totp_secret = $1 WHERE id = $2', [secret, userId]); },
async enableTotp(userId, recoveryCodes) { await q('UPDATE users SET totp_enabled = TRUE, totp_recovery_codes = $1 WHERE id = $2', [recoveryCodes, userId]); },
async enableTotp(userId, recoveryCodes) { const codesJson = Array.isArray(recoveryCodes) ? JSON.stringify(recoveryCodes) : recoveryCodes; await q('UPDATE users SET totp_enabled = TRUE, totp_recovery_codes = $1 WHERE id = $2', [codesJson, userId]); },
async disableTotp(userId) { await q('UPDATE users SET totp_enabled = FALSE, totp_secret = NULL, totp_recovery_codes = NULL WHERE id = $1', [userId]); },
async useRecoveryCode(userId, updatedCodes) { await q('UPDATE users SET totp_recovery_codes = $1 WHERE id = $2', [updatedCodes, userId]); },
async useRecoveryCode(userId, updatedCodes) { const codesJson = Array.isArray(updatedCodes) ? JSON.stringify(updatedCodes) : updatedCodes; await q('UPDATE users SET totp_recovery_codes = $1 WHERE id = $2', [codesJson, userId]); },
// ---- Access tokens ----