diff --git a/composer.json b/composer.json index 89f348e7..7858f78c 100644 --- a/composer.json +++ b/composer.json @@ -39,6 +39,9 @@ "silverstripe/reports": "^3.7", "squizlabs/php_codesniffer": "^3.0" }, + "conflict": { + "silverstripe/subsites": "<1.4.2" + }, "suggest": { "silverstripe/totp-authenticator": "Adds a method to authenticate with you phone using a time-based one-time password.", "silverstripe/webauthn-authenticator": "Adds a method to authenticate with security keys or built-in platform authenticators." diff --git a/src/Authenticator/LoginForm.php b/src/Authenticator/LoginForm.php index 32394322..550a1b79 100644 --- a/src/Authenticator/LoginForm.php +++ b/src/Authenticator/LoginForm.php @@ -1,4 +1,6 @@ -getMember() : null; $loggedInMember = Member::currentUser(); - if (($loggedInMember === null && $sessionMember === null) + if ( + ($loggedInMember === null + && $sessionMember === null) || !$this->getSudoModeService()->check($this->controller->getSession()) ) { return $this->jsonResponse( @@ -242,7 +246,9 @@ public function finishRegistration(): HTTPResponse $sessionMember = $store ? $store->getMember() : null; $loggedInMember = Member::currentUser(); - if (($loggedInMember === null && $sessionMember === null) + if ( + ($loggedInMember === null + && $sessionMember === null) || !$this->getSudoModeService()->check($this->controller->getSession() ?: new Session([])) ) { return $this->jsonResponse( @@ -275,7 +281,9 @@ public function finishRegistration(): HTTPResponse // required to log in though. The "mustLogin" flag is set at the beginning of the MFA process if they have at // least one method registered. They should always do that first. In that case we should assert // "isLoginComplete" - if ((!$mustLogin || $this->isVerificationComplete($store)) + if ( + (!$mustLogin + || $this->isVerificationComplete($store)) && $enforcementManager->hasCompletedRegistration($sessionMember) ) { $this->doPerformLogin($sessionMember); @@ -323,8 +331,11 @@ public function startVerification(): HTTPResponse $request = $this->getRequest(); $store = $this->getStore(); // If we don't have a valid member we shouldn't be here, or if sudo mode is not active yet. - if (!$store || !$store->getMember() || - !$this->getSudoModeService()->check($this->controller->getSession() ?: new Session([]))) { + if ( + !$store + || !$store->getMember() + || !$this->getSudoModeService()->check($this->controller->getSession() ?: new Session([])) + ) { return $this->jsonResponse(['message' => 'Forbidden'], 403); } @@ -428,7 +439,8 @@ public function redirectAfterSuccessfulLogin() // This is potentially redundant logic as the member should only be logged in if they've fully registered. // They're allowed to login if they can skip - so only do assertions if they're not allowed to skip // We'll also check that they've registered the required MFA details - if (!$enforcementManager->canSkipMFA($member) + if ( + !$enforcementManager->canSkipMFA($member) && !$enforcementManager->hasCompletedRegistration($member) ) { $member->logOut(); diff --git a/src/Authenticator/MemberAuthenticator.php b/src/Authenticator/MemberAuthenticator.php index 74f53069..75bbd582 100644 --- a/src/Authenticator/MemberAuthenticator.php +++ b/src/Authenticator/MemberAuthenticator.php @@ -1,4 +1,5 @@ getRequest(); // Ensure CSRF and sudo-mode protection - if (!SecurityToken::inst()->checkRequest($request) + if ( + !SecurityToken::inst()->checkRequest($request) || !$this->getSudoModeService()->check($this->getSession()) ) { return $this->jsonResponse( diff --git a/src/Exception/InvalidMethodException.php b/src/Exception/InvalidMethodException.php index d9cf4051..e4645956 100644 --- a/src/Exception/InvalidMethodException.php +++ b/src/Exception/InvalidMethodException.php @@ -1,4 +1,5 @@ randomToken(); $hash = $this->owner->encryptWithUserSettings($token); - } while (DataObject::get_one(Member::class, [ + } while ( + DataObject::get_one(Member::class, [ '"Member"."AccountResetHash"' => $hash, - ])); + ]) + ); $expiry = DBDatetime::create(); $expiry->setValue( diff --git a/src/Extension/AccountReset/SecurityAdminExtension.php b/src/Extension/AccountReset/SecurityAdminExtension.php index 1edad960..0aeb8e9f 100644 --- a/src/Extension/AccountReset/SecurityAdminExtension.php +++ b/src/Extension/AccountReset/SecurityAdminExtension.php @@ -1,4 +1,6 @@ -RegisteredMFAMethods()->exists() && !$session->get(self::MFA_VERIFIED_ON_CHANGE_PASSWORD) diff --git a/src/Extension/MemberExtension.php b/src/Extension/MemberExtension.php index 95cf365d..9e678348 100644 --- a/src/Extension/MemberExtension.php +++ b/src/Extension/MemberExtension.php @@ -1,4 +1,6 @@ -MainMenu(); foreach ($menu as $candidate) { - if ($candidate->Link + if ( + $candidate->Link && $candidate->Link !== $leftAndMain->Link() && $candidate->MenuItem->controller && singleton($candidate->MenuItem->controller)->canView($member) diff --git a/src/Service/MethodRegistry.php b/src/Service/MethodRegistry.php index 7dcbd892..88c6cb06 100644 --- a/src/Service/MethodRegistry.php +++ b/src/Service/MethodRegistry.php @@ -1,4 +1,6 @@ -