Fix couple of security issues

2026-08-29 00:01:21 +00:00 · 2026-06-11 10:26:29 +02:00
parent 3dfbd8442f
commit 832fb5fb59
17 changed files with 875 additions and 289 deletions
@@ -8,6 +8,7 @@ use App\Events\UserLoggedIn;
 use App\Http\Middleware\Google2FAMiddleware;
 use App\Models\User;
 use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Schema;
@@ -65,6 +66,7 @@ class PasskeyAuthenticationTest extends TestCase
            ]);

        $response->assertRedirect('/');
+        $response->assertCookieMissing(Auth::guard()->getRecallerName());
        $this->assertAuthenticatedAs($user);
        $this->assertTrue((bool) session(config('google2fa.session_var')));
        Event::assertDispatched(UserLoggedIn::class);
@@ -88,14 +90,15 @@ class PasskeyAuthenticationTest extends TestCase
        FakeFindPasskeyAction::$passkey = $passkey;
        config()->set('passkeys.actions.find_passkey', FakeFindPasskeyAction::class);

-        $this
+        $response = $this
            ->withSession(['passkey-authentication-options' => '{}'])
            ->post(route('passkeys.login'), [
                'start_authentication_response' => json_encode(['id' => 'credential-3'], JSON_THROW_ON_ERROR),
                'remember' => true,
-            ])
-            ->assertRedirect('/');
+            ]);

+        $response->assertRedirect('/');
+        $response->assertCookie(Auth::guard()->getRecallerName());
        $this->assertAuthenticatedAs($user);
        $this->assertNotNull($user->fresh()?->remember_token);
    }
@@ -0,0 +1,261 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Auth;
+
+use App\Events\UserLoggedIn;
+use App\Models\PasswordSecurity;
+use App\Models\User;
+use App\Services\PasswordBreachService;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Schema;
+use PragmaRX\Google2FALaravel\Facade as Google2FA;
+use Spatie\Permission\Models\Role;
+use Spatie\Permission\PermissionRegistrar;
+use Tests\TestCase;
+
+class RememberMeAuthenticationTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        config([
+            'database.default' => 'sqlite',
+            'database.connections.sqlite.database' => ':memory:',
+            'app.key' => 'base64:'.base64_encode(random_bytes(32)),
+            'session.driver' => 'array',
+            'google2fa.session_var' => 'google2fa',
+        ]);
+
+        DB::purge();
+        DB::reconnect();
+
+        $this->createSchema();
+        $this->seedSettings();
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+        $this->app->instance(PasswordBreachService::class, new class extends PasswordBreachService
+        {
+            public function isPasswordBreached(string $password): bool
+            {
+                return false;
+            }
+        });
+    }
+
+    public function test_password_login_with_remember_me_queues_recaller_cookie(): void
+    {
+        Event::fake([UserLoggedIn::class]);
+        $user = $this->createUser('remember-password@example.test');
+
+        $response = $this->post(route('login'), [
+            'username' => $user->email,
+            'password' => 'password',
+            'rememberme' => 'on',
+        ]);
+
+        $response->assertRedirect('/');
+        $response->assertCookie($this->recallerCookieName());
+        $this->assertAuthenticatedAs($user);
+    }
+
+    public function test_password_login_without_remember_me_does_not_queue_recaller_cookie(): void
+    {
+        Event::fake([UserLoggedIn::class]);
+        $user = $this->createUser('session-password@example.test');
+
+        $response = $this->post(route('login'), [
+            'username' => $user->email,
+            'password' => 'password',
+        ]);
+
+        $response->assertRedirect('/');
+        $response->assertCookieMissing($this->recallerCookieName());
+        $this->assertAuthenticatedAs($user);
+    }
+
+    public function test_two_factor_login_preserves_remember_me_until_otp_success(): void
+    {
+        Event::fake([UserLoggedIn::class]);
+        $user = $this->createUser('remember-2fa@example.test');
+        $secret = Google2FA::generateSecretKey();
+        PasswordSecurity::query()->create([
+            'user_id' => $user->id,
+            'google2fa_enable' => 1,
+            'google2fa_secret' => $secret,
+        ]);
+
+        $loginResponse = $this->post(route('login'), [
+            'username' => $user->email,
+            'password' => 'password',
+            'rememberme' => 'on',
+        ]);
+
+        $loginResponse->assertRedirect(route('2fa.verify'));
+        $loginResponse->assertCookieMissing($this->recallerCookieName());
+        $this->assertGuest();
+        $this->assertTrue((bool) session('2fa:remember'));
+        $this->assertSame($user->id, session('2fa:user:id'));
+
+        $verifyResponse = $this->post(route('2fa.post'), [
+            'one_time_password' => Google2FA::getCurrentOtp($secret),
+        ]);
+
+        $verifyResponse->assertRedirect('/');
+        $verifyResponse->assertCookie($this->recallerCookieName());
+        $this->assertAuthenticatedAs($user);
+        $this->assertTrue((bool) session(config('google2fa.session_var')));
+        $this->assertNull(session('2fa:remember'));
+    }
+
+    public function test_two_factor_login_without_remember_me_does_not_queue_recaller_cookie_after_otp_success(): void
+    {
+        Event::fake([UserLoggedIn::class]);
+        $user = $this->createUser('session-2fa@example.test');
+        $secret = Google2FA::generateSecretKey();
+        PasswordSecurity::query()->create([
+            'user_id' => $user->id,
+            'google2fa_enable' => 1,
+            'google2fa_secret' => $secret,
+        ]);
+
+        $this->post(route('login'), [
+            'username' => $user->email,
+            'password' => 'password',
+        ])->assertRedirect(route('2fa.verify'));
+
+        $verifyResponse = $this->post(route('2fa.post'), [
+            'one_time_password' => Google2FA::getCurrentOtp($secret),
+        ]);
+
+        $verifyResponse->assertRedirect('/');
+        $verifyResponse->assertCookieMissing($this->recallerCookieName());
+        $this->assertAuthenticatedAs($user);
+    }
+
+    private function recallerCookieName(): string
+    {
+        return Auth::guard()->getRecallerName();
+    }
+
+    protected function createSchema(): void
+    {
+        Schema::create('settings', function (Blueprint $table): void {
+            $table->string('name')->primary();
+            $table->text('value')->nullable();
+        });
+
+        Schema::create('roles', function (Blueprint $table): void {
+            $table->increments('id');
+            $table->string('name');
+            $table->string('guard_name');
+            $table->integer('rate_limit')->default(60);
+            $table->boolean('isdefault')->default(false);
+            $table->unsignedInteger('defaultinvites')->default(0);
+            $table->timestamps();
+        });
+
+        Schema::create('permissions', function (Blueprint $table): void {
+            $table->increments('id');
+            $table->string('name');
+            $table->string('guard_name');
+            $table->timestamps();
+        });
+
+        Schema::create('users', function (Blueprint $table): void {
+            $table->increments('id');
+            $table->string('username');
+            $table->string('email')->unique();
+            $table->string('password');
+            $table->unsignedInteger('roles_id')->default(1);
+            $table->integer('rate_limit')->default(60);
+            $table->string('api_token')->nullable();
+            $table->boolean('verified')->default(true);
+            $table->boolean('can_post')->default(true);
+            $table->timestamp('email_verified_at')->nullable();
+            $table->timestamp('lastlogin')->nullable();
+            $table->string('host')->nullable();
+            $table->rememberToken();
+            $table->string('session_token', 60)->nullable();
+            $table->timestamps();
+            $table->softDeletes();
+        });
+
+        Schema::create('password_securities', function (Blueprint $table): void {
+            $table->id();
+            $table->unsignedInteger('user_id');
+            $table->boolean('google2fa_enable')->default(false);
+            $table->string('google2fa_secret')->nullable();
+            $table->timestamps();
+        });
+
+        Schema::create('model_has_roles', function (Blueprint $table): void {
+            $table->unsignedInteger('role_id');
+            $table->string('model_type');
+            $table->unsignedInteger('model_id');
+            $table->primary(['role_id', 'model_id', 'model_type']);
+        });
+
+        Schema::create('model_has_permissions', function (Blueprint $table): void {
+            $table->unsignedInteger('permission_id');
+            $table->string('model_type');
+            $table->unsignedInteger('model_id');
+            $table->primary(['permission_id', 'model_id', 'model_type']);
+        });
+
+        Schema::create('role_has_permissions', function (Blueprint $table): void {
+            $table->unsignedInteger('permission_id');
+            $table->unsignedInteger('role_id');
+            $table->primary(['permission_id', 'role_id']);
+        });
+
+        Schema::create('user_activities', function (Blueprint $table): void {
+            $table->increments('id');
+            $table->unsignedInteger('user_id')->nullable();
+            $table->string('username');
+            $table->string('activity_type', 50);
+            $table->text('description');
+            $table->json('metadata')->nullable();
+            $table->timestamp('created_at')->nullable();
+        });
+    }
+
+    protected function seedSettings(): void
+    {
+        DB::table('settings')->insert([
+            ['name' => 'title', 'value' => 'NNTmux Test'],
+            ['name' => 'home_link', 'value' => '/'],
+            ['name' => 'categorizeforeign', 'value' => '0'],
+            ['name' => 'catwebdl', 'value' => '0'],
+        ]);
+    }
+
+    protected function createUser(string $email): User
+    {
+        $role = Role::query()->firstOrCreate(
+            ['name' => 'User', 'guard_name' => 'web'],
+            ['rate_limit' => 60, 'isdefault' => true, 'defaultinvites' => 1]
+        );
+
+        $user = User::query()->create([
+            'username' => 'user_'.md5($email),
+            'email' => $email,
+            'password' => bcrypt('password'),
+            'roles_id' => $role->id,
+            'rate_limit' => 60,
+            'api_token' => md5($email),
+            'verified' => true,
+            'email_verified_at' => now(),
+            'lastlogin' => now(),
+        ]);
+
+        $user->assignRole($role);
+
+        return $user->fresh();
+    }
+}
+
@@ -4,10 +4,15 @@ declare(strict_types=1);

 namespace Tests\Feature;

+use App\Http\Middleware\TrustedDevice2FAMiddleware;
+use App\Http\Controllers\Api\RSS;
+use App\Models\TrustedDevice;
 use App\Models\User;
 use App\View\Composers\GlobalDataComposer;
 use Illuminate\Contracts\Console\Kernel;
+use Illuminate\Http\Request;
 use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Route;
@@ -269,6 +274,47 @@ class NzbAndRssAccessTest extends TestCase
        $response->assertDontSee('<title>Login', false);
    }

+    public function test_authenticated_rss_feed_returns_output_response_body(): void
+    {
+        DB::table('roles')->insert([
+            'id' => 1,
+            'name' => 'User',
+            'guard_name' => 'web',
+            'apirequests' => 100,
+            'downloadrequests' => 10,
+        ]);
+
+        DB::table('users')->insert([
+            'username' => 'valid-rss-user',
+            'email' => 'valid-rss@example.test',
+            'password' => 'secret',
+            'roles_id' => 1,
+            'api_token' => 'valid-rss-token',
+            'rate_limit' => 60,
+            'verified' => 1,
+            'email_verified_at' => now(),
+        ]);
+
+        $this->app->instance(RSS::class, new class extends RSS
+        {
+            public function __construct() {}
+
+            public function getRss(mixed $cat, mixed $videosId, mixed $aniDbID, int $userID = 0, int $airDate = -1, int $limit = 100, int $offset = 0)
+            {
+                return [];
+            }
+
+            public function output(mixed $data, array $params, bool $xml, int $offset, string $type = '', array $headers = [])
+            {
+                return response('<rss>ok</rss>', 200, array_merge(['Content-type' => 'text/xml'], $headers));
+            }
+        });
+
+        $this->get('/rss/full-feed?api_token=valid-rss-token')
+            ->assertOk()
+            ->assertSee('<rss>ok</rss>', false);
+    }
+
    public function test_contact_form_is_publicly_accessible_to_guests(): void
    {
        $response = $this->get('/contact-us');
@@ -348,6 +394,101 @@ class NzbAndRssAccessTest extends TestCase
            ->assertJsonPath('error', 'Request limit reached');
    }

+    public function test_api_v2_enforces_daily_role_request_quota(): void
+    {
+        DB::table('roles')->insert([
+            'id' => 10,
+            'name' => 'Limited',
+            'guard_name' => 'web',
+            'apirequests' => 1,
+            'downloadrequests' => 10,
+        ]);
+
+        $userId = DB::table('users')->insertGetId([
+            'username' => 'quota-v2-user',
+            'email' => 'quota-v2@example.test',
+            'password' => 'secret',
+            'roles_id' => 10,
+            'api_token' => 'quota-v2-token',
+            'rate_limit' => 60,
+            'verified' => 1,
+            'email_verified_at' => now(),
+        ]);
+
+        DB::table('user_requests')->insert([
+            ['users_id' => $userId, 'request' => '/api/v2/search?api_token=quota-v2-token&id=one', 'timestamp' => now()->subMinutes(10)],
+            ['users_id' => $userId, 'request' => '/api/v2/search?api_token=quota-v2-token&id=two', 'timestamp' => now()->subMinutes(5)],
+        ]);
+
+        $this->getJson('/api/v2/search?api_token=quota-v2-token&id=test')
+            ->assertStatus(429)
+            ->assertHeader('X-NNTmux', 'API ERROR [500] Request limit reached')
+            ->assertJsonPath('error', 'Request limit reached');
+    }
+
+    public function test_forged_trusted_device_cookie_does_not_pass_2fa_without_stored_token(): void
+    {
+        config(['google2fa.session_var' => 'google2fa']);
+
+        $userId = DB::table('users')->insertGetId([
+            'username' => 'forged-2fa-cookie-user',
+            'email' => 'forged-2fa-cookie@example.test',
+            'password' => 'secret',
+            'api_token' => 'forged-2fa-cookie-token',
+            'verified' => 1,
+            'email_verified_at' => now(),
+        ]);
+        $user = User::query()->findOrFail($userId);
+        Auth::login($user);
+
+        $forgedCookie = json_encode([
+            'user_id' => $user->id,
+            'token' => 'client-forged-token-only',
+            'expires_at' => time() + 3600,
+        ], JSON_THROW_ON_ERROR);
+
+        $request = Request::create('/trusted-device-check', 'GET', [], [
+            '2fa_trusted_device' => $forgedCookie,
+        ]);
+        $request->setLaravelSession(app('session.store'));
+
+        (new TrustedDevice2FAMiddleware())->handle($request, fn () => response('ok'));
+
+        $this->assertFalse((bool) $request->session()->get('google2fa', false));
+    }
+
+    public function test_stored_trusted_device_cookie_passes_2fa(): void
+    {
+        config(['google2fa.session_var' => 'google2fa']);
+
+        $userId = DB::table('users')->insertGetId([
+            'username' => 'stored-2fa-cookie-user',
+            'email' => 'stored-2fa-cookie@example.test',
+            'password' => 'secret',
+            'api_token' => 'stored-2fa-cookie-token',
+            'verified' => 1,
+            'email_verified_at' => now(),
+        ]);
+        $user = User::query()->findOrFail($userId);
+        Auth::login($user);
+
+        $trustedDevice = TrustedDevice::issueForUser($user, '127.0.0.1', 'Feature Test');
+        $cookieValue = json_encode([
+            'user_id' => $user->id,
+            'token' => $trustedDevice['plain'],
+            'expires_at' => $trustedDevice['device']->expires_at->getTimestamp(),
+        ], JSON_THROW_ON_ERROR);
+
+        $request = Request::create('/trusted-device-check', 'GET', [], [
+            '2fa_trusted_device' => $cookieValue,
+        ]);
+        $request->setLaravelSession(app('session.store'));
+
+        (new TrustedDevice2FAMiddleware())->handle($request, fn () => response('ok'));
+
+        $this->assertTrue((bool) $request->session()->get('google2fa', false));
+    }
+
    private function setEnvironmentValue(string $key, ?string $value): void
    {
        if ($value === null) {
@@ -390,11 +531,64 @@ class NzbAndRssAccessTest extends TestCase
                $table->string('api_token')->nullable()->index();
                $table->integer('rate_limit')->default(60);
                $table->boolean('verified')->default(true);
+                $table->timestamp('apiaccess')->nullable();
+                $table->string('host')->nullable();
                $table->timestamp('email_verified_at')->nullable();
                $table->timestamps();
                $table->softDeletes();
            });
        }
+
+        if (! Schema::hasTable('roles')) {
+            Schema::create('roles', function (Blueprint $table): void {
+                $table->increments('id');
+                $table->string('name');
+                $table->string('guard_name')->default('web');
+                $table->integer('apirequests')->default(0);
+                $table->integer('downloadrequests')->default(0);
+                $table->timestamps();
+            });
+        }
+
+        if (! Schema::hasTable('model_has_roles')) {
+            Schema::create('model_has_roles', function (Blueprint $table): void {
+                $table->unsignedInteger('role_id');
+                $table->string('model_type');
+                $table->unsignedInteger('model_id');
+
+                $table->primary(['role_id', 'model_id', 'model_type']);
+            });
+        }
+
+        if (! Schema::hasTable('user_requests')) {
+            Schema::create('user_requests', function (Blueprint $table): void {
+                $table->increments('id');
+                $table->unsignedInteger('users_id');
+                $table->text('request')->nullable();
+                $table->timestamp('timestamp')->nullable();
+            });
+        }
+
+        if (! Schema::hasTable('user_downloads')) {
+            Schema::create('user_downloads', function (Blueprint $table): void {
+                $table->increments('id');
+                $table->unsignedInteger('users_id');
+                $table->timestamp('timestamp')->nullable();
+            });
+        }
+
+        if (! Schema::hasTable('trusted_devices')) {
+            Schema::create('trusted_devices', function (Blueprint $table): void {
+                $table->id();
+                $table->unsignedInteger('user_id');
+                $table->string('token_hash', 64)->unique();
+                $table->timestamp('expires_at');
+                $table->timestamp('last_used_at')->nullable();
+                $table->string('ip_address', 45)->nullable();
+                $table->string('user_agent', 500)->nullable();
+                $table->timestamps();
+            });
+        }
    }

    private function registerTestRoutes(): void