Merge branch 'release/v0.7.14'

Author: DaneEveritt

CHANGELOG.md

@@ -3,6 +3,21 @@ This file is a running track of new features and fixes to each version of the pa
 
 This project follows [Semantic Versioning](http://semver.org) guidelines.
 
+## v0.7.14 (Derelict Dermodactylus)
+### Fixed
+* **[SECURITY]** Fixes an XSS vulnerability when performing certain actions in the file manager.
+* **[SECURITY]** Attempting to login as a user who has 2FA enabled will no longer request the 2FA token before validating
+that their password is correct. This closes a user existence leak that would expose that an account exists if
+it had 2FA enabled.
+
+### Changed
+* Support for setting a node to listen on ports lower than 1024.
+* QR code URLs are now generated without the use of an external library to reduce the dependency tree.
+* Regenerated database passwords now respect the same settings that were used when initially created.
+* Cleaned up 2FA QR code generation to use a more up-to-date library and API.
+* Console charts now properly start at 0 and scale based on server configuration. No more crazy spikes that
+are due to a change of one unit.
+
 ## v0.7.13 (Derelict Dermodactylus)
 ### Fixed
 * Fixes a bug with the location update API endpoint throwing an error due to an unexected response value.

README.md

@@ -1,4 +1,4 @@
-[![Logo Image](https://cdn.pterodactyl.io/logos/Banner%20Logo%20Black@2x.png)](https://pterodactyl.io)
+[![Logo Image](https://cdn.pterodactyl.io/logos/new/pterodactyl_logo.png)](https://pterodactyl.io)
 
 [![Build status](https://img.shields.io/travis/pterodactyl/panel/develop.svg?style=flat-square)](https://travis-ci.org/pterodactyl/panel)
 [![StyleCI](https://styleci.io/repos/47508644/shield?branch=develop)](https://styleci.io/repos/47508644)

app/Http/Controllers/Admin/ServersController.php

@@ -599,7 +599,7 @@ public function resetDatabasePassword(Request $request, $server)
             ['id', '=', $request->input('database')],
         ]);
 
-        $this->databasePasswordService->handle($database, str_random(20));
+        $this->databasePasswordService->handle($database, str_random(24));
 
         return response('', 204);
     }

app/Http/Controllers/Auth/LoginController.php

@@ -126,21 +126,20 @@ public function login(Request $request)
             return $this->sendFailedLoginResponse($request);
         }
 
-        $validCredentials = password_verify($request->input('password'), $user->password);
+        if (! password_verify($request->input('password'), $user->password)) {
+            return $this->sendFailedLoginResponse($request, $user);
+        }
+
         if ($user->use_totp) {
             $token = str_random(64);
-            $this->cache->put($token, ['user_id' => $user->id, 'valid_credentials' => $validCredentials], 5);
+            $this->cache->put($token, ['user_id' => $user->id, 'valid_credentials' => true], 5);
 
             return redirect()->route('auth.totp')->with('authentication_token', $token);
         }
 
-        if ($validCredentials) {
-            $this->auth->guard()->login($user, true);
-
-            return $this->sendLoginResponse($request);
-        }
+        $this->auth->guard()->login($user, true);
 
-        return $this->sendFailedLoginResponse($request, $user);
+        return $this->sendLoginResponse($request);
     }
 
     /**
@@ -161,12 +160,13 @@ public function totp(Request $request)
 
     /**
      * Handle a login where the user is required to provide a TOTP authentication
-     * token. In order to add additional layers of security, users are not
-     * informed of an incorrect password until this stage, forcing them to
-     * provide a token on each login attempt.
+     * token.
      *
      * @param \Illuminate\Http\Request $request
      * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\Response
+     * @throws \PragmaRX\Google2FA\Exceptions\IncompatibleWithGoogleAuthenticatorException
+     * @throws \PragmaRX\Google2FA\Exceptions\InvalidCharactersException
+     * @throws \PragmaRX\Google2FA\Exceptions\SecretKeyTooShortException
      */
     public function loginUsingTotp(Request $request)
     {
@@ -181,7 +181,7 @@ public function loginUsingTotp(Request $request)
             return $this->sendFailedLoginResponse($request);
         }
 
-        if (is_null($request->input('2fa_token')) || ! array_get($cache, 'valid_credentials')) {
+        if (is_null($request->input('2fa_token'))) {
             return $this->sendFailedLoginResponse($request, $user);
         }
 

app/Http/Controllers/Base/SecurityController.php

@@ -90,8 +90,10 @@ public function index(Request $request)
      */
     public function generateTotp(Request $request)
     {
+        $totpData = $this->twoFactorSetupService->handle($request->user());
+
         return response()->json([
-            'qrImage' => $this->twoFactorSetupService->handle($request->user()),
+            'qrImage' => 'https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=' . $totpData,
         ]);
     }
 

app/Http/Controllers/Server/DatabaseController.php

@@ -142,7 +142,7 @@ public function update(Request $request): JsonResponse
     {
         $this->authorize('reset-db-password', $request->attributes->get('server'));
 
-        $password = str_random(20);
+        $password = str_random(24);
         $this->passwordService->handle($request->attributes->get('database'), $password);
 
         return response()->json(['password' => $password]);

app/Models/Node.php

@@ -110,8 +110,8 @@ class Node extends Model implements CleansAttributes, ValidableContract
         'disk' => 'numeric|min:1',
         'disk_overallocate' => 'numeric|min:-1',
         'daemonBase' => 'regex:/^([\/][\d\w.\-\/]+)$/',
-        'daemonSFTP' => 'numeric|between:1024,65535',
-        'daemonListen' => 'numeric|between:1024,65535',
+        'daemonSFTP' => 'numeric|between:1,65535',
+        'daemonListen' => 'numeric|between:1,65535',
         'maintenance_mode' => 'boolean',
         'upload_size' => 'int|between:1,1024',
     ];

app/Services/Databases/DatabaseManagementService.php

@@ -69,7 +69,7 @@ public function create($server, array $data)
         $data['server_id'] = $server;
         $data['database'] = sprintf('s%d_%s', $server, $data['database']);
         $data['username'] = sprintf('u%d_%s', $server, str_random(10));
-        $data['password'] = $this->encrypter->encrypt(str_random(16));
+        $data['password'] = $this->encrypter->encrypt(str_random(24));
 
         $this->database->beginTransaction();
         try {

app/Services/Users/TwoFactorSetupService.php

@@ -1,22 +1,18 @@
 <?php
-/**
- * Pterodactyl - Panel
- * Copyright (c) 2015 - 2017 Dane Everitt <dane@daneeveritt.com>.
- *
- * This software is licensed under the terms of the MIT license.
- * https://opensource.org/licenses/MIT
- */
 
 namespace Pterodactyl\Services\Users;
 
+use Exception;
+use RuntimeException;
 use Pterodactyl\Models\User;
-use PragmaRX\Google2FA\Google2FA;
 use Illuminate\Contracts\Encryption\Encrypter;
 use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
 use Illuminate\Contracts\Config\Repository as ConfigRepository;
 
 class TwoFactorSetupService
 {
+    const VALID_BASE32_CHARACTERS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+
     /**
      * @var \Illuminate\Contracts\Config\Repository
      */
@@ -27,11 +23,6 @@ class TwoFactorSetupService
      */
     private $encrypter;
 
-    /**
-     * @var \PragmaRX\Google2FA\Google2FA
-     */
-    private $google2FA;
-
     /**
      * @var \Pterodactyl\Contracts\Repository\UserRepositoryInterface
      */
@@ -42,24 +33,22 @@ class TwoFactorSetupService
      *
      * @param \Illuminate\Contracts\Config\Repository                   $config
      * @param \Illuminate\Contracts\Encryption\Encrypter                $encrypter
-     * @param \PragmaRX\Google2FA\Google2FA                             $google2FA
      * @param \Pterodactyl\Contracts\Repository\UserRepositoryInterface $repository
      */
     public function __construct(
         ConfigRepository $config,
         Encrypter $encrypter,
-        Google2FA $google2FA,
         UserRepositoryInterface $repository
     ) {
         $this->config = $config;
         $this->encrypter = $encrypter;
-        $this->google2FA = $google2FA;
         $this->repository = $repository;
     }
 
     /**
      * Generate a 2FA token and store it in the database before returning the
-     * QR code image.
+     * QR code URL. This URL will need to be attached to a QR generating service in
+     * order to function.
      *
      * @param \Pterodactyl\Models\User $user
      * @return string
@@ -69,13 +58,26 @@ public function __construct(
      */
     public function handle(User $user): string
     {
-        $secret = $this->google2FA->generateSecretKey($this->config->get('pterodactyl.auth.2fa.bytes'));
-        $image = $this->google2FA->getQRCodeGoogleUrl($this->config->get('app.name'), $user->email, $secret);
+        $secret = '';
+        try {
+            for ($i = 0; $i < $this->config->get('pterodactyl.auth.2fa.bytes', 16); $i++) {
+                $secret .= substr(self::VALID_BASE32_CHARACTERS, random_int(0, 31), 1);
+            }
+        } catch (Exception $exception) {
+            throw new RuntimeException($exception->getMessage(), 0, $exception);
+        }
 
         $this->repository->withoutFreshModel()->update($user->id, [
             'totp_secret' => $this->encrypter->encrypt($secret),
         ]);
 
-        return $image;
+        $company = $this->config->get('app.name');
+
+        return sprintf(
+            'otpauth://totp/%1$s:%2$s?secret=%3$s&issuer=%1$s',
+            rawurlencode($company),
+            rawurlencode($user->email),
+            rawurlencode($secret)
+        );
     }
 }

composer.json

@@ -29,7 +29,7 @@
         "lord/laroute": "^2.4",
         "matriphe/iso-639": "^1.2",
         "nesbot/carbon": "^1.22",
-        "pragmarx/google2fa": "^2.0",
+        "pragmarx/google2fa": "^5.0",
         "predis/predis": "^1.1",
         "prologue/alerts": "^0.4",
         "ramsey/uuid": "^3.7",