Change the old syntax of $this->request->session() to `$this->reque…

.semver

@@ -1,5 +1,5 @@
 ---
 :major: 7
 :minor: 0
-:patch: 0
+:patch: 2
 :special: ''

CHANGELOG.md

@@ -4,6 +4,14 @@ Changelog
 Releases for CakePHP 3
 -------------
 
+* 7.0.1 
+  * Fixed an issue with 2FA only working on the second try
+
+* 7.0.1 
+  * Fixed a security issue in 2 factor authentication, reported by @ndm2
+  * Updated to cakedc/auth ^3.0
+  * Documentation fixes
+
 * 7.0.0
   * Removed deprecations for CakePHP 3.6
   * Added a new `UsersAuthComponent::EVENT_AFTER_CHANGE_PASSWORD`

Docs/Documentation/Configuration.md

@@ -120,7 +120,7 @@ NOTE: SOME keys were hidden in this doc page, please refer to `vendor/cakedc/use
             'all' => [
                 'finder' => 'active',
             ],
-            'CakeDC/Users.RememberMe',
+            'CakeDC/Auth.RememberMe',
             'Form',
         ],
         'authorize' => [
@@ -140,10 +140,10 @@ Using the UsersAuthComponent default initialization, the component will load the
   * 'Form'
   * 'CakeDC/Users.Social' check [SocialAuthenticate](SocialAuthenticate.md) for configuration options
   * 'CakeDC/Auth.RememberMe' check [RememberMeAuthenticate](https://github.com/CakeDC/auth/blob/master/src/RememberMeAuthenticate.php) for configuration options
+  * 'CakeDC/Auth.ApiKey' check [ApiKeyAuthenticate](https://github.com/CakeDC/auth/blob/master/Docs/Documentation/ApiKeyAuthenticate.md) for configuration options
 * Authorize
   * 'CakeDC/Auth.Superuser' check [SuperuserAuthorize](https://github.com/CakeDC/auth/blob/master/Docs/Documentation/SuperuserAuthorize.md) for configuration options
   * 'CakeDC/Auth.SimpleRbac' check [SimpleRbacAuthorize](https://github.com/CakeDC/auth/blob/master/Docs/Documentation/SimpleRbacAuthorize.md) for configuration options
-  * 'CakeDC/Auth.ApiKey' check [ApiKeyAuthenticate](https://github.com/CakeDC/auth/blob/master/Docs/Documentation/ApiKeyAuthenticate.md) for configuration options
 
 ## Using the user's email to login
 

composer.json

@@ -28,7 +28,7 @@
     },
     "require": {
         "cakephp/cakephp": "^3.6",
-        "cakedc/auth": "^2.0"
+        "cakedc/auth": "^3.0"
     },
     "require-dev": {
         "phpunit/phpunit": "^5.0",

src/Controller/Traits/LinkSocialTrait.php

@@ -41,7 +41,7 @@ public function linkSocial($alias = null)
         }
         $authUrl = $provider->getAuthorizationUrl($temporaryCredentials);
         if (empty($temporaryCredentials)) {
-            $this->request->session()->write('SocialLink.oauth2state', $provider->getState());
+            $this->request->getSession()->write('SocialLink.oauth2state', $provider->getState());
         }
 
         return $this->redirect($authUrl);
@@ -228,8 +228,8 @@ protected function _validateCallbackSocialLink()
         }
 
         $sessionKey = 'SocialLink.oauth2state';
-        $oauth2state = $this->request->session()->read($sessionKey);
-        $this->request->session()->delete($sessionKey);
+        $oauth2state = $this->request->getSession()->read($sessionKey);
+        $this->request->getSession()->delete($sessionKey);
         $state = $queryParams['state'];
 
         return $oauth2state === $state;

src/Controller/Traits/LoginTrait.php

@@ -218,20 +218,15 @@ public function verify()
             return $this->redirect(Configure::read('Auth.loginAction'));
         }
 
-        // storing user's session in the temporary one
-        // until the GA verification is checked
-        $temporarySession = $this->Auth->user();
-        $this->request->getSession()->delete('Auth.User');
+        $temporarySession = $this->request->getSession()->read('temporarySession');
+        if (!is_array($temporarySession) || empty($temporarySession)) {
+            $this->Flash->error(__d('CakeDC/Users', 'Invalid request.'), 'default', [], 'auth');
 
-        if (!empty($temporarySession)) {
-            $this->request->getSession()->write('temporarySession', $temporarySession);
-        }
-
-        if (array_key_exists('secret', $temporarySession)) {
-            $secret = $temporarySession['secret'];
+            return $this->redirect(Configure::read('Auth.loginAction'));
         }
 
-        $secretVerified = Hash::get((array)$temporarySession, 'secret_verified');
+        $secret = Hash::get($temporarySession, 'secret');
+        $secretVerified = Hash::get($temporarySession, 'secret_verified');
 
         // showing QR-code until shared secret is verified
         if (!$secretVerified) {
@@ -245,6 +240,8 @@ public function verify()
                         ->set(['secret' => $secret])
                         ->where(['id' => $temporarySession['id']]);
                     $query->execute();
+
+                    $this->request->getSession()->write('temporarySession.secret', $secret);
                 } catch (\Exception $e) {
                     $this->request->getSession()->destroy();
                     $message = $e->getMessage();
@@ -278,10 +275,12 @@ public function verify()
                         ->set(['secret_verified' => true])
                         ->where(['id' => $user['id']])
                         ->execute();
+
+                    $user['secret_verified'] = true;
                 }
 
                 $this->request->getSession()->delete('temporarySession');
-                $this->request->getSession()->write('Auth.User', $user);
+                $this->Auth->setUser($user);
                 $url = $this->Auth->redirectUrl();
 
                 return $this->redirect($url);
@@ -322,14 +321,16 @@ protected function _checkReCaptcha()
     protected function _afterIdentifyUser($user, $socialLogin = false, $googleAuthenticatorLogin = false)
     {
         if (!empty($user)) {
-            $this->Auth->setUser($user);
-
             if ($googleAuthenticatorLogin) {
+                // storing user's session in the temporary one
+                // until the GA verification is checked
+                $this->request->getSession()->write('temporarySession', $user);
                 $url = Configure::read('GoogleAuthenticator.verifyAction');
 
                 return $this->redirect($url);
             }
 
+            $this->Auth->setUser($user);
             $event = $this->dispatchEvent(UsersAuthComponent::EVENT_AFTER_LOGIN, ['user' => $user]);
             if (is_array($event->result)) {
                 return $this->redirect($event->result);

tests/TestCase/Controller/Component/GoogleAuthenticatorComponentTest.php

@@ -44,7 +44,6 @@ public function setUp()
         $this->backupUsersConfig = Configure::read('Users');
 
         Router::reload();
-        Plugin::routes('CakeDC/Users');
         Router::connect('/route/*', [
             'plugin' => 'CakeDC/Users',
             'controller' => 'Users',

tests/TestCase/Controller/Component/UsersAuthComponentTest.php

@@ -53,7 +53,6 @@ public function setUp()
         $this->backupUsersConfig = Configure::read('Users');
 
         Router::reload();
-        Plugin::routes('CakeDC/Users');
         Router::connect('/route/*', [
             'plugin' => 'CakeDC/Users',
             'controller' => 'Users',