github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-06 11:37:49 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #2422] [MERGED] fix: reject CalDAV basic auth when TOTP is enabled #4130

New Issue
Closed
opened 2026-03-22 15:04:15 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-22 15:04:15 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2422
Author: @tink-bot
Created: 3/20/2026
Status: ✅ Merged
Merged: 3/20/2026
Merged by: @kolaente

Base: main ← Head: fix-caldav-2fa-bypass

📝 Commits (7)

  • dc430d6 test: add TOTP fixture data for user1
  • f36bb5f test: add failing test for CalDAV 2FA bypass via basic auth
  • 54a8275 test: register totp fixture in test setup
  • bd42a48 fix: reject CalDAV basic auth when TOTP is enabled
  • a1e5022 fix: use user10 instead of user1 for TOTP fixture to avoid breaking login tests
  • 244f5d2 fix: update TOTP fixtures and tests to avoid conflicts with existing enrollment tests
  • e1cf3bc test: verify CalDAV token auth bypasses TOTP check

📊 Changes

6 files changed (+59 additions, -1 deletions)

View changed files

➕ pkg/db/fixtures/totp.yml (+11 -0)
📝 pkg/db/fixtures/user_tokens.yml (+6 -0)
📝 pkg/models/setup_tests.go (+1 -0)
📝 pkg/routes/caldav/auth.go (+12 -0)
📝 pkg/webtests/caldav_test.go (+25 -0)
📝 pkg/webtests/user_totp_test.go (+4 -1)

📄 Description

CalDAV basic auth with username/password bypasses 2FA when the user has TOTP enabled. Adds a TOTPEnabledForUser check after successful password auth in the CalDAV BasicAuth handler — if TOTP is enabled, the login is rejected with a warning. CalDAV token auth is unaffected (tokens are explicitly generated by the user and bypass 2FA by design).

Security Advisory: GHSA-47cr-f226-r4pq

Test plan

  • Verify password-based CalDAV auth is rejected when TOTP is enabled
  • Verify CalDAV token auth still works when TOTP is enabled
  • Verify CalDAV auth still works for users without TOTP

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2422 **Author:** [@tink-bot](https://github.com/tink-bot) **Created:** 3/20/2026 **Status:** ✅ Merged **Merged:** 3/20/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `main` ← **Head:** `fix-caldav-2fa-bypass` --- ### 📝 Commits (7) - [`dc430d6`](https://github.com/go-vikunja/vikunja/commit/dc430d641204254e83049159be696df456241f08) test: add TOTP fixture data for user1 - [`f36bb5f`](https://github.com/go-vikunja/vikunja/commit/f36bb5f0319e81f5dad9e721be74555896c0e707) test: add failing test for CalDAV 2FA bypass via basic auth - [`54a8275`](https://github.com/go-vikunja/vikunja/commit/54a82751afe4c8e43f6d41a2c7b3a5ee5866f3b2) test: register totp fixture in test setup - [`bd42a48`](https://github.com/go-vikunja/vikunja/commit/bd42a485272cbb72e4e5f0e1607c9f1d0a15e148) fix: reject CalDAV basic auth when TOTP is enabled - [`a1e5022`](https://github.com/go-vikunja/vikunja/commit/a1e5022b5f84848b96de98da1b1b125ec886be9d) fix: use user10 instead of user1 for TOTP fixture to avoid breaking login tests - [`244f5d2`](https://github.com/go-vikunja/vikunja/commit/244f5d2c8012761b0229a1e3fe00a551be7a1fc6) fix: update TOTP fixtures and tests to avoid conflicts with existing enrollment tests - [`e1cf3bc`](https://github.com/go-vikunja/vikunja/commit/e1cf3bc933501509b3986187bb8bc35ebe4e69e5) test: verify CalDAV token auth bypasses TOTP check ### 📊 Changes **6 files changed** (+59 additions, -1 deletions) <details> <summary>View changed files</summary> ➕ `pkg/db/fixtures/totp.yml` (+11 -0) 📝 `pkg/db/fixtures/user_tokens.yml` (+6 -0) 📝 `pkg/models/setup_tests.go` (+1 -0) 📝 `pkg/routes/caldav/auth.go` (+12 -0) 📝 `pkg/webtests/caldav_test.go` (+25 -0) 📝 `pkg/webtests/user_totp_test.go` (+4 -1) </details> ### 📄 Description CalDAV basic auth with username/password bypasses 2FA when the user has TOTP enabled. Adds a `TOTPEnabledForUser` check after successful password auth in the CalDAV `BasicAuth` handler — if TOTP is enabled, the login is rejected with a warning. CalDAV token auth is unaffected (tokens are explicitly generated by the user and bypass 2FA by design). Security Advisory: GHSA-47cr-f226-r4pq ## Test plan - Verify password-based CalDAV auth is rejected when TOTP is enabled - Verify CalDAV token auth still works when TOTP is enabled - Verify CalDAV auth still works for users without TOTP --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-22 15:04:15 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#4130
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?