github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-05-06 11:37:49 -05:00
Code Issues 690 Packages Projects Releases 11 Wiki Activity

[PR #2423] [MERGED] fix: prevent TOTP passcode reuse within validity window #9972

New Issue
Closed
opened 2026-04-23 09:19:15 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 09:19:15 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/go-vikunja/vikunja/pull/2423
Author: @tink-bot
Created: 3/20/2026
Status: ✅ Merged
Merged: 3/20/2026
Merged by: @kolaente

Base: fix-caldav-2fa-bypass ← Head: fix-totp-reuse

📝 Commits (5)

  • 819ed13 test: add TOTP fixture and load it in user test bootstrap
  • e6d5bf7 test: add failing test for TOTP passcode reuse prevention
  • 6ef72a3 fix: prevent TOTP passcode reuse within validity window
  • d2d3e54 fix: update TOTP reuse test to use user10 matching rebased fixture
  • 8438fd7 fix: add TTL-based expiry and cleanup for used TOTP passcode entries

📊 Changes

4 files changed (+128 additions, -1 deletions)

View changed files

📝 pkg/user/error.go (+26 -0)
📝 pkg/user/test.go (+1 -1)
📝 pkg/user/totp.go (+44 -0)
➕ pkg/user/totp_test.go (+57 -0)

📄 Description

TOTP passcodes can be reused within their 30-second validity window. After validating a TOTP passcode, stores a timestamp in the keyvalue store keyed by user ID and passcode. Subsequent uses of the same passcode within 90 seconds (30s window + clock skew) are rejected. Expired entries are lazily cleaned up via a background goroutine to prevent unbounded growth.

Depends on #2422 for the TOTP fixture data.

Security Advisory: GHSA-p747-qc5p-773r

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/go-vikunja/vikunja/pull/2423 **Author:** [@tink-bot](https://github.com/tink-bot) **Created:** 3/20/2026 **Status:** ✅ Merged **Merged:** 3/20/2026 **Merged by:** [@kolaente](https://github.com/kolaente) **Base:** `fix-caldav-2fa-bypass` ← **Head:** `fix-totp-reuse` --- ### 📝 Commits (5) - [`819ed13`](https://github.com/go-vikunja/vikunja/commit/819ed13265c8451f0f5301c7a49f83275fee22eb) test: add TOTP fixture and load it in user test bootstrap - [`e6d5bf7`](https://github.com/go-vikunja/vikunja/commit/e6d5bf71f52980eff9006ea2f1bee9a07ad8338d) test: add failing test for TOTP passcode reuse prevention - [`6ef72a3`](https://github.com/go-vikunja/vikunja/commit/6ef72a38a48ba68f9d053b4cf8ec8507009705f5) fix: prevent TOTP passcode reuse within validity window - [`d2d3e54`](https://github.com/go-vikunja/vikunja/commit/d2d3e5428b65db35fb0d689ed7bf0934356efe59) fix: update TOTP reuse test to use user10 matching rebased fixture - [`8438fd7`](https://github.com/go-vikunja/vikunja/commit/8438fd7cd0f599d536e1397359a435e82ee07bc9) fix: add TTL-based expiry and cleanup for used TOTP passcode entries ### 📊 Changes **4 files changed** (+128 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `pkg/user/error.go` (+26 -0) 📝 `pkg/user/test.go` (+1 -1) 📝 `pkg/user/totp.go` (+44 -0) ➕ `pkg/user/totp_test.go` (+57 -0) </details> ### 📄 Description TOTP passcodes can be reused within their 30-second validity window. After validating a TOTP passcode, stores a timestamp in the keyvalue store keyed by user ID and passcode. Subsequent uses of the same passcode within 90 seconds (30s window + clock skew) are rejected. Expired entries are lazily cleaned up via a background goroutine to prevent unbounded growth. Depends on #2422 for the TOTP fixture data. Security Advisory: GHSA-p747-qc5p-773r --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 09:19:15 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/attachments
area/auth
area/avatars
area/backup-restore
area/caldav
area/calendar-view
area/comments
area/config
area/database
area/desktop
area/docker
area/email
area/favorites
area/filters
area/frontend
area/gantt
area/i18n
area/import-export
area/internal-code
area/kanban
area/labels
area/list-view
area/mobile
area/notifications
area/permissions
area/projects
area/pwa
area/recurring-tasks
area/reminders
area/search
area/shortcuts
area/subtasks
area/sync
area/table-view
area/task-editor
area/task-metadata
area/task-relations
area/teams
area/theming
area/time-tracking
area/typesense
area/views
area/webhooks
bug
changes requested
concern/accessibility
concern/performance
concern/regression
concern/ux
confirmed
db/mysql
dependencies
enhancement
good first issue
help wanted
integration/inbound
integration/outbound
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#9972
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?