From ce64be4e1433d71cf1a0b4bb9a208e6793d76810 Mon Sep 17 00:00:00 2001 From: jevb Date: Tue, 31 Mar 2026 16:17:40 +0200 Subject: [PATCH] fix: safe registration_open default + TOTP constant-time comparison (T-199, T-201) --- Server/api/auth_handler.go | 2 +- Server/auth/totp.go | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/Server/api/auth_handler.go b/Server/api/auth_handler.go index a900936a..f4da7af0 100644 --- a/Server/api/auth_handler.go +++ b/Server/api/auth_handler.go @@ -793,7 +793,7 @@ func isRequire2FAEnabled(database *db.DB) (bool, error) { } func isRegistrationOpen(database *db.DB) (bool, error) { - return getBooleanSetting(database, "registration_open", false) + return getBooleanSetting(database, "registration_open", true) } func getBooleanSetting(database *db.DB, key string, defaultValue bool) (bool, error) { diff --git a/Server/auth/totp.go b/Server/auth/totp.go index 5ad49988..9e10361c 100644 --- a/Server/auth/totp.go +++ b/Server/auth/totp.go @@ -4,6 +4,7 @@ import ( "crypto/hmac" "crypto/rand" "crypto/sha1" + "crypto/subtle" "encoding/base32" "encoding/binary" "encoding/hex" @@ -204,7 +205,7 @@ func VerifyTOTPCode(secret, code string, at time.Time) bool { } for _, offset := range []int{-1, 0, 1} { candidate, err := GenerateTOTPCode(secret, at.Add(time.Duration(offset)*totpPeriod)) - if err == nil && candidate == code { + if err == nil && subtle.ConstantTimeCompare([]byte(candidate), []byte(code)) == 1 { return true } }