nahakubuilder/mailgoserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MFA fix, added IP blacklist, update webmail client

Browse Source
This commit is contained in:
nahakubuilder
2026-08-14 13:04:55 +01:00
parent 6063f95504
commit 892f366a16
122 changed files with 13362 additions and 251 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/webui/webauthn.go
+4 -4
View File
@@ -150,7 +150,7 @@ func (a *App) passkeyRegisterFinish(w http.ResponseWriter, r *http.Request) {
writeJSON(w, http.StatusInternalServerError, M{"error": "Could not save passkey"})
return
}
_ = a.DB.LogAuthAttempt("admin_mfa", user.Username, requestIP(r), true, "Passkey added: "+name)
_ = a.DB.LogAuthAttempt("admin_mfa", user.Username, a.requestIP(r), true, "Passkey added: "+name)
writeJSON(w, http.StatusOK, M{"success": true})
}
@@ -159,7 +159,7 @@ func (a *App) passkeyRemove(w http.ResponseWriter, r *http.Request) {
if err := a.DB.DeleteWebAuthnCredential(pathID(r), user.ID); err != nil {
setFlash(w, "error", "Could not remove passkey")
} else {
_ = a.DB.LogAuthAttempt("admin_mfa", user.Username, requestIP(r), true, "Passkey removed")
_ = a.DB.LogAuthAttempt("admin_mfa", user.Username, a.requestIP(r), true, "Passkey removed")
setFlash(w, "success", "Passkey removed")
}
http.Redirect(w, r, Prefix+"/account", http.StatusFound)
@@ -230,7 +230,7 @@ func (a *App) passkeyLoginFinish(w http.ResponseWriter, r *http.Request) {
}
if _, err := wa.FinishLogin(wu, *session, r); err != nil {
clearWebauthnSession(w)
_ = a.DB.LogAuthAttempt("admin_login", user.Username, requestIP(r), false, "Passkey verification failed")
_ = a.DB.LogAuthAttempt("admin_login", user.Username, a.requestIP(r), false, "Passkey verification failed")
writeJSON(w, http.StatusUnauthorized, M{"error": "Passkey verification failed"})
return
}
@@ -241,7 +241,7 @@ func (a *App) passkeyLoginFinish(w http.ResponseWriter, r *http.Request) {
writeJSON(w, http.StatusInternalServerError, M{"error": "Could not start session"})
return
}
_ = a.DB.LogAuthAttempt("admin_login", user.Username, requestIP(r), true, "Login successful (passkey)")
_ = a.DB.LogAuthAttempt("admin_login", user.Username, a.requestIP(r), true, "Login successful (passkey)")
clearPendingMFACookie(w)
setSessionCookie(w, token, r.TLS != nil)
writeJSON(w, http.StatusOK, M{"success": true})