Change login flow to always check both 2FA, update CHANGELOG

CHANGELOG.md

@@ -9,12 +9,14 @@ Special shoutout to l29utp0 & loynet (ptchan.org), Homicide (94chan.org) and som
 Now, back to the program. Here are the changes for 1.0.0, with one especially notable feature:
   - Multiple language support. jschan now supports language packs. There is a global and board-level language setting which completely translates the interface to another language. No javascript required.
     - An effort has been made to translate everything, but given there is almost 4 years of code, some things may have slipped through the cracks. If something isn't translated, please report it on gitgud.
-	- 1.0.0 includes two language packs: English and Portuguese. Contributions for new language packs or improvements to existing ones are very welcome!
+	- 1.0.0 includes three* language packs: English (en-GB) and Portuguese (pt-PT) (Russian machine translation is also included, but may not be accurate).
 	- Huge credit to the ptchan.org admins for providing the Portuguese translation.
+	- Contributions for new language packs or improvements to existing ones are very welcome! Reach out via email/IRC to discuss imbursement for contributing language packs.
   - Improve the css and markup to only show the appropriate wording e.g "tap" or "click" in tooltips depending if you are on mobile/desktop.
   - Notify the user when making a playlist from a thread if there were no files, rather than just silently logging.
   - Improve the installation process to fix a potential issue with the database connection settings.
   - Customflags will now show correctly when editing a post on a board with custom flags enabled.
+  - Security improvement to the 2FA validation flow during login.
   - More minor bugfixes to permissions pages displays.
 
 ### 0.11.2

lib/misc/dotwofactor.js

@@ -3,10 +3,6 @@ const OTPAuth = require('otpauth')
 
 module.exports = async (username, totpSecret, userInput) => {
 
-	if (!userInput) {
-		return null;
-	}
-
 	const totp = new OTPAuth.TOTP({
 		secret: totpSecret,
 		algorithm: 'SHA256',

models/forms/login.js

@@ -7,6 +7,7 @@ const bcrypt = require('bcrypt')
 
 module.exports = async (req, res) => {
 
+	const { __ } = res.locals;
 	const username = req.body.username.toLowerCase();
 	const password = req.body.password;
 	let goto = req.body.goto;
@@ -22,8 +23,8 @@ module.exports = async (req, res) => {
 	//if the account doesnt exist, reject
 	if (!account) {
 		return dynamicResponse(req, res, 403, 'message', {
-			'title': 'Forbidden',
-			'message': 'Incorrect login credentials',
+			'title': __('Forbidden'),
+			'message': __('Incorrect login credentials'),
 			'redirect': failRedirect
 		});
 	}
@@ -31,26 +32,19 @@ module.exports = async (req, res) => {
 	// bcrypt compare input to saved hash
 	const passwordMatch = await bcrypt.compare(password, account.passwordHash);
 
-	//if hashes matched
-	if (passwordMatch === false) {
+	//2fA (TOTP) validation
+	const delta = await doTwoFactor(username, account.twofactor, req.body.twofactor);
+
+	//if password was correct and 2fa valid (if enabled)
+	if (passwordMatch === false
+		|| (account.twofactor && delta === null)) {
 		return dynamicResponse(req, res, 403, 'message', {
-			'title': 'Forbidden',
-			'message': 'Incorrect login credentials',
+			'title': __('Forbidden'),
+			'message': __('Incorrect login credentials'),
 			'redirect': failRedirect
 		});
 	}
 
-	if (account.twofactor) {
-		const delta = await doTwoFactor(username, account.twofactor, req.body.twofactor);
-		if (delta === null) {
-			return dynamicResponse(req, res, 403, 'message', {
-				'title': 'Forbidden',
-				'message': 'Incorrect login credentials', //better to not tell them, i think
-				'redirect': failRedirect
-			});
-		}
-	}
-
 	// add the account to the session and authenticate if password was correct
 	req.session.user = account._id;
 

models/forms/makepost.js

@@ -345,7 +345,7 @@ module.exports = async (req, res) => {
 						break;
 					}
 					default:
-						throw new Error(`invalid file mime type: ${processedFile.mimetype}`);
+						throw new Error(__('invalid file mime type: %s', processedFile.mimetype));
 				}
 			}