[FIX] Bypassing 2FA on email verification (#647)

RocketChat · Feb 14, 2023 · 31f0e01 · 31f0e01
1 parent 1067078
commit 31f0e01
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 4 deletions.
diff --git a/apps/meteor/app/2fa/server/loginHandler.ts b/apps/meteor/app/2fa/server/loginHandler.ts
@@ -26,7 +26,11 @@ Accounts.registerLoginHandler('totp', function (options) {
 callbacks.add(
 	'onValidateLogin',
 	(login) => {
-		if (login.type === 'resume' || login.type === 'proxy' || login.methodName === 'verifyEmail') {
+		if (login.methodName === 'verifyEmail') {
+			throw new Meteor.Error('verify-email', 'E-mail verified');
+		}
+
+		if (login.type === 'resume' || login.type === 'proxy') {
 			return login;
 		}
 		// CAS login doesn't yet support 2FA.

diff --git a/apps/meteor/app/ui/client/lib/accounts.js b/apps/meteor/app/ui/client/lib/accounts.js
@@ -4,14 +4,13 @@ import { Accounts } from 'meteor/accounts-base';
 import { t } from '../../../utils';
 import { dispatchToastMessage } from '../../../../client/lib/toast';
 
-Accounts.onEmailVerificationLink(function (token, done) {
+Accounts.onEmailVerificationLink(function (token) {
 	Accounts.verifyEmail(token, function (error) {
-		if (error == null) {
+		if (error.error === 'verify-email') {
 			dispatchToastMessage({ type: 'success', message: t('Email_verified') });
 			Meteor.call('afterVerifyEmail');
 		} else {
 			dispatchToastMessage({ type: 'error', message: error.message });
 		}
-		return done();
 	});
 });