Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure API requests with session auth check 2fa status #19550

Merged
merged 1 commit into from Jul 21, 2022

Conversation

sgiehl
Copy link
Member

@sgiehl sgiehl commented Jul 20, 2022

Description:

If API requests are sent using the currents session token_auth, the 2FA status of the session should be checked.

Review

@sgiehl sgiehl added c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. Needs Review PRs that need a code review labels Jul 20, 2022
@sgiehl sgiehl added this to the 4.12.0 milestone Jul 20, 2022
@peterhashair peterhashair merged commit 7f2d5ce into 4.x-dev Jul 21, 2022
@peterhashair peterhashair deleted the apisession2fa branch July 21, 2022 01:57
@sgiehl
Copy link
Member Author

sgiehl commented Jul 21, 2022

@peterhashair This PR might look quite small, but it actually is quite impacting. If there is something wrong it could open up security issues. Would you in general mind to summarize what exactly you did on code reviews? Simply adding a green tick doesn't give a feeling if you only looked at the code or if you also tested possible scenarios where the code changes have an effect. You are still quite "new" to the product and might not yet be able to directly see the impact of certain code changes. So this might help to get a feeling if you thought of everything that should have been looked at. I could then give you feedback and you might be able to harden your knowledge over time.

@justinvelluppillai
Copy link
Contributor

Good points there @sgiehl. @peterhashair for all reviews it would be good to leave a few sentences describing what you've tested and what you're giving the tick for, eg "I've run it locally, tested X and Y scenarios, etc".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. Needs Review PRs that need a code review
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants