bitwarden/mobile
1
0
Fork 0
mirror of https://github.com/bitwarden/mobile synced 2026-01-13 14:03:23 +00:00
Code Issues Releases Wiki Activity

[AC-1070] Change master password options to method variable to avoid class field

Browse Source 
Add null check for password strength result and log an error as this is an unexpected flow
This commit is contained in:
Shane Melton
2023-03-10 14:11:22 -08:00
parent 1c75421f53
commit 77280a42f1
1 changed files with 18 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
src/App/Pages/Accounts/LockPageViewModel.cs
View File

@@ -49,8 +49,6 @@ namespace Bit.App.Pages
private bool _isPinProtected;
private bool _isPinProtectedWithKey;
private MasterPasswordPolicyOptions _enforcedMasterPasswordOptions;
public LockPageViewModel()
{
_apiService = ServiceContainer.Resolve<IApiService>("apiService");
@@ -300,6 +298,7 @@ namespace Bit.App.Pages
var key = await _cryptoService.MakeKeyAsync(MasterPassword, _email, kdfConfig);
var storedKeyHash = await _cryptoService.GetKeyHashAsync();
var passwordValid = false;
MasterPasswordPolicyOptions enforcedMasterPasswordOptions = null;
if (storedKeyHash != null)
{
@@ -311,10 +310,11 @@ namespace Bit.App.Pages
var keyHash = await _cryptoService.HashPasswordAsync(MasterPassword, key, HashPurpose.ServerAuthorization);
var request = new PasswordVerificationRequest();
request.MasterPasswordHash = keyHash;
try
{
var response = await _apiService.PostAccountVerifyPasswordAsync(request);
_enforcedMasterPasswordOptions = response.MasterPasswordPolicy;
enforcedMasterPasswordOptions = response.MasterPasswordPolicy;
passwordValid = true;
var localKeyHash = await _cryptoService.HashPasswordAsync(MasterPassword, key, HashPurpose.LocalAuthorization);
await _cryptoService.SetKeyHashAsync(localKeyHash);
@@ -336,7 +336,7 @@ namespace Bit.App.Pages
await _stateService.SetPinProtectedKeyAsync(await _cryptoService.EncryptAsync(key.Key, pinKey));
}
if (await RequirePasswordChangeAsync())
if (await RequirePasswordChangeAsync(enforcedMasterPasswordOptions))
{
// Save the ForcePasswordResetReason to force a password reset after unlock
await _stateService.SetForcePasswordResetReasonAsync(
@@ -370,24 +370,31 @@ namespace Bit.App.Pages
/// <summary>
/// Checks if the master password requires updating to meet the enforced policy requirements
/// </summary>
private async Task<bool> RequirePasswordChangeAsync()
/// <param name="options"></param>
private async Task<bool> RequirePasswordChangeAsync(MasterPasswordPolicyOptions options = null)
{
// If we do not have any saved policies, attempt to load them from the service
_enforcedMasterPasswordOptions ??= await _policyService.GetMasterPasswordPolicyOptions();
// If no policy options are provided, attempt to load them from the policy service
var enforcedOptions = options ?? await _policyService.GetMasterPasswordPolicyOptions();
// No policy to enforce on login/unlock
if (!(_enforcedMasterPasswordOptions is { EnforceOnLogin: true }))
if (!(enforcedOptions is { EnforceOnLogin: true }))
{
return false;
}
var strength = _passwordGenerationService.PasswordStrength(
MasterPassword, _passwordGenerationService.GetPasswordStrengthUserInput(_email)).Score;
MasterPassword, _passwordGenerationService.GetPasswordStrengthUserInput(_email))?.Score;
if (!strength.HasValue)
{
_logger.Error("Unable to evaluate master password strength during unlock");
return false;
}
return !await _policyService.EvaluateMasterPassword(
strength,
strength.Value,
MasterPassword,
_enforcedMasterPasswordOptions
enforcedOptions
);
}