659c33f0e8
This bug was reported to us by a user (@Ferry#1704) on Discord on Monday, November 7th, 2016. It was disclosed that it was possible to bypass the 2FA checkpoint by clicking outside of the modal which would prompt the modal to close, but not submit the form. The user could then press the login button which would trigger an error. Due to this error being triggered the authentication attempt was not cancelled. On the next page load the application recognized the user as logged in and continued on to the panel. At no time was it possible to login without using the correct email address and password. As a result of this bug we have re-factored the Authentication code for logins to address the persistent session. Previously accounts were manually logged back out on 2FA failure. However, as this bug demonstrated, causing a fatal error in the code would prevent the logout code from firing, thus preserving their session state. This commit modifies the code to use a non-persistent login to handle 2FA checking. In order for the session to be saved the application must complete all portions of the login without any errors, at which point the user is persistently authenticated using Auth::login(). This resolves the ability to cause an exception and bypass 2FA verification. |
||
|---|---|---|
| .github | ||
| app | ||
| bootstrap | ||
| config | ||
| database | ||
| public | ||
| resources | ||
| storage | ||
| tests | ||
| .env.example | ||
| .gitignore | ||
| .phraseapp.yml | ||
| CHANGELOG.md | ||
| CONTRIBUTING.md | ||
| CONTRIBUTORS.md | ||
| LICENSE.md | ||
| README.md | ||
| artisan | ||
| composer.json | ||
| server.php | ||
README.md
Pterodactyl Panel
Pterodactyl is the free game server management panel designed by users, for users. Featuring support for Vanilla Minecraft, Spigot, Source Dedicated Servers, BungeeCord, and many more. Pterodactyl is built on the Laravel PHP Framework (v5.3).
Support & Documentation
Support for using Pterodactyl can be found on our wiki or on our Discord chat.
License
Copyright (c) 2015 - 2016 Dane Everitt <dane@daneeveritt.com>
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Credits
A huge thanks to PhraseApp who provide us the software to help translate this project.
Ace Editor - license - homepage
Animate.css - license - homepage
Bootstrap - license - homepage
BootStrap Notify - license - homepage
FontAwesome - license - homepage
FontAwesome Animations - license - homepage
jQuery Terminal - license - homepage
Socket.io - license - homepage
SweetAlert - license - homepage
Typeahead — license — homepage
Additional License Information
Some Javascript and CSS used within the panel is licensed under a MIT or Apache 2.0. Please check their respective header files for more information.
Some images used within Pterodactyl are Copyright (c) their respective owners.
/public/images/403.jpg is licensed under a CC BY 2.0 by BigTallGuy
/public/images/404.jpg is licensed under a CC BY-SA 2.0 by nicsuzor