Don't permit access to internal keys via API.

mydnshost · Mar 10, 2019 · 4db0d72 · 4db0d72
1 parent 9c3e8cf
commit 4db0d72
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/web/1.0/methods/useradmin.php b/web/1.0/methods/useradmin.php
@@ -36,6 +36,8 @@ protected function get2FAKeyFromParam($userid, $secretid) {
 			$key = TwoFactorKey::loadFromUserKey($this->getContextKey('db'), $userid, $secretid);
 			if ($key === FALSE) {
 				$this->getContextKey('response')->sendError('Unknown 2fakey: ' . $secretid);
+			} else if ($key->isInternal()) {
+				$this->getContextKey('response')->sendError('Unknown 2fakey: ' . $secretid);
 			}
 
 			return $key;