From 5dea748b0c8470bb1900b94d0b48c9d474b18fb8 Mon Sep 17 00:00:00 2001 From: Travis Garrison Date: Wed, 5 Aug 2026 11:35:07 +0400 Subject: [PATCH] fix(auth): validate gcaptcha before password to prevent bypass Move gcaptcha check before credential validation so a valid captcha is required prior to any login attempt. Previously, password auth ran first, allowing timing-based enumeration without captcha. Signed-off-by: Travis Garrison --- app/Config/Validation/OSPOSRules.php | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/app/Config/Validation/OSPOSRules.php b/app/Config/Validation/OSPOSRules.php index 49be9f367..46437d20d 100644 --- a/app/Config/Validation/OSPOSRules.php +++ b/app/Config/Validation/OSPOSRules.php @@ -39,13 +39,6 @@ class OSPOSRules return false; } - $password = $data['password']; - if (!$employee->login($username, $password)) { - $error = lang('Login.invalid_username_and_password'); - - return false; - } - $gcaptcha_enabled = array_key_exists('gcaptcha_enable', $this->config) && $this->config['gcaptcha_enable']; if ($gcaptcha_enabled) { $g_recaptcha_response = $this->request->getPost('g-recaptcha-response'); @@ -57,6 +50,13 @@ class OSPOSRules } } + $password = $data['password']; + if (!$employee->login($username, $password)) { + $error = lang('Login.invalid_username_and_password'); + + return false; + } + return true; }