From 2db7928b763378f66ddaa88aa75e98db952353e8 Mon Sep 17 00:00:00 2001
From: Dane Everitt <dane@daneeveritt.com>
Date: Fri, 21 Jun 2019 21:39:24 -0700
Subject: [PATCH] Don't expose existence of account when an incorrect password
 is provided and the user has 2FA enabled

---
 app/Http/Controllers/Auth/LoginController.php | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php
index d00b22fa..c18b004b 100644
--- a/app/Http/Controllers/Auth/LoginController.php
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -126,21 +126,20 @@ class LoginController extends Controller
             return $this->sendFailedLoginResponse($request);
         }
 
-        $validCredentials = password_verify($request->input('password'), $user->password);
+        if (! password_verify($request->input('password'), $user->password)) {
+            return $this->sendFailedLoginResponse($request, $user);
+        }
+
         if ($user->use_totp) {
             $token = str_random(64);
-            $this->cache->put($token, ['user_id' => $user->id, 'valid_credentials' => $validCredentials], 5);
+            $this->cache->put($token, ['user_id' => $user->id, 'valid_credentials' => true], 5);
 
             return redirect()->route('auth.totp')->with('authentication_token', $token);
         }
 
-        if ($validCredentials) {
-            $this->auth->guard()->login($user, true);
+        $this->auth->guard()->login($user, true);
 
-            return $this->sendLoginResponse($request);
-        }
-
-        return $this->sendFailedLoginResponse($request, $user);
+        return $this->sendLoginResponse($request);
     }
 
     /**
@@ -161,12 +160,13 @@ class LoginController extends Controller
 
     /**
      * Handle a login where the user is required to provide a TOTP authentication
-     * token. In order to add additional layers of security, users are not
-     * informed of an incorrect password until this stage, forcing them to
-     * provide a token on each login attempt.
+     * token.
      *
      * @param \Illuminate\Http\Request $request
      * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\Response
+     * @throws \PragmaRX\Google2FA\Exceptions\IncompatibleWithGoogleAuthenticatorException
+     * @throws \PragmaRX\Google2FA\Exceptions\InvalidCharactersException
+     * @throws \PragmaRX\Google2FA\Exceptions\SecretKeyTooShortException
      */
     public function loginUsingTotp(Request $request)
     {
@@ -181,7 +181,7 @@ class LoginController extends Controller
             return $this->sendFailedLoginResponse($request);
         }
 
-        if (is_null($request->input('2fa_token')) || ! array_get($cache, 'valid_credentials')) {
+        if (is_null($request->input('2fa_token'))) {
             return $this->sendFailedLoginResponse($request, $user);
         }