Fix Security Issues (#644)

* Apply fix for Microsoft Security Advisory CVE-2018-0784

* Apply fix for Microsoft Security Advisory CVE-2018-0785

src/Web/Controllers/ManageController.cs

@@ -26,6 +26,7 @@ public class ManageController : Controller
     private readonly UrlEncoder _urlEncoder;
 
     private const string AuthenticatorUriFormat = "otpauth://totp/{0}:{1}?secret={2}&issuer={0}&digits=6";
+    private const string RecoveryCodesKey = nameof(RecoveryCodesKey);
 
     public ManageController(
       UserManager<ApplicationUser> userManager,
@@ -370,37 +371,42 @@ public class ManageController : Controller
             throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
         }
 
-        var unformattedKey = await _userManager.GetAuthenticatorKeyAsync(user);
-        if (string.IsNullOrEmpty(unformattedKey))
-        {
-            await _userManager.ResetAuthenticatorKeyAsync(user);
-            unformattedKey = await _userManager.GetAuthenticatorKeyAsync(user);
-        }
-
-        var model = new EnableAuthenticatorViewModel
-        {
-            SharedKey = FormatKey(unformattedKey),
-            AuthenticatorUri = GenerateQrCodeUri(user.Email, unformattedKey)
-        };
+        var model = new EnableAuthenticatorViewModel();
+        await LoadSharedKeyAndQrCodeUriAsync(user, model);
 
         return View(model);
     }
 
+    [HttpGet]
+    public IActionResult ShowRecoveryCodes()
+    {
+        var recoveryCodes = (string[])TempData[RecoveryCodesKey];
+        if (recoveryCodes == null)
+        {
+            return RedirectToAction(nameof(TwoFactorAuthentication));
+        }
+
+        var model = new ShowRecoveryCodesViewModel { RecoveryCodes = recoveryCodes };
+        return View(model);
+    }
+
+
     [HttpPost]
     [ValidateAntiForgeryToken]
     public async Task<IActionResult> EnableAuthenticator(EnableAuthenticatorViewModel model)
     {
-        if (!ModelState.IsValid)
-        {
-            return View(model);
-        }
-
         var user = await _userManager.GetUserAsync(User);
         if (user == null)
         {
             throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
         }
 
+        if (!ModelState.IsValid)
+        {
+            await LoadSharedKeyAndQrCodeUriAsync(user, model);
+            return View(model);
+        }
+
         // Strip spaces and hypens
         var verificationCode = model.Code.Replace(" ", string.Empty).Replace("-", string.Empty);
 
@@ -409,13 +415,17 @@ public class ManageController : Controller
 
         if (!is2faTokenValid)
         {
-            ModelState.AddModelError("model.TwoFactorCode", "Verification code is invalid.");
+            ModelState.AddModelError("Code", "Verification code is invalid.");
+            await LoadSharedKeyAndQrCodeUriAsync(user, model);
             return View(model);
         }
 
         await _userManager.SetTwoFactorEnabledAsync(user, true);
         _logger.LogInformation("User with ID {UserId} has enabled 2FA with an authenticator app.", user.Id);
-        return RedirectToAction(nameof(GenerateRecoveryCodes));
+        var recoveryCodes = await _userManager.GenerateNewTwoFactorRecoveryCodesAsync(user, 10);
+        TempData[RecoveryCodesKey] = recoveryCodes.ToArray();
+
+        return RedirectToAction(nameof(ShowRecoveryCodes));
     }
 
     [HttpGet]
@@ -441,7 +451,8 @@ public class ManageController : Controller
         return RedirectToAction(nameof(EnableAuthenticator));
     }
 
-    [HttpGet]
+    [HttpPost]
+    [ValidateAntiForgeryToken]
     public async Task<IActionResult> GenerateRecoveryCodes()
     {
         var user = await _userManager.GetUserAsync(User);
@@ -456,11 +467,28 @@ public class ManageController : Controller
         }
 
         var recoveryCodes = await _userManager.GenerateNewTwoFactorRecoveryCodesAsync(user, 10);
-        var model = new GenerateRecoveryCodesViewModel { RecoveryCodes = recoveryCodes.ToArray() };
-
         _logger.LogInformation("User with ID {UserId} has generated new 2FA recovery codes.", user.Id);
 
-        return View(model);
+        var model = new ShowRecoveryCodesViewModel { RecoveryCodes = recoveryCodes.ToArray() };
+
+        return View(nameof(ShowRecoveryCodes), model);
+    }
+
+    [HttpGet]
+    public async Task<IActionResult> GenerateRecoveryCodesWarning()
+    {
+        var user = await _userManager.GetUserAsync(User);
+        if (user == null)
+        {
+            throw new ApplicationException($"Unable to load user with ID '{_userManager.GetUserId(User)}'.");
+        }
+
+        if (!user.TwoFactorEnabled)
+        {
+            throw new ApplicationException($"Cannot generate recovery codes for user with ID '{user.Id}' because they do not have 2FA enabled.");
+        }
+
+        return View(nameof(GenerateRecoveryCodesWarning));
     }
 
     private void AddErrors(IdentityResult result)
@@ -496,4 +524,18 @@ public class ManageController : Controller
             _urlEncoder.Encode(email),
             unformattedKey);
     }
+
+    private async Task LoadSharedKeyAndQrCodeUriAsync(ApplicationUser user, EnableAuthenticatorViewModel model)
+    {
+        var unformattedKey = await _userManager.GetAuthenticatorKeyAsync(user);
+        if (string.IsNullOrEmpty(unformattedKey))
+        {
+            await _userManager.ResetAuthenticatorKeyAsync(user);
+            unformattedKey = await _userManager.GetAuthenticatorKeyAsync(user);
+        }
+
+        model.SharedKey = FormatKey(unformattedKey);
+        model.AuthenticatorUri = GenerateQrCodeUri(user.Email, unformattedKey);
+    }
+
 }