Merge pull request #7 from baseVISION/sync/backport-2026-05b

[BV] Backport security fixes from upstream hotfix_v2.4.29

Author: Che4ter

docker-compose.bv.yml

@@ -51,7 +51,8 @@ services:
       context: .
       dockerfile: docker/webApp/Dockerfile
     image: bv-iriswebapp-app:develop
-    ports: []
+    ports:
+      - "127.0.0.1:8000:8000"
     volumes:
       - ./source/app:/iriswebapp/app:z
       - ./ui/dist:/iriswebapp/static:z
@@ -99,6 +100,8 @@ services:
         NGINX_CONF_GID: 1234
         NGINX_CONF_FILE: ${NGINX_CONF_FILE:-nginx.conf}
     image: bv-iriswebapp-nginx:develop
+    security_opt:
+      - "label=disable"
     volumes:
       - "./certificates/web_certificates/:/www/certs/:z"
     depends_on:

docker/nginx/nginx.conf

@@ -77,15 +77,6 @@ http {
     proxy_set_header    X-Real-IP           $remote_addr;
     proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
 
-    # FULLY DISABLE SERVER CACHE
-    add_header          Last-Modified $date_gmt;
-    add_header          'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
-    if_modified_since   off;
-    expires             off;
-    etag                off;
-    proxy_no_cache      1;
-    proxy_cache_bypass  1;
-
     # SSL CONF, STRONG CIPHERS ONLY
     ssl_protocols               TLSv1.2 TLSv1.3;
 
@@ -119,6 +110,45 @@ http {
         add_header Strict-Transport-Security    "max-age=31536000: includeSubDomains" always;
         add_header Front-End-Https              on;
 
+        # FULLY DISABLE SERVER CACHE
+        # Moved to server block to fix inheritance issues.
+        # 'always' ensures headers are sent even on error pages.
+        add_header Last-Modified $date_gmt always;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
+        add_header Pragma "no-cache" always;
+        add_header Expires "0" always;
+        if_modified_since off;
+        expires off;
+        etag off;
+        proxy_no_cache 1;
+        proxy_cache_bypass 1;
+
+        location /static {
+            # Enable Caching (Overrides server "off" settings) for static
+            # ----------------------------------------------------
+            expires 1y;
+            add_header Cache-Control "public, max-age=31536000, immutable";
+
+            # Re-enable ETags and Last-Modified so browsers can check for updates
+            etag on;
+            if_modified_since exact;
+
+            # Re-apply Security Headers
+            add_header X-XSS-Protection             "1; mode=block";
+            add_header X-Frame-Options              DENY;
+            add_header X-Content-Type-Options       nosniff;
+            add_header Strict-Transport-Security    "max-age=31536000: includeSubDomains" always;
+            add_header Front-End-Https              on;
+            add_header Content-Security-Policy      $csp_header;
+
+
+            # Standard Proxy Config
+            proxy_pass http://${IRIS_UPSTREAM_SERVER}:${IRIS_UPSTREAM_PORT};
+
+            proxy_no_cache 0;
+            proxy_cache_bypass 0;
+        }
+
         location / {
             proxy_pass  http://${IRIS_UPSTREAM_SERVER}:${IRIS_UPSTREAM_PORT};
 

source/app/__init__.py

@@ -17,6 +17,8 @@
 #  Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 import os
+import bleach
+from markupsafe import Markup
 from flask import Flask
 from flask import g
 from flask import session
@@ -88,7 +90,37 @@ def ac_current_user_has_manage_perms():
     return False
 
 
+# Allowlist for user-defined HTML custom attributes. Matches the frontend
+# do_md_filter_xss() allowlist closely so behavior is consistent across sinks.
+# Explicitly excludes script / iframe / event handlers / javascript: URLs.
+_ATTR_HTML_ALLOWED_TAGS = [
+    'a', 'abbr', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'h1', 'h2', 'h3',
+    'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong',
+    'table', 'tbody', 'td', 'th', 'thead', 'tr', 'ul',
+]
+_ATTR_HTML_ALLOWED_ATTRS = {
+    '*': ['class', 'title'],
+    'a': ['href', 'title', 'target', 'rel'],
+    'img': ['src', 'alt', 'title', 'width', 'height'],
+}
+_ATTR_HTML_ALLOWED_PROTOCOLS = ['http', 'https', 'mailto']
+
+
+def _sanitize_attribute_html(value):
+    if value is None:
+        return ''
+    cleaned = bleach.clean(
+        str(value),
+        tags=_ATTR_HTML_ALLOWED_TAGS,
+        attributes=_ATTR_HTML_ALLOWED_ATTRS,
+        protocols=_ATTR_HTML_ALLOWED_PROTOCOLS,
+        strip=True,
+    )
+    return Markup(cleaned)
+
+
 register_jinja_filters(app.jinja_env)
+app.jinja_env.filters['sanitize_attribute_html'] = _sanitize_attribute_html
 
 app.jinja_env.globals.update(user_has_perm=ac_current_user_has_permission)
 app.jinja_env.globals.update(user_has_manage_perms=ac_current_user_has_manage_perms)

source/app/blueprints/pages/login/login_routes.py

@@ -23,6 +23,7 @@
 import random
 import string
 import json
+import time
 from flask import Blueprint, flash
 from flask import redirect
 from flask import render_template
@@ -354,15 +355,98 @@ def oidc_authorise():
         return wrap_login_user(user, is_oidc=True)
 
 
+# MFA hardening constants. Values are deliberately conservative — a legitimate
+# user mistypes their token occasionally; an attacker brute-forcing 10^6 TOTP
+# codes should not be able to linearly grind them.
+_MFA_MAX_ATTEMPTS = 5
+_MFA_LOCKOUT_SECONDS = 15 * 60
+
+
+def _get_pre_mfa_user():
+    """Return the user this session just passed password auth for, or None.
+
+    The pre_mfa_user_id marker is set exclusively by wrap_login_user after a
+    successful password (or LDAP) check. Any MFA handler that runs without it
+    is being hit directly by an attacker and must be refused.
+    """
+    pre_mfa_user_id = session.get('pre_mfa_user_id')
+    if pre_mfa_user_id is None:
+        return None
+    return get_user(pre_mfa_user_id, id_key='id')
+
+
+def _clear_pre_mfa_state(preserve_lockout=False):
+    """Clear the markers that prove this session just passed password auth.
+
+    preserve_lockout: when True, keep the lockout timestamp and fail counter
+    so that an attacker cannot wipe a brute-force lockout simply by hitting
+    /login again.
+    """
+    session.pop('pre_mfa_user_id', None)
+    session.pop('pending_mfa_secret', None)
+    if not preserve_lockout:
+        session.pop('mfa_fail_count', None)
+        session.pop('mfa_lockout_until', None)
+
+
+def _mfa_is_locked_out():
+    locked_until = session.get('mfa_lockout_until')
+    if locked_until and locked_until > time.time():
+        return True
+    if locked_until and locked_until <= time.time():
+        # Lockout expired — reset the counter so the user gets a fresh window.
+        session.pop('mfa_lockout_until', None)
+        session['mfa_fail_count'] = 0
+    return False
+
+
+def _register_mfa_failure(user, reason):
+    session['mfa_fail_count'] = session.get('mfa_fail_count', 0) + 1
+    track_activity(
+        f'Failed MFA {reason} for user {user.user} (attempt {session["mfa_fail_count"]}/{_MFA_MAX_ATTEMPTS})',
+        ctx_less=True, display_in_ui=False
+    )
+    if session['mfa_fail_count'] >= _MFA_MAX_ATTEMPTS:
+        session['mfa_lockout_until'] = time.time() + _MFA_LOCKOUT_SECONDS
+        # Drop the pending-MFA marker so the attacker has to go back through
+        # password auth before they get another burst of attempts. Preserve
+        # the lockout timestamp so a fresh /login cannot wipe it.
+        _clear_pre_mfa_state(preserve_lockout=True)
+        session.pop('username', None)
+
+
 @app.route("/auth/mfa-setup", methods=["GET", "POST"])
 def mfa_setup():
-    user = retrieve_user_by_username(username=session["username"])
+    user = _get_pre_mfa_user()
+    if user is None:
+        return redirect(url_for("login.login"))
+
+    # mfa_setup is only for users who haven't completed MFA yet (fresh
+    # accounts, or admin-reset accounts where mfa_setup_complete was cleared).
+    # A user who already has MFA enrolled must go through mfa_verify — this
+    # prevents the "I know the password, let me overwrite the enrolled secret
+    # with one I control" bypass.
+    if user.mfa_setup_complete and user.mfa_secrets:
+        return redirect(url_for("mfa_verify"))
+
+    if _mfa_is_locked_out():
+        flash('Too many attempts. Please try again later.', 'danger')
+        return redirect(url_for("login.login"))
+
     form = MFASetupForm()
 
     if form.submit() and form.validate():
+
         token = form.token.data
-        mfa_secret = form.mfa_secret.data
         user_password = form.user_password.data
+        # The secret MUST come from the server-side session, never from the
+        # submitted form. Trusting form.mfa_secret let an attacker enrol a
+        # secret of their choosing and immediately log in.
+        mfa_secret = session.get('pending_mfa_secret')
+        if not mfa_secret:
+            flash('MFA setup expired. Please restart the login flow.', 'danger')
+            return redirect(url_for("login.login"))
+
         totp = pyotp.TOTP(mfa_secret)
 
         if totp.verify(token):
@@ -379,36 +463,36 @@ def mfa_setup():
                 has_valid_password = True
 
             if not has_valid_password:
-                track_activity(
-                    f"Failed MFA setup for user {user.user}. Invalid password.",
-                    ctx_less=True,
-                    display_in_ui=False,
-                )
+                _register_mfa_failure(user, 'setup (invalid password)')
                 flash("Invalid password. Please try again.", "danger")
                 return render_template("mfa_setup.html", form=form)
 
             user.mfa_secrets = mfa_secret
             user.mfa_setup_complete = True
             db.session.commit()
-            session["mfa_verified"] = False
             track_activity(
                 f"MFA setup successful for user {user.user}",
                 ctx_less=True,
                 display_in_ui=False,
             )
+            # Setup succeeded — promote this session to MFA-verified for this
+            # user and clear the pre-MFA markers. Without this, wrap_login_user
+            # would loop straight back to mfa_verify.
+            session['mfa_verified_for_user_id'] = user.id
+            _clear_pre_mfa_state()
             return wrap_login_user(user)
-        track_activity(
-            f"Failed MFA setup for user {user.user}. Invalid token.",
-            ctx_less=True,
-            display_in_ui=False,
-        )
-        flash("Invalid token or password. Please try again.", "danger")
+        else:
+            _register_mfa_failure(user, 'setup (invalid token)')
+            flash("Invalid token or password. Please try again.", "danger")
 
+    # Generate a fresh secret on every GET and stash it in the session. The
+    # client only sees the QR code and the base32 key for manual entry; it
+    # never sends the secret back.
     temp_otp_secret = pyotp.random_base32()
+    session['pending_mfa_secret'] = temp_otp_secret
     otp_uri = pyotp.TOTP(temp_otp_secret).provisioning_uri(
         user.email, issuer_name="IRIS"
     )
-    form.mfa_secret.data = temp_otp_secret
     img = qrcode.make(otp_uri)
     buf = io.BytesIO()
     img.save(buf, format="PNG")
@@ -421,11 +505,10 @@ def mfa_setup():
 
 @app.route("/auth/mfa-verify", methods=["GET", "POST"])
 def mfa_verify():
-    if "username" not in session:
+    user = _get_pre_mfa_user()
+    if user is None:
         return redirect(url_for("login.login"))
 
-    user = retrieve_user_by_username(username=session["username"])
-
     # Redirect user to MFA setup if MFA is not fully set up
     if not user.mfa_secrets or not user.mfa_setup_complete:
         track_activity(
@@ -435,6 +518,10 @@ def mfa_verify():
         )
         return redirect(url_for("mfa_setup"))
 
+    if _mfa_is_locked_out():
+        flash('Too many attempts. Please try again later.', 'danger')
+        return redirect(url_for("login.login"))
+
     form = MFASetupForm()
     form.user_password.data = "not required for verification"
 
@@ -446,19 +533,19 @@ def mfa_verify():
 
         totp = pyotp.TOTP(user.mfa_secrets)
         if totp.verify(token):
-            session.pop("username", None)
-            session["mfa_verified"] = True
             track_activity(
                 f"MFA verification successful for user {user.user}",
                 ctx_less=True,
                 display_in_ui=False,
             )
+            # Bind the MFA-verified marker to this specific user id so that a
+            # later login attempt for a different user on the same browser
+            # session cannot reuse it.
+            session['mfa_verified_for_user_id'] = user.id
+            _clear_pre_mfa_state()
             return wrap_login_user(user)
-        track_activity(
-            f"Failed MFA verification for user {user.user}. Invalid token.",
-            ctx_less=True,
-            display_in_ui=False,
-        )
-        flash("Invalid token. Please try again.", "danger")
+        else:
+            _register_mfa_failure(user, 'verification (invalid token)')
+            flash("Invalid token. Please try again.", "danger")
 
     return render_template("mfa_verify.html", form=form)

source/app/blueprints/pages/login/templates/mfa_setup.html

@@ -32,7 +32,6 @@ <h3 class="login__form_title">Your organisation requires to setup MFA</h3>
                           <div class="form-row ml-2">
                             <div class="form-group col-12">
                                 {{ form.hidden_tag() }}
-                                {{ form.mfa_secret(size=32, class="hidden", style="display:None;") }}
                                 <label for="token">Password</label>
                                 {{ form.user_password(class="form-control") }}