Username enumeration fix (#2144)

Author: gtsteffaniak

.github/workflows/regular-tests.yaml

@@ -14,7 +14,7 @@ jobs:
         with:
           go-version: 'stable'
       - working-directory: backend
-        run: go test -race -v ./...
+        run: go test -race -v ./... -timeout 30s
   lint-backend:
     runs-on: ubuntu-latest
     steps:

CHANGELOG.md

@@ -4,6 +4,9 @@ All notable changes to this project will be documented in this file. For commit
 
 ## v1.3.2-beta
 
+ **Security**:
+ - Patched Username Enumeration via Authentication Timing Side-Channel  GHSA-7789-65hx-f26w
+
  **Notes**:
  - Downloading multiple files streams the archive creation rather than using cacheDir -- thanks @janakoram (#2125) (#2130)
    - `server.maxArchiveSizeGB` deprecated since its no longer an issue with archive streaming.

backend/auth/json.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/gtsteffaniak/filebrowser/backend/common/errors"
+	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 )
 
@@ -42,15 +43,21 @@ func (auther JSONAuth) Auth(r *http.Request, userStore *users.Storage) (*users.U
 		}
 	}
 
-	user, err := userStore.Get(username)
-	if err != nil {
-		return nil, fmt.Errorf("unable to get user from store: %v", err)
+	user, getErr := userStore.Get(username)
+	var passwordHash string
+	if getErr != nil {
+		passwordHash = utils.InvalidPasswordHash
+	} else {
+		passwordHash = user.Password
 	}
-	err = users.CheckPwd(password, user.Password)
+	// always run checkPwd to prevent timing attacks
+	err = utils.CheckPwd(password, passwordHash)
 	if err != nil {
 		return nil, err
 	}
-
+	if getErr != nil {
+		return nil, fmt.Errorf("unable to get user from store: %v", err)
+	}
 	// check for OTP for password
 	if user.TOTPSecret != "" {
 		if totpCode == "" {