Fixed Multi-Factor Authentication bypass vulnerability (CVE-2024-4215). #7425

web/pgadmin/tools/backup/__init__.py

@@ -16,7 +16,8 @@ import operator
 from flask import render_template, request, current_app, \
     url_for, Response
 from flask_babel import gettext
-from flask_security import login_required, current_user
+from flask_security import current_user
+from pgadmin.user_login_check import pga_login_required
 from pgadmin.misc.bgprocess.processes import BatchProcess, IProcessDesc
 from pgadmin.utils import PgAdminModule, get_storage_directory, html, \
     fs_short_path, document_dir, does_utility_exist, get_server, \
@@ -177,13 +178,13 @@ class BackupMessage(IProcessDesc):
 
 
 @blueprint.route("/")
-@login_required
+@pga_login_required
 def index():
     return bad_request(errormsg=gettext("This URL cannot be called directly."))
 
 
 @blueprint.route("/backup.js")
-@login_required
+@pga_login_required
 def script():
     """render own javascript"""
     return Response(
@@ -391,7 +392,7 @@ def _get_args_params_values(data, conn, backup_obj_type, backup_file, server,
 @blueprint.route(
     '/job/<int:sid>/object', methods=['POST'], endpoint='create_object_job'
 )
-@login_required
+@pga_login_required
 def create_backup_objects_job(sid):
     """
     Args:
@@ -498,7 +499,7 @@ def create_backup_objects_job(sid):
 @blueprint.route(
     '/utility_exists/<int:sid>/<backup_obj_type>', endpoint='utility_exists'
 )
-@login_required
+@pga_login_required
 def check_utility_exists(sid, backup_obj_type):
     """
     This function checks the utility file exist on the given path.
@@ -540,7 +541,7 @@ def check_utility_exists(sid, backup_obj_type):
 @blueprint.route(
     '/objects/<int:sid>/<int:did>/<int:scid>', endpoint='schema_objects'
 )
-@login_required
+@pga_login_required
 def objects(sid, did, scid=None):
     """
     This function returns backup objects