From 3e90ed93a5c0ff976281f801fff985bd67fbc174 Mon Sep 17 00:00:00 2001
From: Thiago Charneski <135767191+thiagoaugustocosta@users.noreply.github.com>
Date: Sun, 13 Sep 2026 00:10:21 +0000
Subject: [PATCH] Fix insecure password recovery

---
 .../src/api/routes/ChangePassword.go          |  2 +-
 .../src/api/routes/RecoveryPassword.go        | 42 ++-----------------
 .../src/api/routes/User.go                    | 24 ++---------
 .../super-recovery-password/src/api/server.go |  2 -
 4 files changed, 8 insertions(+), 62 deletions(-)

diff --git a/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/ChangePassword.go b/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/ChangePassword.go
index 45dc4cb0b..d97b99f9f 100644
--- a/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/ChangePassword.go
+++ b/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/ChangePassword.go
@@ -14,7 +14,7 @@ import (
 func ChangePassword(c echo.Context) (err error) {
 	user := c.Get("user").(*jwt.Token)
 	claims := user.Claims.(*services.JwtCustomClaims)
-	if claims.Recovery != true {
+	if claims.Recovery == true {
 		return c.JSON(http.StatusOK, echo.Map{
 			"message": "invalid token",
 		})
diff --git a/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/RecoveryPassword.go b/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/RecoveryPassword.go
index b5d9acf6e..a0aaa3b41 100644
--- a/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/RecoveryPassword.go
+++ b/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/RecoveryPassword.go
@@ -1,45 +1,11 @@
 package routes
 
-import (
-	"api/database"
-	"api/services"
-	"api/types"
-	"fmt"
-	"net/http"
-	"strings"
+import ("net/http"
 
 	"github.com/labstack/echo"
 )
-
 func RecoveryPassword(c echo.Context) (err error) {
-	u := new(types.RecoveryPasswordAnswers)
-	if err = c.Bind(u); err != nil {
-		return
-	}
-	u.Login = strings.ToLower(u.Login)
-	recoveryPasswordAnswers := types.RecoveryPasswordAnswers{
-		Login:        u.Login,
-		FirstAnswer:  u.FirstAnswer,
-		SecondAnswer: u.SecondAnswer,
-	}
-
-	answers, err := database.RecoveryPassword(recoveryPasswordAnswers.Login, recoveryPasswordAnswers.FirstAnswer, recoveryPasswordAnswers.SecondAnswer)
-	if err != nil {
-		return c.JSON(http.StatusConflict, echo.Map{"message": "incorrect answers!"})
-	}
-
-	if answers.FirstAnswer != recoveryPasswordAnswers.FirstAnswer || answers.SecondAnswer != recoveryPasswordAnswers.SecondAnswer {
-		return c.JSON(http.StatusConflict, echo.Map{"message": "incorrect answers!"})
-	}
-
-	token, err := services.GenerateJwt(recoveryPasswordAnswers.Login, true)
-	if err != nil {
-		return c.JSON(http.StatusUnauthorized, echo.Map{
-			"token": "Error to generate token.",
-		})
-	}
-	fmt.Println(token)
-	return c.JSON(http.StatusOK, echo.Map{
-		"token": token,
+	return c.JSON(http.StatusForbidden, echo.Map{
+		"message": "password recovery is disabled",
 	})
-}
+}
\ No newline at end of file
diff --git a/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/User.go b/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/User.go
index b7c770f78..da33a4217 100644
--- a/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/User.go
+++ b/owasp-top10-2021-apps/a4/super-recovery-password/src/api/routes/User.go
@@ -1,30 +1,12 @@
 package routes
 
 import (
-	"api/database"
-	"api/types"
 	"net/http"
-	"strings"
-
 	"github.com/labstack/echo"
 )
 
 func UserInfo(c echo.Context) (err error) {
-	u := new(types.User)
-	if err = c.Bind(u); err != nil {
-		return
-	}
-	u.Login = strings.ToLower(u.Login)
-	userQuestions, err := database.UserQuestions(u.Login)
-	if err != nil {
-		return c.JSON(http.StatusBadRequest, echo.Map{
-			"message": "invalid login",
-		})
-	}
-
-	return c.JSON(http.StatusOK, echo.Map{
-		"login":          userQuestions.Login,
-		"firstQuestion":  userQuestions.FirstQuestion,
-		"secondQuestion": userQuestions.SecondQuestion,
+	return c.JSON(http.StatusForbidden, echo.Map{
+		"message": "user information is not available",
 	})
-}
+}
\ No newline at end of file
diff --git a/owasp-top10-2021-apps/a4/super-recovery-password/src/api/server.go b/owasp-top10-2021-apps/a4/super-recovery-password/src/api/server.go
index adc5ca981..88a52962c 100644
--- a/owasp-top10-2021-apps/a4/super-recovery-password/src/api/server.go
+++ b/owasp-top10-2021-apps/a4/super-recovery-password/src/api/server.go
@@ -32,10 +32,8 @@ func main() {
 	}))
 
 	e.GET("/healthcheck", routes.Healthcheck)
-	e.POST("/userinfo", routes.UserInfo)
 	e.POST("/register", routes.Register)
 	e.POST("/login", routes.Login)
-	e.POST("/recovery", routes.RecoveryPassword)
 
 	r := e.Group("/reset")
 	config := middleware.JWTConfig{