|
Lines 24-29
use C4::Output qw( output_and_exit output_html_with_http_headers );
Link Here
|
| 24 |
|
24 |
|
| 25 |
use Koha::Patrons; |
25 |
use Koha::Patrons; |
| 26 |
use Koha::Auth::TwoFactorAuth; |
26 |
use Koha::Auth::TwoFactorAuth; |
|
|
27 |
use Koha::Token; |
| 27 |
|
28 |
|
| 28 |
my $cgi = CGI->new; |
29 |
my $cgi = CGI->new; |
| 29 |
|
30 |
|
|
Lines 44-51
unless ( C4::Context->preference('TwoFactorAuthentication') ) {
Link Here
|
| 44 |
my $logged_in_user = Koha::Patrons->find($loggedinuser); |
45 |
my $logged_in_user = Koha::Patrons->find($loggedinuser); |
| 45 |
|
46 |
|
| 46 |
my $op = $cgi->param('op') // ''; |
47 |
my $op = $cgi->param('op') // ''; |
|
|
48 |
my $csrf_pars = { |
| 49 |
session_id => scalar $cgi->cookie('CGISESSID'), |
| 50 |
token => scalar $cgi->param('csrf_token'), |
| 51 |
}; |
| 47 |
|
52 |
|
| 48 |
if ( $op eq 'register-2FA' ) { |
53 |
if ( $op eq 'register-2FA' ) { |
|
|
54 |
output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) |
| 55 |
unless Koha::Token->new->check_csrf($csrf_pars); |
| 56 |
|
| 49 |
my $pin_code = $cgi->param('pin_code'); |
57 |
my $pin_code = $cgi->param('pin_code'); |
| 50 |
my $secret32 = $cgi->param('secret32'); |
58 |
my $secret32 = $cgi->param('secret32'); |
| 51 |
my $auth = Koha::Auth::TwoFactorAuth->new( |
59 |
my $auth = Koha::Auth::TwoFactorAuth->new( |
|
Lines 91-96
if ( $op eq 'enable-2FA' ) {
Link Here
|
| 91 |
$op = 'register'; |
99 |
$op = 'register'; |
| 92 |
} |
100 |
} |
| 93 |
elsif ( $op eq 'disable-2FA' ) { |
101 |
elsif ( $op eq 'disable-2FA' ) { |
|
|
102 |
output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) |
| 103 |
unless Koha::Token->new->check_csrf($csrf_pars); |
| 94 |
$logged_in_user->auth_method('password')->store; |
104 |
$logged_in_user->auth_method('password')->store; |
| 95 |
} |
105 |
} |
| 96 |
|
106 |
|
| 97 |
- |
|
|