|
Lines 42-127
unless ( C4::Context->preference('TwoFactorAuthentication') ) {
Link Here
|
| 42 |
exit; |
42 |
exit; |
| 43 |
} |
43 |
} |
| 44 |
|
44 |
|
| 45 |
output_and_exit( $cgi, $cookie, $template, 'Entry encryption_key is missing in koha-conf.xml' ) |
|
|
| 46 |
if !C4::Context->config('encryption_key'); |
| 47 |
|
| 48 |
my $logged_in_user = Koha::Patrons->find($loggedinuser); |
45 |
my $logged_in_user = Koha::Patrons->find($loggedinuser); |
|
|
46 |
my $op = $cgi->param('op') // ''; |
| 49 |
|
47 |
|
| 50 |
my $op = $cgi->param('op') // ''; |
48 |
if ( !C4::Context->config('encryption_key') ) { |
| 51 |
my $csrf_pars = { |
49 |
$template->param( missing_key => 1 ); |
| 52 |
session_id => scalar $cgi->cookie('CGISESSID'), |
50 |
} |
| 53 |
token => scalar $cgi->param('csrf_token'), |
51 |
else { |
| 54 |
}; |
52 |
|
| 55 |
|
53 |
my $csrf_pars = { |
| 56 |
if ( $op eq 'register-2FA' ) { |
54 |
session_id => scalar $cgi->cookie('CGISESSID'), |
| 57 |
output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) |
55 |
token => scalar $cgi->param('csrf_token'), |
| 58 |
unless Koha::Token->new->check_csrf($csrf_pars); |
56 |
}; |
| 59 |
|
57 |
|
| 60 |
my $pin_code = $cgi->param('pin_code'); |
58 |
if ( $op eq 'register-2FA' ) { |
| 61 |
my $secret32 = $cgi->param('secret32'); |
59 |
output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) |
| 62 |
my $auth = Koha::Auth::TwoFactorAuth->new( |
60 |
unless Koha::Token->new->check_csrf($csrf_pars); |
| 63 |
{ patron => $logged_in_user, secret32 => $secret32 } ); |
61 |
|
| 64 |
|
62 |
my $pin_code = $cgi->param('pin_code'); |
| 65 |
my $verified = $auth->verify( |
63 |
my $secret32 = $cgi->param('secret32'); |
| 66 |
$pin_code, |
64 |
my $auth = Koha::Auth::TwoFactorAuth->new( |
| 67 |
1, # range |
65 |
{ patron => $logged_in_user, secret32 => $secret32 } ); |
| 68 |
$secret32, |
66 |
|
| 69 |
undef, # timestamp (defaults to now) |
67 |
my $verified = $auth->verify( |
| 70 |
30, # interval (default 30) |
68 |
$pin_code, |
| 71 |
); |
69 |
1, # range |
| 72 |
|
70 |
$secret32, |
| 73 |
if ($verified) { |
71 |
undef, # timestamp (defaults to now) |
| 74 |
# FIXME Generate a (new?) secret |
72 |
30, # interval (default 30) |
| 75 |
$logged_in_user->encode_secret($secret32); |
73 |
); |
| 76 |
$logged_in_user->auth_method('two-factor')->store; |
74 |
|
| 77 |
$op = 'registered'; |
75 |
if ($verified) { |
| 78 |
if( $logged_in_user->notice_email_address ) { |
76 |
|
| 79 |
$logged_in_user->queue_notice({ |
77 |
# FIXME Generate a (new?) secret |
| 80 |
letter_params => { |
78 |
$logged_in_user->encode_secret($secret32); |
| 81 |
module => 'members', letter_code => '2FA_ENABLE', |
79 |
$logged_in_user->auth_method('two-factor')->store; |
| 82 |
branchcode => $logged_in_user->branchcode, lang => $logged_in_user->lang, |
80 |
$op = 'registered'; |
| 83 |
tables => { branches => $logged_in_user->branchcode, borrowers => $logged_in_user->id }, |
81 |
if ( $logged_in_user->notice_email_address ) { |
| 84 |
}, |
82 |
$logged_in_user->queue_notice( |
| 85 |
message_transports => [ 'email' ], |
83 |
{ |
| 86 |
}); |
84 |
letter_params => { |
|
|
85 |
module => 'members', |
| 86 |
letter_code => '2FA_ENABLE', |
| 87 |
branchcode => $logged_in_user->branchcode, |
| 88 |
lang => $logged_in_user->lang, |
| 89 |
tables => { |
| 90 |
branches => $logged_in_user->branchcode, |
| 91 |
borrowers => $logged_in_user->id |
| 92 |
}, |
| 93 |
}, |
| 94 |
message_transports => ['email'], |
| 95 |
} |
| 96 |
); |
| 97 |
} |
| 98 |
} |
| 99 |
else { |
| 100 |
$template->param( invalid_pin => 1, ); |
| 101 |
$op = 'enable-2FA'; |
| 87 |
} |
102 |
} |
| 88 |
} |
103 |
} |
| 89 |
else { |
|
|
| 90 |
$template->param( invalid_pin => 1, ); |
| 91 |
$op = 'enable-2FA'; |
| 92 |
} |
| 93 |
} |
| 94 |
|
104 |
|
| 95 |
if ( $op eq 'enable-2FA' ) { |
105 |
if ( $op eq 'enable-2FA' ) { |
| 96 |
my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 ); |
106 |
my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 ); |
| 97 |
my $auth = Koha::Auth::TwoFactorAuth->new( |
107 |
my $auth = Koha::Auth::TwoFactorAuth->new( |
| 98 |
{ patron => $logged_in_user, secret => $secret } ); |
108 |
{ patron => $logged_in_user, secret => $secret } ); |
|
|
109 |
|
| 110 |
$template->param( |
| 111 |
issuer => $auth->issuer, |
| 112 |
key_id => $auth->key_id, |
| 113 |
qr_code => $auth->qr_code, |
| 114 |
secret32 => $auth->secret32, |
| 99 |
|
115 |
|
| 100 |
$template->param( |
|
|
| 101 |
issuer => $auth->issuer, |
| 102 |
key_id => $auth->key_id, |
| 103 |
qr_code => $auth->qr_code, |
| 104 |
secret32 => $auth->secret32, |
| 105 |
# IMPORTANT: get secret32 after qr_code call ! |
116 |
# IMPORTANT: get secret32 after qr_code call ! |
| 106 |
); |
117 |
); |
| 107 |
$auth->clear; |
118 |
$auth->clear; |
| 108 |
$op = 'register'; |
119 |
$op = 'register'; |
| 109 |
} |
120 |
} |
| 110 |
elsif ( $op eq 'disable-2FA' ) { |
121 |
elsif ( $op eq 'disable-2FA' ) { |
| 111 |
output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) |
122 |
output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) |
| 112 |
unless Koha::Token->new->check_csrf($csrf_pars); |
123 |
unless Koha::Token->new->check_csrf($csrf_pars); |
| 113 |
my $auth = Koha::Auth::TwoFactorAuth->new({ patron => $logged_in_user }); |
124 |
my $auth = |
| 114 |
$logged_in_user->secret(undef); |
125 |
Koha::Auth::TwoFactorAuth->new( { patron => $logged_in_user } ); |
| 115 |
$logged_in_user->auth_method('password')->store; |
126 |
$logged_in_user->secret(undef); |
| 116 |
if( $logged_in_user->notice_email_address ) { |
127 |
$logged_in_user->auth_method('password')->store; |
| 117 |
$logged_in_user->queue_notice({ |
128 |
if ( $logged_in_user->notice_email_address ) { |
| 118 |
letter_params => { |
129 |
$logged_in_user->queue_notice( |
| 119 |
module => 'members', letter_code => '2FA_DISABLE', |
130 |
{ |
| 120 |
branchcode => $logged_in_user->branchcode, lang => $logged_in_user->lang, |
131 |
letter_params => { |
| 121 |
tables => { branches => $logged_in_user->branchcode, borrowers => $logged_in_user->id }, |
132 |
module => 'members', |
| 122 |
}, |
133 |
letter_code => '2FA_DISABLE', |
| 123 |
message_transports => [ 'email' ], |
134 |
branchcode => $logged_in_user->branchcode, |
| 124 |
}); |
135 |
lang => $logged_in_user->lang, |
|
|
136 |
tables => { |
| 137 |
branches => $logged_in_user->branchcode, |
| 138 |
borrowers => $logged_in_user->id |
| 139 |
}, |
| 140 |
}, |
| 141 |
message_transports => ['email'], |
| 142 |
} |
| 143 |
); |
| 144 |
} |
| 125 |
} |
145 |
} |
| 126 |
} |
146 |
} |
| 127 |
|
147 |
|
| 128 |
- |
|
|