Attachment 123378 Details for Bug 28786 – Bug 28786: Add controller script and template

[patch] Bug 28786: Add controller script and template

Bug-28786-Add-controller-script-and-template.patch (text/plain), 10.15 KB, created by Jonathan Druart on 2021-08-02 13:14:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jonathan Druart

Created: 2021-08-02 13:14:26 UTC

Size: 10.15 KB

patch

obsolete

>From 234bbb4174bec62ca0d065f63ec51c113f1b3b83 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
>Date: Thu, 29 Jul 2021 15:25:18 +0200
>Subject: [PATCH] Bug 28786: Add controller script and template
>
>Sponsored-by: Orex Digital
>---
> .../prog/en/includes/members-toolbar.inc      |   4 +
> .../en/modules/members/two_factor_auth.tt     | 115 ++++++++++++++++++
> members/two_factor_auth.pl                    | 106 ++++++++++++++++
> 3 files changed, 225 insertions(+)
> create mode 100644 koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
> create mode 100644 members/two_factor_auth.pl
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>index 44d6f800a64..369746d1515 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
>@@ -52,6 +52,10 @@
>                     <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to set permissions" id="patronflags" href="#">Set permissions</a></li>
>                 [% END %]
> 
>+                [% IF Koha.Preference('TwoFactorAuthentication') && logged_in_user.borrowernumber == patron.borrowernumber %]
>+                    <li><a id="twofa" href="/cgi-bin/koha/members/two_factor_auth.pl">Enable Two-Factor Authentication</a></li>
>+                [% END %]
>+
>                 [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
>                     <li><a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% patron.borrowernumber | uri %]">Discharge</a></li>
>                 [% END %]
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
>new file mode 100644
>index 00000000000..999f6f9fb67
>--- /dev/null
>+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
>@@ -0,0 +1,115 @@
>+[% USE raw %]
>+[% USE Koha %]
>+[% USE Asset %]
>+[% SET footerjs = 1 %]
>+[% INCLUDE 'doc-head-open.inc' %]
>+<title>Two-Factor Authentication &rsaquo; Patrons &rsaquo; Koha</title>
>+[% INCLUDE 'doc-head-close.inc' %]
>+</head>
>+<body id="pat_two_factor_auth" class="pat">
>+[% INCLUDE 'header.inc' %]
>+[% INCLUDE 'patron-search.inc' %]
>+
>+<nav id="breadcrumbs" aria-label="Breadcrumb" class="breadcrumb">
>+    <ol>
>+        <li>
>+            <a href="/cgi-bin/koha/mainpage.pl">Home</a>
>+        </li>
>+        <li>
>+            <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
>+        </li>
>+        <li>
>+            <a href="#" aria-current="page">
>+                Manage two-factor authentication
>+            </a>
>+        </li>
>+    </ol>
>+</nav>
>+
>+<div class="main container-fluid">
>+    <div class="row">
>+        <div class="col-sm-10 col-sm-push-2">
>+            <main>
>+
>+                [% INCLUDE 'members-toolbar.inc' %]
>+
>+                [% IF op == 'register' %]
>+                    <h1>Register Two-Factor Authenticator</h1>
>+                    <div class="dialog message">
>+                        <p>We recommend cloud-based mobile authenticator apps such as Authy, Duo Mobile, and LastPass. They can restore access if you lose your hardware device.</p>
>+                        <p>Can't scan the code?</p>
>+                        <p>To add the entry manually, provide the following details to the application on your phone.</p>
>+                        <p>Account: [% issuer %]</p>
>+                        <p>Key: [% key_id %]</p>
>+                        <p>Time based: Yes</p>
>+                    </div>
>+
>+                    [% IF invalid_pin %]
>+                        <div class="dialog error">Invalid pin code</div>
>+                    [% END %]
>+                    <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
>+                        <fieldset class="rows">
>+                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
>+                            <input type="hidden" name="op" value="register-2FA" />
>+                            <input type="hidden" name="secret32" value="[% secret32 %]" />
>+                            <ol>
>+                                <li>
>+                                    <label for="qr_code">QR code: </label>
>+                                    <img id="qr_code" src="[% qr_code_url %]" />
>+                                </li>
>+                                <li>
>+                                    <label for="pin_code">Pin code: </label>
>+                                    <input type="text" id="pin_code" name="pin_code" value="" />
>+                                </li>
>+                            </ol>
>+                        </fieldset>
>+                        <fieldset class="action">
>+                            <input type="submit" value="Register with two-factor app" />
>+                            <a class="cancel" href="/cgi-bin/koha/members/two_factor_auth.pl">Cancel</a>
>+                        </fieldset>
>+                    </form>
>+                [% ELSE %]
>+                    <h1>Two-Factor Authentication</h1>
>+                    [% IF patron.auth_method == "two-factor" %]
>+                        <div class="two-factor-status">Status: Enabled</div>
>+
>+                        <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
>+                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
>+                            <input type="hidden" name="op" value="disable-2FA" />
>+                            <input type="submit" value="Disable Two-Factor Authentication" />
>+                        </form>
>+                    [% ELSE %]
>+                        <div class="two-factor-status">Status: Disabled</div>
>+
>+                        <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
>+                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
>+                            <input type="hidden" name="op" value="enable-2FA" />
>+                            <input type="submit" value="Enable Two-Factor Authentication" />
>+                        </form>
>+
>+                    [% END %]
>+                [% END %]
>+            </main>
>+        </div> 
>+
>+        <div class="col-sm-2 col-sm-pull-10">
>+            <aside>
>+                [% INCLUDE 'circ-menu.inc' %]
>+            </aside>
>+        </div> 
>+    </div> 
>+
>+
>+[% MACRO jsinclude BLOCK %]
>+    [% INCLUDE 'str/members-menu.inc' %]
>+    [% Asset.js("js/members-menu.js") | $raw %]
>+    <script>
>+        $(document).ready(function(){
>+            $(".delete").on("click", function(e){
>+                return confirmDelete(_("Are you sure you want to delete this key?"));
>+            });
>+        });
>+    </script>
>+[% END %]
>+
>+[% INCLUDE 'intranet-bottom.inc' %]
>diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl
>new file mode 100644
>index 00000000000..ce5143ea7da
>--- /dev/null
>+++ b/members/two_factor_auth.pl
>@@ -0,0 +1,106 @@
>+#!/usr/bin/perl
>+
>+# This file is part of Koha.
>+#
>+# Koha is free software; you can redistribute it and/or modify it
>+# under the terms of the GNU General Public License as published by
>+# the Free Software Foundation; either version 3 of the License, or
>+# (at your option) any later version.
>+#
>+# Koha is distributed in the hope that it will be useful, but
>+# WITHOUT ANY WARRANTY; without even the implied warranty of
>+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>+# GNU General Public License for more details.
>+#
>+# You should have received a copy of the GNU General Public License
>+# along with Koha; if not, see <http://www.gnu.org/licenses>.
>+
>+use Modern::Perl;
>+
>+use CGI;
>+
>+use C4::Auth qw( get_template_and_user );
>+use C4::Output qw( output_and_exit output_html_with_http_headers );
>+
>+use Koha::Patrons;
>+use Koha::Auth::TwoFactorAuth;
>+
>+my $cgi = CGI->new;
>+
>+my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
>+    {
>+        template_name => 'members/two_factor_auth.tt',
>+        query         => $cgi,
>+        type          => 'intranet',
>+        flagsrequired => { editcatalogue => '*' },
>+    }
>+);
>+
>+unless ( C4::Context->preference('TwoFactorAuthentication') ) {
>+    print $cgi->redirect("/cgi-bin/koha/errors/404.pl");
>+    exit;
>+}
>+
>+my $logged_in_user = Koha::Patrons->find($loggedinuser);
>+
>+my $op = $cgi->param('op') // '';
>+
>+if ( $op eq 'register-2FA' ) {
>+    my $pin_code = $cgi->param('pin_code');
>+    my $secret32 = $cgi->param('secret32');
>+    my $auth     = Koha::Auth::TwoFactorAuth::get_auth(
>+        { patron => $logged_in_user, secret32 => $secret32 } );
>+
>+    my $verified = $auth->verify(
>+        $pin_code,
>+        1,    # range
>+        $secret32,
>+        undef,    # timestamp (defaults to now)
>+        30,       # interval (default 30)
>+    );
>+
>+    if ($verified) {
>+        $logged_in_user->secret($secret32);
>+        $op = 'registered';
>+
>+        # FIXME Generate a (new?) secret
>+        $logged_in_user->auth_method('two-factor')->store;
>+    }
>+    else {
>+        $template->param( invalid_pin => 1, );
>+        $op = 'enable-2FA';
>+    }
>+}
>+
>+if ( $op eq 'enable-2FA' ) {
>+
>+    my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 );
>+    my $auth = Koha::Auth::TwoFactorAuth::get_auth(
>+        { patron => $logged_in_user, secret => $secret } );
>+
>+    my $secret32 = $auth->generate_secret32;
>+    my $qr_code_url =
>+      $auth->qr_code( $secret32, $auth->key_id, $auth->issuer, );
>+
>+    $template->param(
>+        issuer      => $auth->issuer,
>+        key_id      => $auth->key_id,
>+        secret32    => $secret32,
>+        qr_code_url => $qr_code_url,
>+    );
>+    $auth->clear;
>+    $op = 'register';
>+}
>+elsif ( $op eq 'disable-2FA' ) {
>+    $logged_in_user->auth_method('password')->store;
>+}
>+
>+$template->param(
>+    csrf_token => Koha::Token->new->generate_csrf(
>+        { session_id => scalar $cgi->cookie('CGISESSID') }
>+    ),
>+    patron => $logged_in_user,
>+    op     => $op,
>+);
>+
>+output_html_with_http_headers $cgi, $cookie, $template->output;
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 28786: 123375 | 123376 | 123377 | 123378 | 123379 | 123380 | 123381 | 123397 | 123398 | 123399 | 123400 | 123401 | 123402 | 123403 | 124569 | 124770 | 124771 | 124844 | 124845 | 124846 | 124847 | 128841 | 128842 | 129383 | 129384 | 129474 | 129521 | 129557 | 129558 | 129559 | 129560 | 129561 | 129562 | 129563 | 129564 | 129565 | 129566 | 129567 | 129568 | 129569 | 129654 | 129655 | 129656 | 129657 | 129658 | 129659 | 129660 | 129661 | 129662 | 129665 | 131940 | 131941 | 131942 | 131943 | 131944 | 131945 | 131946 | 131947 | 131948 | 131949 | 131950 | 131951 | 131952 | 131953 | 131954 | 131955 | 131956 | 131957 | 131958 | 132142 | 132143 | 132144 | 132145 | 132146 | 132147 | 132148 | 132149 | 132150 | 132153 | 132154 | 132155 | 132156 | 132157 | 133222 | 133516 | 133522 | 133531 | 133533 | 133541 | 133548 | 133643 | 133686