Bugzilla – Attachment 129668 Details for
Bug 28984
Unify MARC21 ISBN/ISSN handling in XSLT in the OPAC
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 28984: Clear secret when disabling 2FA
Bug-28984-Clear-secret-when-disabling-2FA.patch (text/plain), 1.60 KB, created by
Marcel de Rooy
on 2022-01-20 15:17:47 UTC
(
hide
)
Description:
Bug 28984: Clear secret when disabling 2FA
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2022-01-20 15:17:47 UTC
Size:
1.60 KB
patch
obsolete
>From 4f6f7b97c0c545c6329eb83f9b14b98cd2b8878b Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Thu, 20 Jan 2022 15:07:30 +0000 >Subject: [PATCH] Bug 28984: Clear secret when disabling 2FA >Content-Type: text/plain; charset=utf-8 > >Test plan: >Deregister 2FA for patron. >Check if secret is empty in borrowers.secret. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > members/two_factor_auth.pl | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) > >diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl >index 0cf6843b84..7b8a1a434b 100755 >--- a/members/two_factor_auth.pl >+++ b/members/two_factor_auth.pl >@@ -68,11 +68,10 @@ if ( $op eq 'register-2FA' ) { > ); > > if ($verified) { >- $logged_in_user->secret($secret32); >- $op = 'registered'; >- > # FIXME Generate a (new?) secret >+ $logged_in_user->secret($secret32); > $logged_in_user->auth_method('two-factor')->store; >+ $op = 'registered'; > } > else { > $template->param( invalid_pin => 1, ); >@@ -81,7 +80,6 @@ if ( $op eq 'register-2FA' ) { > } > > if ( $op eq 'enable-2FA' ) { >- > my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 ); > my $auth = Koha::Auth::TwoFactorAuth->new( > { patron => $logged_in_user, secret => $secret } ); >@@ -99,6 +97,7 @@ if ( $op eq 'enable-2FA' ) { > elsif ( $op eq 'disable-2FA' ) { > output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) > unless Koha::Token->new->check_csrf($csrf_pars); >+ $logged_in_user->secret(undef); > $logged_in_user->auth_method('password')->store; > } > >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 28984
:
129667
|
129668