Bugzilla – Attachment 129670 Details for
Bug 29894
2FA: Add few validations, clear secret, send register notice
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29894: Clear secret when disabling 2FA
Bug-29894-Clear-secret-when-disabling-2FA.patch (text/plain), 1.60 KB, created by
Marcel de Rooy
on 2022-01-20 15:21:01 UTC
(
hide
)
Description:
Bug 29894: Clear secret when disabling 2FA
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2022-01-20 15:21:01 UTC
Size:
1.60 KB
patch
obsolete
>From 236ec5ff4006b30903e5afc1c2513205bffaa38d Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Thu, 20 Jan 2022 15:07:30 +0000 >Subject: [PATCH] Bug 29894: Clear secret when disabling 2FA >Content-Type: text/plain; charset=utf-8 > >Test plan: >Deregister 2FA for patron. >Check if secret is empty in borrowers.secret. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > members/two_factor_auth.pl | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) > >diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl >index 0cf6843b84..7b8a1a434b 100755 >--- a/members/two_factor_auth.pl >+++ b/members/two_factor_auth.pl >@@ -68,11 +68,10 @@ if ( $op eq 'register-2FA' ) { > ); > > if ($verified) { >- $logged_in_user->secret($secret32); >- $op = 'registered'; >- > # FIXME Generate a (new?) secret >+ $logged_in_user->secret($secret32); > $logged_in_user->auth_method('two-factor')->store; >+ $op = 'registered'; > } > else { > $template->param( invalid_pin => 1, ); >@@ -81,7 +80,6 @@ if ( $op eq 'register-2FA' ) { > } > > if ( $op eq 'enable-2FA' ) { >- > my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 ); > my $auth = Koha::Auth::TwoFactorAuth->new( > { patron => $logged_in_user, secret => $secret } ); >@@ -99,6 +97,7 @@ if ( $op eq 'enable-2FA' ) { > elsif ( $op eq 'disable-2FA' ) { > output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) > unless Koha::Token->new->check_csrf($csrf_pars); >+ $logged_in_user->secret(undef); > $logged_in_user->auth_method('password')->store; > } > >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29894
:
129538
|
129539
|
129669
|
129670
|
129689
|
129690
|
129691
|
129692
|
133286
|
133287
|
133288
|
133289
|
133562
|
133563
|
133564
|
133565
|
133566
|
133618
|
133661
|
133662
|
133663
|
133664
|
133665
|
133666
|
133667