Attachment 133287 Details for Bug 29894 – Bug 29894: Clear secret when disabling 2FA

[patch] Bug 29894: Clear secret when disabling 2FA

Bug-29894-Clear-secret-when-disabling-2FA.patch (text/plain), 1.60 KB, created by Marcel de Rooy on 2022-04-14 06:27:35 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2022-04-14 06:27:35 UTC

Size: 1.60 KB

patch

obsolete

>From 21a8100dc6c4dd1759a4384ff3766bc0e1bd4a80 Mon Sep 17 00:00:00 2001
>From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>Date: Thu, 20 Jan 2022 15:07:30 +0000
>Subject: [PATCH] Bug 29894: Clear secret when disabling 2FA
>Content-Type: text/plain; charset=utf-8
>
>Test plan:
>Deregister 2FA for patron.
>Check if secret is empty in borrowers.secret.
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> members/two_factor_auth.pl | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)
>
>diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl
>index 0cf6843b84..7b8a1a434b 100755
>--- a/members/two_factor_auth.pl
>+++ b/members/two_factor_auth.pl
>@@ -68,11 +68,10 @@ if ( $op eq 'register-2FA' ) {
>     );
> 
>     if ($verified) {
>-        $logged_in_user->secret($secret32);
>-        $op = 'registered';
>-
>         # FIXME Generate a (new?) secret
>+        $logged_in_user->secret($secret32);
>         $logged_in_user->auth_method('two-factor')->store;
>+        $op = 'registered';
>     }
>     else {
>         $template->param( invalid_pin => 1, );
>@@ -81,7 +80,6 @@ if ( $op eq 'register-2FA' ) {
> }
> 
> if ( $op eq 'enable-2FA' ) {
>-
>     my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 );
>     my $auth = Koha::Auth::TwoFactorAuth->new(
>         { patron => $logged_in_user, secret => $secret } );
>@@ -99,6 +97,7 @@ if ( $op eq 'enable-2FA' ) {
> elsif ( $op eq 'disable-2FA' ) {
>     output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
>         unless Koha::Token->new->check_csrf($csrf_pars);
>+    $logged_in_user->secret(undef);
>     $logged_in_user->auth_method('password')->store;
> }
> 
>-- 
>2.20.1

Actions: View | Diff | Splinter Review

Attachments on bug 29894: 129538 | 129539 | 129669 | 129670 | 129689 | 129690 | 129691 | 129692 | 133286 | 133287 | 133288 | 133289 | 133562 | 133563 | 133564 | 133565 | 133566 | 133618 | 133661 | 133662 | 133663 | 133664 | 133665 | 133666 | 133667