Bugzilla – Attachment 133655 Details for
Bug 28998
Encrypt borrowers.secret
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 28998: (QA follow-up) Improve output on error
Bug-28998-QA-follow-up-Improve-output-on-error.patch (text/plain), 15.04 KB, created by
Martin Renvoize (ashimema)
on 2022-04-22 09:49:48 UTC
(
hide
)
Description:
Bug 28998: (QA follow-up) Improve output on error
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2022-04-22 09:49:48 UTC
Size:
15.04 KB
patch
obsolete
>From 0af63e9f95bcb107830d822156919af9d154607d Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@ptfs-europe.com> >Date: Fri, 22 Apr 2022 10:46:06 +0100 >Subject: [PATCH] Bug 28998: (QA follow-up) Improve output on error > >This patch updates the output_and_exit call to instead pass an error >parameter in the template and use it to display the warning instead of >the rest of the page content in the 'Manage two-factor authentication' >page. > >This allows for translation and makes the page adhere to normal >practices. > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > .../en/modules/members/two_factor_auth.tt | 105 ++++++----- > members/two_factor_auth.pl | 166 ++++++++++-------- > 2 files changed, 150 insertions(+), 121 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >index feb86b9586..1c2c16cfae 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >@@ -33,60 +33,69 @@ > > [% INCLUDE 'members-toolbar.inc' %] > >- [% IF op == 'register' %] >- <h1>Register two-factor authenticator</h1> >- <div class="dialog message"> >- <p>We recommend cloud-based mobile authenticator apps such as Authy, Duo Mobile, and LastPass. They can restore access if you lose your hardware device.</p> >- <p>Can't scan the code?</p> >- <p>To add the entry manually, provide the following details to the application on your phone.</p> >- <p>Account: [% issuer | html %]</p> >- <p>Key: [% key_id | html %]</p> >- <p>Time based: Yes</p> >- </div> >+ <h1>Manage two-factor authentication</h1> > >- [% IF invalid_pin %] >- <div class="dialog error">Invalid pin code</div> >- [% END %] >- <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post"> >- <fieldset class="rows"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >- <input type="hidden" name="op" value="register-2FA" /> >- <input type="hidden" name="secret32" value="[% secret32 | html %]" /> >- <ol> >- <li> >- <label for="qr_code">QR code: </label> >- <img id="qr_code" src="[% qr_code | $raw %]" /> >- </li> >- <li> >- <label for="pin_code">Pin code: </label> >- <input type="text" id="pin_code" name="pin_code" value="" /> >- </li> >- </ol> >- </fieldset> >- <fieldset class="action"> >- <input type="submit" value="Register with two-factor app" /> >- <a class="cancel" href="/cgi-bin/koha/members/two_factor_auth.pl">Cancel</a> >- </fieldset> >- </form> >+ [% IF ( missing_key ) %] >+ <div id="error_message" class="dialog message"> >+ <p> >+ Operation cannot proceed, please define an encryption key in your configuration. >+ </p> >+ </div> > [% ELSE %] >- <h1>Two-factor authentication</h1> >- [% IF patron.auth_method == "two-factor" %] >- <div class="two-factor-status">Status: Enabled</div> > >+ [% IF op == 'register' %] >+ <div class="dialog message"> >+ <p>We recommend cloud-based mobile authenticator apps such as Authy, Duo Mobile, and LastPass. They can restore access if you lose your hardware device.</p> >+ <p>Can't scan the code?</p> >+ <p>To add the entry manually, provide the following details to the application on your phone.</p> >+ <p>Account: [% issuer | html %]</p> >+ <p>Key: [% key_id | html %]</p> >+ <p>Time based: Yes</p> >+ </div> >+ >+ [% IF invalid_pin %] >+ <div class="dialog error">Invalid pin code</div> >+ [% END %] > <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >- <input type="hidden" name="op" value="disable-2FA" /> >- <input type="submit" value="Disable two-factor authentication" /> >+ <fieldset class="rows"> >+ <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ <input type="hidden" name="op" value="register-2FA" /> >+ <input type="hidden" name="secret32" value="[% secret32 | html %]" /> >+ <ol> >+ <li> >+ <label for="qr_code">QR code: </label> >+ <img id="qr_code" src="[% qr_code | $raw %]" /> >+ </li> >+ <li> >+ <label for="pin_code">Pin code: </label> >+ <input type="text" id="pin_code" name="pin_code" value="" /> >+ </li> >+ </ol> >+ </fieldset> >+ <fieldset class="action"> >+ <input type="submit" value="Register with two-factor app" /> >+ <a class="cancel" href="/cgi-bin/koha/members/two_factor_auth.pl">Cancel</a> >+ </fieldset> > </form> > [% ELSE %] >- <div class="two-factor-status">Status: Disabled</div> >- >- <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post"> >- <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >- <input type="hidden" name="op" value="enable-2FA" /> >- <input type="submit" value="Enable two-factor authentication" /> >- </form> >- >+ [% IF patron.auth_method == "two-factor" %] >+ <div class="two-factor-status">Status: Enabled</div> >+ >+ <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post"> >+ <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ <input type="hidden" name="op" value="disable-2FA" /> >+ <input type="submit" value="Disable two-factor authentication" /> >+ </form> >+ [% ELSE %] >+ <div class="two-factor-status">Status: Disabled</div> >+ >+ <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post"> >+ <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" /> >+ <input type="hidden" name="op" value="enable-2FA" /> >+ <input type="submit" value="Enable two-factor authentication" /> >+ </form> >+ >+ [% END %] > [% END %] > [% END %] > </main> >diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl >index 14040dc1ec..71ca71da57 100755 >--- a/members/two_factor_auth.pl >+++ b/members/two_factor_auth.pl >@@ -42,86 +42,106 @@ unless ( C4::Context->preference('TwoFactorAuthentication') ) { > exit; > } > >-output_and_exit( $cgi, $cookie, $template, 'Entry encryption_key is missing in koha-conf.xml' ) >- if !C4::Context->config('encryption_key'); >- > my $logged_in_user = Koha::Patrons->find($loggedinuser); >+my $op = $cgi->param('op') // ''; > >-my $op = $cgi->param('op') // ''; >-my $csrf_pars = { >- session_id => scalar $cgi->cookie('CGISESSID'), >- token => scalar $cgi->param('csrf_token'), >-}; >- >-if ( $op eq 'register-2FA' ) { >- output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf($csrf_pars); >- >- my $pin_code = $cgi->param('pin_code'); >- my $secret32 = $cgi->param('secret32'); >- my $auth = Koha::Auth::TwoFactorAuth->new( >- { patron => $logged_in_user, secret32 => $secret32 } ); >- >- my $verified = $auth->verify( >- $pin_code, >- 1, # range >- $secret32, >- undef, # timestamp (defaults to now) >- 30, # interval (default 30) >- ); >- >- if ($verified) { >- # FIXME Generate a (new?) secret >- $logged_in_user->encode_secret($secret32); >- $logged_in_user->auth_method('two-factor')->store; >- $op = 'registered'; >- if( $logged_in_user->notice_email_address ) { >- $logged_in_user->queue_notice({ >- letter_params => { >- module => 'members', letter_code => '2FA_ENABLE', >- branchcode => $logged_in_user->branchcode, lang => $logged_in_user->lang, >- tables => { branches => $logged_in_user->branchcode, borrowers => $logged_in_user->id }, >- }, >- message_transports => [ 'email' ], >- }); >+if ( !C4::Context->config('encryption_key') ) { >+ $template->param( missing_key => 1 ); >+} >+else { >+ >+ my $csrf_pars = { >+ session_id => scalar $cgi->cookie('CGISESSID'), >+ token => scalar $cgi->param('csrf_token'), >+ }; >+ >+ if ( $op eq 'register-2FA' ) { >+ output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) >+ unless Koha::Token->new->check_csrf($csrf_pars); >+ >+ my $pin_code = $cgi->param('pin_code'); >+ my $secret32 = $cgi->param('secret32'); >+ my $auth = Koha::Auth::TwoFactorAuth->new( >+ { patron => $logged_in_user, secret32 => $secret32 } ); >+ >+ my $verified = $auth->verify( >+ $pin_code, >+ 1, # range >+ $secret32, >+ undef, # timestamp (defaults to now) >+ 30, # interval (default 30) >+ ); >+ >+ if ($verified) { >+ >+ # FIXME Generate a (new?) secret >+ $logged_in_user->encode_secret($secret32); >+ $logged_in_user->auth_method('two-factor')->store; >+ $op = 'registered'; >+ if ( $logged_in_user->notice_email_address ) { >+ $logged_in_user->queue_notice( >+ { >+ letter_params => { >+ module => 'members', >+ letter_code => '2FA_ENABLE', >+ branchcode => $logged_in_user->branchcode, >+ lang => $logged_in_user->lang, >+ tables => { >+ branches => $logged_in_user->branchcode, >+ borrowers => $logged_in_user->id >+ }, >+ }, >+ message_transports => ['email'], >+ } >+ ); >+ } >+ } >+ else { >+ $template->param( invalid_pin => 1, ); >+ $op = 'enable-2FA'; > } > } >- else { >- $template->param( invalid_pin => 1, ); >- $op = 'enable-2FA'; >- } >-} > >-if ( $op eq 'enable-2FA' ) { >- my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 ); >- my $auth = Koha::Auth::TwoFactorAuth->new( >- { patron => $logged_in_user, secret => $secret } ); >+ if ( $op eq 'enable-2FA' ) { >+ my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 ); >+ my $auth = Koha::Auth::TwoFactorAuth->new( >+ { patron => $logged_in_user, secret => $secret } ); >+ >+ $template->param( >+ issuer => $auth->issuer, >+ key_id => $auth->key_id, >+ qr_code => $auth->qr_code, >+ secret32 => $auth->secret32, > >- $template->param( >- issuer => $auth->issuer, >- key_id => $auth->key_id, >- qr_code => $auth->qr_code, >- secret32 => $auth->secret32, > # IMPORTANT: get secret32 after qr_code call ! >- ); >- $auth->clear; >- $op = 'register'; >-} >-elsif ( $op eq 'disable-2FA' ) { >- output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) >- unless Koha::Token->new->check_csrf($csrf_pars); >- my $auth = Koha::Auth::TwoFactorAuth->new({ patron => $logged_in_user }); >- $logged_in_user->secret(undef); >- $logged_in_user->auth_method('password')->store; >- if( $logged_in_user->notice_email_address ) { >- $logged_in_user->queue_notice({ >- letter_params => { >- module => 'members', letter_code => '2FA_DISABLE', >- branchcode => $logged_in_user->branchcode, lang => $logged_in_user->lang, >- tables => { branches => $logged_in_user->branchcode, borrowers => $logged_in_user->id }, >- }, >- message_transports => [ 'email' ], >- }); >+ ); >+ $auth->clear; >+ $op = 'register'; >+ } >+ elsif ( $op eq 'disable-2FA' ) { >+ output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' ) >+ unless Koha::Token->new->check_csrf($csrf_pars); >+ my $auth = >+ Koha::Auth::TwoFactorAuth->new( { patron => $logged_in_user } ); >+ $logged_in_user->secret(undef); >+ $logged_in_user->auth_method('password')->store; >+ if ( $logged_in_user->notice_email_address ) { >+ $logged_in_user->queue_notice( >+ { >+ letter_params => { >+ module => 'members', >+ letter_code => '2FA_DISABLE', >+ branchcode => $logged_in_user->branchcode, >+ lang => $logged_in_user->lang, >+ tables => { >+ branches => $logged_in_user->branchcode, >+ borrowers => $logged_in_user->id >+ }, >+ }, >+ message_transports => ['email'], >+ } >+ ); >+ } > } > } > >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 28998
:
124772
|
124773
|
124774
|
133291
|
133317
|
133318
|
133319
|
133320
|
133321
|
133322
|
133323
|
133523
|
133524
|
133525
|
133526
|
133527
|
133528
|
133529
|
133580
|
133581
|
133582
|
133583
|
133584
|
133585
|
133586
|
133588
|
133619
|
133620
|
133621
|
133622
|
133623
|
133624
|
133625
|
133626
|
133627
|
133628
|
133629
|
133631
|
133632
|
133633
|
133634
|
133635
|
133636
|
133637
|
133638
|
133639
|
133640
|
133641
|
133642
|
133645
|
133646
|
133647
|
133648
|
133649
|
133650
|
133651
|
133652
|
133653
|
133654
| 133655 |
134636
|
134637
|
134671