From f5f184174f2b6b0678b7688dc501c1c322aaa225 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 14 Jan 2022 12:42:59 +0100 Subject: [PATCH] Bug 28786: Don't pass unecessary secret to constructor This is a leftover what a misunderstanding I had at first reading the module's pod, generate_secret32 does not generate the base-32 version of the secret we passed in parameter to the constructor. --- Koha/Auth/TwoFactorAuth.pm | 6 ++---- members/two_factor_auth.pl | 3 +-- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/Koha/Auth/TwoFactorAuth.pm b/Koha/Auth/TwoFactorAuth.pm index 89320067638..19fa7e46b72 100644 --- a/Koha/Auth/TwoFactorAuth.pm +++ b/Koha/Auth/TwoFactorAuth.pm @@ -28,9 +28,7 @@ Koha::Auth::TwoFactorAuth- Koha class deal with Two factor authentication use Koha::Auth::TwoFactorAuth; -my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 ); -my $auth = Koha::Auth::TwoFactorAuth->new( - { patron => $patron, secret => $secret } ); +my $auth = Koha::Auth::TwoFactorAuth->new({ patron => $patron }); my $secret32 = $auth->generate_secret32; my $ok = $auth->verify($pin_code, 1, $secret32); @@ -40,7 +38,7 @@ It's based on Auth::GoogleAuth =head3 new - $obj = Koha::Auth::TwoFactorAuth->new({ patron => $p, secret => $s }); + $obj = Koha::Auth::TwoFactorAuth->new({ patron => $p, [secret => $secret], [secret32 => $secret32] }); =cut diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl index 2a5a996c566..159e2fd992a 100755 --- a/members/two_factor_auth.pl +++ b/members/two_factor_auth.pl @@ -74,9 +74,8 @@ if ( $op eq 'register-2FA' ) { if ( $op eq 'enable-2FA' ) { - my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 ); my $auth = Koha::Auth::TwoFactorAuth->new( - { patron => $logged_in_user, secret => $secret } ); + { patron => $logged_in_user } ); my $secret32 = $auth->generate_secret32; my $qr_code_url = -- 2.25.1