From 29510356b240f3c88e482fb288a1b665569a498e Mon Sep 17 00:00:00 2001 From: Marcel de Rooy Date: Thu, 13 Jan 2022 14:27:36 +0000 Subject: [PATCH] Bug 29873: Create QR code Content-Type: text/plain; charset=utf-8 Instead of using deprecated Google Charts API, and exposing our secret in a GET parameter, we generate QR data ourselves. Test plan: [1] Enable two factor authentication in the prefs. [2] Login in staff. Go to account. Select Manage 2FA. [3] Verify that QR code is displayed. [4] Register the QR in your authenticator app and test 2FA by logging in again. Signed-off-by: Marcel de Rooy Tested with Google Authenticator and FreeOTP. --- Koha/Auth/TwoFactorAuth.pm | 26 +++++++++++++++++++ .../en/modules/members/two_factor_auth.tt | 2 +- members/two_factor_auth.pl | 6 ++--- 3 files changed, 29 insertions(+), 5 deletions(-) diff --git a/Koha/Auth/TwoFactorAuth.pm b/Koha/Auth/TwoFactorAuth.pm index 81ddf06a3d..8d61d91f85 100644 --- a/Koha/Auth/TwoFactorAuth.pm +++ b/Koha/Auth/TwoFactorAuth.pm @@ -17,6 +17,8 @@ package Koha::Auth::TwoFactorAuth; use Modern::Perl; use Auth::GoogleAuth; +use Imager::QRCode; +use MIME::Base64 qw( encode_base64 ); use base qw( Auth::GoogleAuth ); @@ -66,4 +68,28 @@ sub new { ); } +=head3 qr_dataurl + +=cut + +sub qr_dataurl { + my ( $self ) = @_; + + my $otpauth = $self->qr_code( undef, undef, undef, 1); + # no need to pass secret, key and issuer again + my $qrcode = Imager::QRCode->new({ + size => 8, # 200 x 200 + margin => 2, + version => 1, + level => 'M', + casesensitive => 1, + lightcolor => Imager::Color->new(255, 255, 255), + darkcolor => Imager::Color->new(0, 0, 0), + }); + my $img = $qrcode->plot( $otpauth ); + my $data; + $img->write( data => \$data, type => 'png' ); + return "data:image/png;base64,". encode_base64( $data, q{} ); # does not contain newlines +} + 1; diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt index cddac9f1b4..c954f3664b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt @@ -55,7 +55,7 @@
  1. - +
  2. diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl index d5157dfd8a..067396f863 100755 --- a/members/two_factor_auth.pl +++ b/members/two_factor_auth.pl @@ -86,14 +86,12 @@ if ( $op eq 'enable-2FA' ) { my $auth = Koha::Auth::TwoFactorAuth->new( { patron => $logged_in_user, secret => $secret } ); - my $qr_code_url = - $auth->qr_code( undef, $auth->key_id, $auth->issuer ); # no need to pass secret32 - $template->param( issuer => $auth->issuer, key_id => $auth->key_id, + qr_dataurl => $auth->qr_dataurl, secret32 => $auth->secret32, - qr_code_url => $qr_code_url, + # IMPORTANT: get secret32 after qr_dataurl call ! ); $auth->clear; $op = 'register'; -- 2.20.1