Bugzilla – Attachment 129576 Details for
Bug 29873
2FA: Generate QR code without exposing secret via HTTP GET
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29873: Create QR code
Bug-29873-Create-QR-code.patch (text/plain), 3.61 KB, created by
Marcel de Rooy
on 2022-01-18 15:04:06 UTC
(
hide
)
Description:
Bug 29873: Create QR code
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2022-01-18 15:04:06 UTC
Size:
3.61 KB
patch
obsolete
>From 29510356b240f3c88e482fb288a1b665569a498e Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Thu, 13 Jan 2022 14:27:36 +0000 >Subject: [PATCH] Bug 29873: Create QR code >Content-Type: text/plain; charset=utf-8 > >Instead of using deprecated Google Charts API, and exposing our >secret in a GET parameter, we generate QR data ourselves. > >Test plan: >[1] Enable two factor authentication in the prefs. >[2] Login in staff. Go to account. Select Manage 2FA. >[3] Verify that QR code is displayed. >[4] Register the QR in your authenticator app and test 2FA > by logging in again. > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Tested with Google Authenticator and FreeOTP. >--- > Koha/Auth/TwoFactorAuth.pm | 26 +++++++++++++++++++ > .../en/modules/members/two_factor_auth.tt | 2 +- > members/two_factor_auth.pl | 6 ++--- > 3 files changed, 29 insertions(+), 5 deletions(-) > >diff --git a/Koha/Auth/TwoFactorAuth.pm b/Koha/Auth/TwoFactorAuth.pm >index 81ddf06a3d..8d61d91f85 100644 >--- a/Koha/Auth/TwoFactorAuth.pm >+++ b/Koha/Auth/TwoFactorAuth.pm >@@ -17,6 +17,8 @@ package Koha::Auth::TwoFactorAuth; > > use Modern::Perl; > use Auth::GoogleAuth; >+use Imager::QRCode; >+use MIME::Base64 qw( encode_base64 ); > > use base qw( Auth::GoogleAuth ); > >@@ -66,4 +68,28 @@ sub new { > ); > } > >+=head3 qr_dataurl >+ >+=cut >+ >+sub qr_dataurl { >+ my ( $self ) = @_; >+ >+ my $otpauth = $self->qr_code( undef, undef, undef, 1); >+ # no need to pass secret, key and issuer again >+ my $qrcode = Imager::QRCode->new({ >+ size => 8, # 200 x 200 >+ margin => 2, >+ version => 1, >+ level => 'M', >+ casesensitive => 1, >+ lightcolor => Imager::Color->new(255, 255, 255), >+ darkcolor => Imager::Color->new(0, 0, 0), >+ }); >+ my $img = $qrcode->plot( $otpauth ); >+ my $data; >+ $img->write( data => \$data, type => 'png' ); >+ return "data:image/png;base64,". encode_base64( $data, q{} ); # does not contain newlines >+} >+ > 1; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >index cddac9f1b4..c954f3664b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >@@ -55,7 +55,7 @@ > <ol> > <li> > <label for="qr_code">QR code: </label> >- <img id="qr_code" src="[% qr_code_url | $raw %]" /> >+ <img id="qr_code" src="[% qr_dataurl | $raw %]" /> > </li> > <li> > <label for="pin_code">Pin code: </label> >diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl >index d5157dfd8a..067396f863 100755 >--- a/members/two_factor_auth.pl >+++ b/members/two_factor_auth.pl >@@ -86,14 +86,12 @@ if ( $op eq 'enable-2FA' ) { > my $auth = Koha::Auth::TwoFactorAuth->new( > { patron => $logged_in_user, secret => $secret } ); > >- my $qr_code_url = >- $auth->qr_code( undef, $auth->key_id, $auth->issuer ); # no need to pass secret32 >- > $template->param( > issuer => $auth->issuer, > key_id => $auth->key_id, >+ qr_dataurl => $auth->qr_dataurl, > secret32 => $auth->secret32, >- qr_code_url => $qr_code_url, >+ # IMPORTANT: get secret32 after qr_dataurl call ! > ); > $auth->clear; > $op = 'register'; >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29873
:
129402
|
129576
|
129577
|
129578
|
129579
|
129580
|
129581
|
129605
|
133216
|
133217
|
133558
|
133559
|
133659
|
133660