Bugzilla – Attachment 129605 Details for
Bug 29873
2FA: Generate QR code without exposing secret via HTTP GET
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 29873: (follow-up) Rename qr_dataurl
Bug-29873-follow-up-Rename-qrdataurl.patch (text/plain), 5.10 KB, created by
Marcel de Rooy
on 2022-01-19 12:59:34 UTC
(
hide
)
Description:
Bug 29873: (follow-up) Rename qr_dataurl
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2022-01-19 12:59:34 UTC
Size:
5.10 KB
patch
obsolete
>From 7334ff2ca8c3096e4f43cc6abd0d9e5928e54747 Mon Sep 17 00:00:00 2001 >From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >Date: Wed, 19 Jan 2022 12:52:29 +0000 >Subject: [PATCH] Bug 29873: (follow-up) Rename qr_dataurl >Content-Type: text/plain; charset=utf-8 > >As requested by a QA team member. >We're moving to qr_code as method name. This is the same name as >the method in the underlying base class. >Apart from one sed statement, changing to self->SUPER on one line. > >Test plan: >Can you still register, logout and login? >Run t/db_dependent/Koha/Auth/TwoFactorAuth.t > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > Koha/Auth/TwoFactorAuth.pm | 12 +++++++++--- > .../prog/en/modules/members/two_factor_auth.tt | 2 +- > members/two_factor_auth.pl | 4 ++-- > t/db_dependent/Koha/Auth/TwoFactorAuth.t | 12 ++++++------ > 4 files changed, 18 insertions(+), 12 deletions(-) > >diff --git a/Koha/Auth/TwoFactorAuth.pm b/Koha/Auth/TwoFactorAuth.pm >index 2dccdbb608..9f6639396e 100644 >--- a/Koha/Auth/TwoFactorAuth.pm >+++ b/Koha/Auth/TwoFactorAuth.pm >@@ -68,14 +68,20 @@ sub new { > ); > } > >-=head3 qr_dataurl >+=head3 qr_code >+ >+ my $image_src = $auth->qr_code; >+ >+ Wrapper around Auth::GoogleAuth::qr_code. >+ Returns the data URL to fill the src attribute of the >+ image tag on the registration form. > > =cut > >-sub qr_dataurl { >+sub qr_code { > my ( $self ) = @_; > >- my $otpauth = $self->qr_code( undef, undef, undef, 1); >+ my $otpauth = $self->SUPER::qr_code( undef, undef, undef, 1); > # no need to pass secret, key and issuer again > my $qrcode = Imager::QRCode->new({ > size => 4, >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >index c954f3664b..feb86b9586 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >@@ -55,7 +55,7 @@ > <ol> > <li> > <label for="qr_code">QR code: </label> >- <img id="qr_code" src="[% qr_dataurl | $raw %]" /> >+ <img id="qr_code" src="[% qr_code | $raw %]" /> > </li> > <li> > <label for="pin_code">Pin code: </label> >diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl >index 067396f863..b874a6f97d 100755 >--- a/members/two_factor_auth.pl >+++ b/members/two_factor_auth.pl >@@ -89,9 +89,9 @@ if ( $op eq 'enable-2FA' ) { > $template->param( > issuer => $auth->issuer, > key_id => $auth->key_id, >- qr_dataurl => $auth->qr_dataurl, >+ qr_code => $auth->qr_code, > secret32 => $auth->secret32, >- # IMPORTANT: get secret32 after qr_dataurl call ! >+ # IMPORTANT: get secret32 after qr_code call ! > ); > $auth->clear; > $op = 'register'; >diff --git a/t/db_dependent/Koha/Auth/TwoFactorAuth.t b/t/db_dependent/Koha/Auth/TwoFactorAuth.t >index 523544b710..6f76cd0749 100755 >--- a/t/db_dependent/Koha/Auth/TwoFactorAuth.t >+++ b/t/db_dependent/Koha/Auth/TwoFactorAuth.t >@@ -10,7 +10,7 @@ use Koha::Auth::TwoFactorAuth; > our $schema = Koha::Database->new->schema; > our $builder = t::lib::TestBuilder->new; > >-subtest 'qr_dataurl' => sub { >+subtest 'qr_code' => sub { > plan tests => 9; > > $schema->storage->txn_begin; >@@ -22,8 +22,8 @@ subtest 'qr_dataurl' => sub { > is( $patron->secret, undef, 'Secret still undefined' ); > my $auth = Koha::Auth::TwoFactorAuth->new({ patron => $patron }); > is( $auth->secret, undef, 'Still no secret yet as expected' ); >- # Auth::GoogleAuth will generate a secret when calling qr_dataurl >- my $img_data = $auth->qr_dataurl; >+ # Auth::GoogleAuth will generate a secret when calling qr_code >+ my $img_data = $auth->qr_code; > is( length($auth->secret32), 16, 'Secret of 16 base32 chars expected' ); > is( length($img_data) > 22, 1, 'Dataurl not empty too' ); # prefix is 22 > $auth->clear; >@@ -34,17 +34,17 @@ subtest 'qr_dataurl' => sub { > $patron->store; > > $auth = Koha::Auth::TwoFactorAuth->new({ patron => $patron }); >- $img_data = $auth->qr_dataurl; >+ $img_data = $auth->qr_code; > is( substr($img_data, 0, 22), 'data:image/png;base64,', 'Checking prefix of dataurl' ); > like( substr($img_data, 22), qr/^[a-zA-Z0-9\/=+]+$/, 'Contains base64 chars' ); >- is( $auth->qr_dataurl, $img_data, 'Repeated call' ); >+ is( $auth->qr_code, $img_data, 'Repeated call' ); > $auth->clear; > > # Changing the secret should generate different data, right? > $patron->secret('no3really3not3cracked'); # base32 > $patron->store; > $auth = Koha::Auth::TwoFactorAuth->new({ patron => $patron }); >- my $img_data02 = $auth->qr_dataurl; >+ my $img_data02 = $auth->qr_code; > is( length($img_data02) > 22, 1, 'More characters than prefix' ); > isnt( $img_data02, $img_data, 'Another secret, another image' ); > >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 29873
:
129402
|
129576
|
129577
|
129578
|
129579
|
129580
|
129581
|
129605
|
133216
|
133217
|
133558
|
133559
|
133659
|
133660