@@ -, +, @@ TOTP --- C4/Auth.pm | 2 +- Koha/Auth/TwoFactorAuth.pm | 21 +++++++++++++++++++++ Koha/REST/V1/TwoFactorAuth.pm | 2 +- debian/templates/koha-conf-site.xml.in | 2 ++ etc/koha-conf.xml | 2 ++ 5 files changed, 27 insertions(+), 2 deletions(-) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -883,7 +883,7 @@ sub checkauth { { my $patron = Koha::Patrons->find( { userid => $userid } ); my $auth = Koha::Auth::TwoFactorAuth->new( { patron => $patron } ); - my $verified = $auth->verify($otp_token, 1); + my $verified = $auth->verify($otp_token); $auth->clear; if ( $verified ) { # The token is correct, the user is fully logged in! --- a/Koha/Auth/TwoFactorAuth.pm +++ a/Koha/Auth/TwoFactorAuth.pm @@ -19,6 +19,7 @@ use Modern::Perl; use GD::Barcode; use MIME::Base64 qw( encode_base64 ); +use C4::Context; use C4::Letters; use Koha::Exceptions; use Koha::Exceptions::Patron; @@ -106,4 +107,24 @@ sub qr_code { return "data:image/png;base64,". encode_base64( $data, q{} ); # does not contain newlines } +=head3 verify + + my $verified = $auth->verify($otp_token); + + Replacement for Auth::GoogleAuth::verify. + This uses a system wide default for range. + +=cut + +sub verify { + my ( $self, $code, $range, $secret32, $timestamp, $interval ) = @_; + if ( !defined $range ) { + my $mfa_range = C4::Context->config('mfa_range') ? int( C4::Context->config('mfa_range') ) : 1; + if ($mfa_range) { + $range = $mfa_range; + } + } + return $self->SUPER::verify( $code, $range, $secret32, $timestamp, $interval ); +} + 1; --- a/Koha/REST/V1/TwoFactorAuth.pm +++ a/Koha/REST/V1/TwoFactorAuth.pm @@ -139,7 +139,7 @@ sub verification { my $verified = $auth->verify( $pin_code, - 1, # range + undef, # range (default to 1 or mfa_range in koha-conf.xml) $secret32, undef, # timestamp (defaults to now) 30, # interval (default 30) --- a/debian/templates/koha-conf-site.xml.in +++ a/debian/templates/koha-conf-site.xml.in @@ -480,5 +480,7 @@ __END_SRU_PUBLICSERVER__ + 1 + --- a/etc/koha-conf.xml +++ a/etc/koha-conf.xml @@ -291,5 +291,7 @@ + 1 + --