@@ -, +, @@
TOTP
---
C4/Auth.pm | 2 +-
Koha/Auth/TwoFactorAuth.pm | 21 +++++++++++++++++++++
Koha/REST/V1/TwoFactorAuth.pm | 2 +-
debian/templates/koha-conf-site.xml.in | 2 ++
etc/koha-conf.xml | 2 ++
5 files changed, 27 insertions(+), 2 deletions(-)
--- a/C4/Auth.pm
+++ a/C4/Auth.pm
@@ -883,7 +883,7 @@ sub checkauth {
{
my $patron = Koha::Patrons->find( { userid => $userid } );
my $auth = Koha::Auth::TwoFactorAuth->new( { patron => $patron } );
- my $verified = $auth->verify($otp_token, 1);
+ my $verified = $auth->verify($otp_token);
$auth->clear;
if ( $verified ) {
# The token is correct, the user is fully logged in!
--- a/Koha/Auth/TwoFactorAuth.pm
+++ a/Koha/Auth/TwoFactorAuth.pm
@@ -19,6 +19,7 @@ use Modern::Perl;
use GD::Barcode;
use MIME::Base64 qw( encode_base64 );
+use C4::Context;
use C4::Letters;
use Koha::Exceptions;
use Koha::Exceptions::Patron;
@@ -106,4 +107,24 @@ sub qr_code {
return "data:image/png;base64,". encode_base64( $data, q{} ); # does not contain newlines
}
+=head3 verify
+
+ my $verified = $auth->verify($otp_token);
+
+ Replacement for Auth::GoogleAuth::verify.
+ This uses a system wide default for range.
+
+=cut
+
+sub verify {
+ my ( $self, $code, $range, $secret32, $timestamp, $interval ) = @_;
+ if ( !defined $range ) {
+ my $mfa_range = C4::Context->config('mfa_range') ? int( C4::Context->config('mfa_range') ) : 1;
+ if ($mfa_range) {
+ $range = $mfa_range;
+ }
+ }
+ return $self->SUPER::verify( $code, $range, $secret32, $timestamp, $interval );
+}
+
1;
--- a/Koha/REST/V1/TwoFactorAuth.pm
+++ a/Koha/REST/V1/TwoFactorAuth.pm
@@ -139,7 +139,7 @@ sub verification {
my $verified = $auth->verify(
$pin_code,
- 1, # range
+ undef, # range (default to 1 or mfa_range in koha-conf.xml)
$secret32,
undef, # timestamp (defaults to now)
30, # interval (default 30)
--- a/debian/templates/koha-conf-site.xml.in
+++ a/debian/templates/koha-conf-site.xml.in
@@ -480,5 +480,7 @@ __END_SRU_PUBLICSERVER__
+ 1
+
--- a/etc/koha-conf.xml
+++ a/etc/koha-conf.xml
@@ -291,5 +291,7 @@
+ 1
+
--