Bug 28786: Add controller script and template
Sponsored-by: Orex Digital Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
parent
cbf12e601c
commit
639f96376a
3 changed files with 225 additions and 0 deletions
|
|
@ -52,6 +52,10 @@
|
|||
<li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to set permissions" id="patronflags" href="#">Set permissions</a></li>
|
||||
[% END %]
|
||||
|
||||
[% IF Koha.Preference('TwoFactorAuthentication') && logged_in_user.borrowernumber == patron.borrowernumber %]
|
||||
<li><a id="twofa" href="/cgi-bin/koha/members/two_factor_auth.pl">Enable Two-Factor Authentication</a></li>
|
||||
[% END %]
|
||||
|
||||
[% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
|
||||
<li><a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% patron.borrowernumber | uri %]">Discharge</a></li>
|
||||
[% END %]
|
||||
|
|
|
|||
|
|
@ -0,0 +1,115 @@
|
|||
[% USE raw %]
|
||||
[% USE Koha %]
|
||||
[% USE Asset %]
|
||||
[% SET footerjs = 1 %]
|
||||
[% INCLUDE 'doc-head-open.inc' %]
|
||||
<title>Two-Factor Authentication › Patrons › Koha</title>
|
||||
[% INCLUDE 'doc-head-close.inc' %]
|
||||
</head>
|
||||
<body id="pat_two_factor_auth" class="pat">
|
||||
[% INCLUDE 'header.inc' %]
|
||||
[% INCLUDE 'patron-search.inc' %]
|
||||
|
||||
<nav id="breadcrumbs" aria-label="Breadcrumb" class="breadcrumb">
|
||||
<ol>
|
||||
<li>
|
||||
<a href="/cgi-bin/koha/mainpage.pl">Home</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="#" aria-current="page">
|
||||
Manage two-factor authentication
|
||||
</a>
|
||||
</li>
|
||||
</ol>
|
||||
</nav>
|
||||
|
||||
<div class="main container-fluid">
|
||||
<div class="row">
|
||||
<div class="col-sm-10 col-sm-push-2">
|
||||
<main>
|
||||
|
||||
[% INCLUDE 'members-toolbar.inc' %]
|
||||
|
||||
[% IF op == 'register' %]
|
||||
<h1>Register Two-Factor Authenticator</h1>
|
||||
<div class="dialog message">
|
||||
<p>We recommend cloud-based mobile authenticator apps such as Authy, Duo Mobile, and LastPass. They can restore access if you lose your hardware device.</p>
|
||||
<p>Can't scan the code?</p>
|
||||
<p>To add the entry manually, provide the following details to the application on your phone.</p>
|
||||
<p>Account: [% issuer %]</p>
|
||||
<p>Key: [% key_id %]</p>
|
||||
<p>Time based: Yes</p>
|
||||
</div>
|
||||
|
||||
[% IF invalid_pin %]
|
||||
<div class="dialog error">Invalid pin code</div>
|
||||
[% END %]
|
||||
<form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
|
||||
<fieldset class="rows">
|
||||
<input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
|
||||
<input type="hidden" name="op" value="register-2FA" />
|
||||
<input type="hidden" name="secret32" value="[% secret32 %]" />
|
||||
<ol>
|
||||
<li>
|
||||
<label for="qr_code">QR code: </label>
|
||||
<img id="qr_code" src="[% qr_code_url %]" />
|
||||
</li>
|
||||
<li>
|
||||
<label for="pin_code">Pin code: </label>
|
||||
<input type="text" id="pin_code" name="pin_code" value="" />
|
||||
</li>
|
||||
</ol>
|
||||
</fieldset>
|
||||
<fieldset class="action">
|
||||
<input type="submit" value="Register with two-factor app" />
|
||||
<a class="cancel" href="/cgi-bin/koha/members/two_factor_auth.pl">Cancel</a>
|
||||
</fieldset>
|
||||
</form>
|
||||
[% ELSE %]
|
||||
<h1>Two-Factor Authentication</h1>
|
||||
[% IF patron.auth_method == "two-factor" %]
|
||||
<div class="two-factor-status">Status: Enabled</div>
|
||||
|
||||
<form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
|
||||
<input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
|
||||
<input type="hidden" name="op" value="disable-2FA" />
|
||||
<input type="submit" value="Disable Two-Factor Authentication" />
|
||||
</form>
|
||||
[% ELSE %]
|
||||
<div class="two-factor-status">Status: Disabled</div>
|
||||
|
||||
<form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
|
||||
<input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
|
||||
<input type="hidden" name="op" value="enable-2FA" />
|
||||
<input type="submit" value="Enable Two-Factor Authentication" />
|
||||
</form>
|
||||
|
||||
[% END %]
|
||||
[% END %]
|
||||
</main>
|
||||
</div> <!-- /.col-sm-10.col-sm-push-2 -->
|
||||
|
||||
<div class="col-sm-2 col-sm-pull-10">
|
||||
<aside>
|
||||
[% INCLUDE 'circ-menu.inc' %]
|
||||
</aside>
|
||||
</div> <!-- /.col-sm-2.col-sm-pull-10 -->
|
||||
</div> <!-- /.row -->
|
||||
|
||||
|
||||
[% MACRO jsinclude BLOCK %]
|
||||
[% INCLUDE 'str/members-menu.inc' %]
|
||||
[% Asset.js("js/members-menu.js") | $raw %]
|
||||
<script>
|
||||
$(document).ready(function(){
|
||||
$(".delete").on("click", function(e){
|
||||
return confirmDelete(_("Are you sure you want to delete this key?"));
|
||||
});
|
||||
});
|
||||
</script>
|
||||
[% END %]
|
||||
|
||||
[% INCLUDE 'intranet-bottom.inc' %]
|
||||
106
members/two_factor_auth.pl
Normal file
106
members/two_factor_auth.pl
Normal file
|
|
@ -0,0 +1,106 @@
|
|||
#!/usr/bin/perl
|
||||
|
||||
# This file is part of Koha.
|
||||
#
|
||||
# Koha is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# Koha is distributed in the hope that it will be useful, but
|
||||
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Koha; if not, see <http://www.gnu.org/licenses>.
|
||||
|
||||
use Modern::Perl;
|
||||
|
||||
use CGI;
|
||||
|
||||
use C4::Auth qw( get_template_and_user );
|
||||
use C4::Output qw( output_and_exit output_html_with_http_headers );
|
||||
|
||||
use Koha::Patrons;
|
||||
use Koha::Auth::TwoFactorAuth;
|
||||
|
||||
my $cgi = CGI->new;
|
||||
|
||||
my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
|
||||
{
|
||||
template_name => 'members/two_factor_auth.tt',
|
||||
query => $cgi,
|
||||
type => 'intranet',
|
||||
flagsrequired => { editcatalogue => '*' },
|
||||
}
|
||||
);
|
||||
|
||||
unless ( C4::Context->preference('TwoFactorAuthentication') ) {
|
||||
print $cgi->redirect("/cgi-bin/koha/errors/404.pl");
|
||||
exit;
|
||||
}
|
||||
|
||||
my $logged_in_user = Koha::Patrons->find($loggedinuser);
|
||||
|
||||
my $op = $cgi->param('op') // '';
|
||||
|
||||
if ( $op eq 'register-2FA' ) {
|
||||
my $pin_code = $cgi->param('pin_code');
|
||||
my $secret32 = $cgi->param('secret32');
|
||||
my $auth = Koha::Auth::TwoFactorAuth::get_auth(
|
||||
{ patron => $logged_in_user, secret32 => $secret32 } );
|
||||
|
||||
my $verified = $auth->verify(
|
||||
$pin_code,
|
||||
1, # range
|
||||
$secret32,
|
||||
undef, # timestamp (defaults to now)
|
||||
30, # interval (default 30)
|
||||
);
|
||||
|
||||
if ($verified) {
|
||||
$logged_in_user->secret($secret32);
|
||||
$op = 'registered';
|
||||
|
||||
# FIXME Generate a (new?) secret
|
||||
$logged_in_user->auth_method('two-factor')->store;
|
||||
}
|
||||
else {
|
||||
$template->param( invalid_pin => 1, );
|
||||
$op = 'enable-2FA';
|
||||
}
|
||||
}
|
||||
|
||||
if ( $op eq 'enable-2FA' ) {
|
||||
|
||||
my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 );
|
||||
my $auth = Koha::Auth::TwoFactorAuth::get_auth(
|
||||
{ patron => $logged_in_user, secret => $secret } );
|
||||
|
||||
my $secret32 = $auth->generate_secret32;
|
||||
my $qr_code_url =
|
||||
$auth->qr_code( $secret32, $auth->key_id, $auth->issuer, );
|
||||
|
||||
$template->param(
|
||||
issuer => $auth->issuer,
|
||||
key_id => $auth->key_id,
|
||||
secret32 => $secret32,
|
||||
qr_code_url => $qr_code_url,
|
||||
);
|
||||
$auth->clear;
|
||||
$op = 'register';
|
||||
}
|
||||
elsif ( $op eq 'disable-2FA' ) {
|
||||
$logged_in_user->auth_method('password')->store;
|
||||
}
|
||||
|
||||
$template->param(
|
||||
csrf_token => Koha::Token->new->generate_csrf(
|
||||
{ session_id => scalar $cgi->cookie('CGISESSID') }
|
||||
),
|
||||
patron => $logged_in_user,
|
||||
op => $op,
|
||||
);
|
||||
|
||||
output_html_with_http_headers $cgi, $cookie, $template->output;
|
||||
Loading…
Reference in a new issue