3 # This file is part of Koha.
5 # Koha is free software; you can redistribute it and/or modify it
6 # under the terms of the GNU General Public License as published by
7 # the Free Software Foundation; either version 3 of the License, or
8 # (at your option) any later version.
10 # Koha is distributed in the hope that it will be useful, but
11 # WITHOUT ANY WARRANTY; without even the implied warranty of
12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 # GNU General Public License for more details.
15 # You should have received a copy of the GNU General Public License
16 # along with Koha; if not, see <http://www.gnu.org/licenses>.
22 use C4::Auth qw( get_template_and_user );
23 use C4::Output qw( output_and_exit output_html_with_http_headers );
26 use Koha::Auth::TwoFactorAuth;
31 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
33 template_name => 'members/two_factor_auth.tt',
36 flagsrequired => { editcatalogue => '*' },
40 unless ( C4::Context->preference('TwoFactorAuthentication') ) {
41 print $cgi->redirect("/cgi-bin/koha/errors/404.pl");
45 output_and_exit( $cgi, $cookie, $template, 'Entry encryption_key is missing in koha-conf.xml' )
46 if !C4::Context->config('encryption_key');
48 my $logged_in_user = Koha::Patrons->find($loggedinuser);
50 my $op = $cgi->param('op') // '';
52 session_id => scalar $cgi->cookie('CGISESSID'),
53 token => scalar $cgi->param('csrf_token'),
56 if ( $op eq 'register-2FA' ) {
57 output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
58 unless Koha::Token->new->check_csrf($csrf_pars);
60 my $pin_code = $cgi->param('pin_code');
61 my $secret32 = $cgi->param('secret32');
62 my $auth = Koha::Auth::TwoFactorAuth->new(
63 { patron => $logged_in_user, secret32 => $secret32 } );
65 my $verified = $auth->verify(
69 undef, # timestamp (defaults to now)
70 30, # interval (default 30)
74 # FIXME Generate a (new?) secret
75 $logged_in_user->encode_secret($secret32);
76 $logged_in_user->auth_method('two-factor')->store;
78 if( $logged_in_user->notice_email_address ) {
79 $logged_in_user->queue_notice({
81 module => 'members', letter_code => '2FA_ENABLE',
82 branchcode => $logged_in_user->branchcode, lang => $logged_in_user->lang,
83 tables => { branches => $logged_in_user->branchcode, borrowers => $logged_in_user->id },
85 message_transports => [ 'email' ],
90 $template->param( invalid_pin => 1, );
95 if ( $op eq 'enable-2FA' ) {
96 my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 );
97 my $auth = Koha::Auth::TwoFactorAuth->new(
98 { patron => $logged_in_user, secret => $secret } );
101 issuer => $auth->issuer,
102 key_id => $auth->key_id,
103 qr_code => $auth->qr_code,
104 secret32 => $auth->secret32,
105 # IMPORTANT: get secret32 after qr_code call !
110 elsif ( $op eq 'disable-2FA' ) {
111 output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
112 unless Koha::Token->new->check_csrf($csrf_pars);
113 my $auth = Koha::Auth::TwoFactorAuth->new({ patron => $logged_in_user });
114 $logged_in_user->secret(undef);
115 $logged_in_user->auth_method('password')->store;
116 if( $logged_in_user->notice_email_address ) {
117 $logged_in_user->queue_notice({
119 module => 'members', letter_code => '2FA_DISABLE',
120 branchcode => $logged_in_user->branchcode, lang => $logged_in_user->lang,
121 tables => { branches => $logged_in_user->branchcode, borrowers => $logged_in_user->id },
123 message_transports => [ 'email' ],
129 csrf_token => Koha::Token->new->generate_csrf(
130 { session_id => scalar $cgi->cookie('CGISESSID') }
132 patron => $logged_in_user,
136 output_html_with_http_headers $cgi, $cookie, $template->output;