members/two_factor_auth.pl

   1 #!/usr/bin/perl
   2
   3 # This file is part of Koha.
   4 #
   5 # Koha is free software; you can redistribute it and/or modify it
   6 # under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 3 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # Koha is distributed in the hope that it will be useful, but
  11 # WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with Koha; if not, see <http://www.gnu.org/licenses>.
  17
  18 use Modern::Perl;
  19
  20 use CGI qw(-utf8);
  21
  22 use C4::Auth qw( get_template_and_user );
  23 use C4::Output qw( output_and_exit output_html_with_http_headers );
  24
  25 use Koha::Patrons;
  26 use Koha::Auth::TwoFactorAuth;
  27 use Koha::Token;
  28
  29 my $cgi = CGI->new;
  30
  31 my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
  32     {
  33         template_name => 'members/two_factor_auth.tt',
  34         query         => $cgi,
  35         type          => 'intranet',
  36         flagsrequired => { editcatalogue => '*' },
  37     }
  38 );
  39
  40 my $TwoFactorAuthentication = C4::Context->preference('TwoFactorAuthentication');
  41 if ( $TwoFactorAuthentication ne 'enabled' && $TwoFactorAuthentication ne 'enforced' ) {
  42     print $cgi->redirect("/cgi-bin/koha/errors/404.pl");
  43     exit;
  44 }
  45
  46 my $logged_in_user = Koha::Patrons->find($loggedinuser);
  47 my $op             = $cgi->param('op') // '';
  48
  49 if ( !C4::Context->config('encryption_key') ) {
  50     $template->param( missing_key => 1 );
  51 }
  52 else {
  53
  54     my $csrf_pars = {
  55         session_id => scalar $cgi->cookie('CGISESSID'),
  56         token      => scalar $cgi->param('csrf_token'),
  57     };
  58
  59     if ( $op eq 'register-2FA' ) {
  60         output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
  61           unless Koha::Token->new->check_csrf($csrf_pars);
  62
  63         my $pin_code = $cgi->param('pin_code');
  64         my $secret32 = $cgi->param('secret32');
  65         my $auth     = Koha::Auth::TwoFactorAuth->new(
  66             { patron => $logged_in_user, secret32 => $secret32 } );
  67
  68         my $verified = $auth->verify(
  69             $pin_code,
  70             1,        # range
  71             $secret32,
  72             undef,    # timestamp (defaults to now)
  73             30,       # interval (default 30)
  74         );
  75
  76         if ($verified) {
  77
  78             # FIXME Generate a (new?) secret
  79             $logged_in_user->encode_secret($secret32);
  80             $logged_in_user->auth_method('two-factor')->store;
  81             $op = 'registered';
  82             if ( $logged_in_user->notice_email_address ) {
  83                 $logged_in_user->queue_notice(
  84                     {
  85                         letter_params => {
  86                             module      => 'members',
  87                             letter_code => '2FA_ENABLE',
  88                             branchcode  => $logged_in_user->branchcode,
  89                             lang        => $logged_in_user->lang,
  90                             tables      => {
  91                                 branches  => $logged_in_user->branchcode,
  92                                 borrowers => $logged_in_user->id
  93                             },
  94                         },
  95                         message_transports => ['email'],
  96                     }
  97                 );
  98             }
  99         }
 100         else {
 101             $template->param( invalid_pin => 1, );
 102             $op = 'enable-2FA';
 103         }
 104     }
 105
 106     if ( $op eq 'enable-2FA' ) {
 107         my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 );
 108         my $auth   = Koha::Auth::TwoFactorAuth->new(
 109             { patron => $logged_in_user, secret => $secret } );
 110
 111         $template->param(
 112             issuer   => $auth->issuer,
 113             key_id   => $auth->key_id,
 114             qr_code  => $auth->qr_code,
 115             secret32 => $auth->secret32,
 116
 117             # IMPORTANT: get secret32 after qr_code call !
 118         );
 119         $auth->clear;
 120         $op = 'register';
 121     }
 122     elsif ( $op eq 'disable-2FA' ) {
 123         output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
 124           unless Koha::Token->new->check_csrf($csrf_pars);
 125         my $auth =
 126           Koha::Auth::TwoFactorAuth->new( { patron => $logged_in_user } );
 127         $logged_in_user->secret(undef);
 128         $logged_in_user->auth_method('password')->store;
 129         if ( $logged_in_user->notice_email_address ) {
 130             $logged_in_user->queue_notice(
 131                 {
 132                     letter_params => {
 133                         module      => 'members',
 134                         letter_code => '2FA_DISABLE',
 135                         branchcode  => $logged_in_user->branchcode,
 136                         lang        => $logged_in_user->lang,
 137                         tables      => {
 138                             branches  => $logged_in_user->branchcode,
 139                             borrowers => $logged_in_user->id
 140                         },
 141                     },
 142                     message_transports => ['email'],
 143                 }
 144             );
 145         }
 146     }
 147 }
 148
 149 $template->param(
 150     csrf_token => Koha::Token->new->generate_csrf(
 151         { session_id => scalar $cgi->cookie('CGISESSID') }
 152     ),
 153     patron => $logged_in_user,
 154     op     => $op,
 155 );
 156
 157 output_html_with_http_headers $cgi, $cookie, $template->output;