projects / koha-ffzg.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: cbf12e6)
Bug 28786: Add controller script and template
authorJonathan Druart <jonathan.druart@bugs.koha-community.org>
Thu, 29 Jul 2021 13:25:18 +0000 (15:25 +0200)
committerFridolin Somers <fridolin.somers@biblibre.com>
Thu, 21 Apr 2022 06:43:15 +0000 (20:43 -1000)
Sponsored-by: Orex Digital
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc patch | blob | history
koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt [new file with mode: 0644] patch | blob
members/two_factor_auth.pl [new file with mode: 0644] patch | blob

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
index 0b3d740..9a16f32 100644 (file)
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/members-toolbar.inc
@@ -52,6 +52,10 @@
                     <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to set permissions" id="patronflags" href="#">Set permissions</a></li>
                 [% END %]
 
                     <li class="disabled"><a data-toggle="tooltip" data-placement="left" title="You are not authorized to set permissions" id="patronflags" href="#">Set permissions</a></li>
                 [% END %]
 
+                [% IF Koha.Preference('TwoFactorAuthentication') && logged_in_user.borrowernumber == patron.borrowernumber %]
+                    <li><a id="twofa" href="/cgi-bin/koha/members/two_factor_auth.pl">Enable Two-Factor Authentication</a></li>
+                [% END %]
+
                 [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
                     <li><a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% patron.borrowernumber | uri %]">Discharge</a></li>
                 [% END %]
                 [% IF CAN_user_borrowers_edit_borrowers && useDischarge %]
                     <li><a href="/cgi-bin/koha/members/discharge.pl?borrowernumber=[% patron.borrowernumber | uri %]">Discharge</a></li>
                 [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
new file mode 100644 (file)
index 0000000..999f6f9
--- /dev/null
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
@@ -0,0 +1,115 @@
+[% USE raw %]
+[% USE Koha %]
+[% USE Asset %]
+[% SET footerjs = 1 %]
+[% INCLUDE 'doc-head-open.inc' %]
+<title>Two-Factor Authentication &rsaquo; Patrons &rsaquo; Koha</title>
+[% INCLUDE 'doc-head-close.inc' %]
+</head>
+<body id="pat_two_factor_auth" class="pat">
+[% INCLUDE 'header.inc' %]
+[% INCLUDE 'patron-search.inc' %]
+
+<nav id="breadcrumbs" aria-label="Breadcrumb" class="breadcrumb">
+    <ol>
+        <li>
+            <a href="/cgi-bin/koha/mainpage.pl">Home</a>
+        </li>
+        <li>
+            <a href="/cgi-bin/koha/members/members-home.pl">Patrons</a>
+        </li>
+        <li>
+            <a href="#" aria-current="page">
+                Manage two-factor authentication
+            </a>
+        </li>
+    </ol>
+</nav>
+
+<div class="main container-fluid">
+    <div class="row">
+        <div class="col-sm-10 col-sm-push-2">
+            <main>
+
+                [% INCLUDE 'members-toolbar.inc' %]
+
+                [% IF op == 'register' %]
+                    <h1>Register Two-Factor Authenticator</h1>
+                    <div class="dialog message">
+                        <p>We recommend cloud-based mobile authenticator apps such as Authy, Duo Mobile, and LastPass. They can restore access if you lose your hardware device.</p>
+                        <p>Can't scan the code?</p>
+                        <p>To add the entry manually, provide the following details to the application on your phone.</p>
+                        <p>Account: [% issuer %]</p>
+                        <p>Key: [% key_id %]</p>
+                        <p>Time based: Yes</p>
+                    </div>
+
+                    [% IF invalid_pin %]
+                        <div class="dialog error">Invalid pin code</div>
+                    [% END %]
+                    <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
+                        <fieldset class="rows">
+                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                            <input type="hidden" name="op" value="register-2FA" />
+                            <input type="hidden" name="secret32" value="[% secret32 %]" />
+                            <ol>
+                                <li>
+                                    <label for="qr_code">QR code: </label>
+                                    <img id="qr_code" src="[% qr_code_url %]" />
+                                </li>
+                                <li>
+                                    <label for="pin_code">Pin code: </label>
+                                    <input type="text" id="pin_code" name="pin_code" value="" />
+                                </li>
+                            </ol>
+                        </fieldset>
+                        <fieldset class="action">
+                            <input type="submit" value="Register with two-factor app" />
+                            <a class="cancel" href="/cgi-bin/koha/members/two_factor_auth.pl">Cancel</a>
+                        </fieldset>
+                    </form>
+                [% ELSE %]
+                    <h1>Two-Factor Authentication</h1>
+                    [% IF patron.auth_method == "two-factor" %]
+                        <div class="two-factor-status">Status: Enabled</div>
+
+                        <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
+                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                            <input type="hidden" name="op" value="disable-2FA" />
+                            <input type="submit" value="Disable Two-Factor Authentication" />
+                        </form>
+                    [% ELSE %]
+                        <div class="two-factor-status">Status: Disabled</div>
+
+                        <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
+                            <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
+                            <input type="hidden" name="op" value="enable-2FA" />
+                            <input type="submit" value="Enable Two-Factor Authentication" />
+                        </form>
+
+                    [% END %]
+                [% END %]
+            </main>
+        </div> <!-- /.col-sm-10.col-sm-push-2 -->
+
+        <div class="col-sm-2 col-sm-pull-10">
+            <aside>
+                [% INCLUDE 'circ-menu.inc' %]
+            </aside>
+        </div> <!-- /.col-sm-2.col-sm-pull-10 -->
+    </div> <!-- /.row -->
+
+
+[% MACRO jsinclude BLOCK %]
+    [% INCLUDE 'str/members-menu.inc' %]
+    [% Asset.js("js/members-menu.js") | $raw %]
+    <script>
+        $(document).ready(function(){
+            $(".delete").on("click", function(e){
+                return confirmDelete(_("Are you sure you want to delete this key?"));
+            });
+        });
+    </script>
+[% END %]
+
+[% INCLUDE 'intranet-bottom.inc' %]
diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl
new file mode 100644 (file)
index 0000000..ce5143e
--- /dev/null
+++ b/members/two_factor_auth.pl
@@ -0,0 +1,106 @@
+#!/usr/bin/perl
+
+# This file is part of Koha.
+#
+# Koha is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# Koha is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Koha; if not, see <http://www.gnu.org/licenses>.
+
+use Modern::Perl;
+
+use CGI;
+
+use C4::Auth qw( get_template_and_user );
+use C4::Output qw( output_and_exit output_html_with_http_headers );
+
+use Koha::Patrons;
+use Koha::Auth::TwoFactorAuth;
+
+my $cgi = CGI->new;
+
+my ( $template, $loggedinuser, $cookie ) = get_template_and_user(
+    {
+        template_name => 'members/two_factor_auth.tt',
+        query         => $cgi,
+        type          => 'intranet',
+        flagsrequired => { editcatalogue => '*' },
+    }
+);
+
+unless ( C4::Context->preference('TwoFactorAuthentication') ) {
+    print $cgi->redirect("/cgi-bin/koha/errors/404.pl");
+    exit;
+}
+
+my $logged_in_user = Koha::Patrons->find($loggedinuser);
+
+my $op = $cgi->param('op') // '';
+
+if ( $op eq 'register-2FA' ) {
+    my $pin_code = $cgi->param('pin_code');
+    my $secret32 = $cgi->param('secret32');
+    my $auth     = Koha::Auth::TwoFactorAuth::get_auth(
+        { patron => $logged_in_user, secret32 => $secret32 } );
+
+    my $verified = $auth->verify(
+        $pin_code,
+        1,    # range
+        $secret32,
+        undef,    # timestamp (defaults to now)
+        30,       # interval (default 30)
+    );
+
+    if ($verified) {
+        $logged_in_user->secret($secret32);
+        $op = 'registered';
+
+        # FIXME Generate a (new?) secret
+        $logged_in_user->auth_method('two-factor')->store;
+    }
+    else {
+        $template->param( invalid_pin => 1, );
+        $op = 'enable-2FA';
+    }
+}
+
+if ( $op eq 'enable-2FA' ) {
+
+    my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 );
+    my $auth = Koha::Auth::TwoFactorAuth::get_auth(
+        { patron => $logged_in_user, secret => $secret } );
+
+    my $secret32 = $auth->generate_secret32;
+    my $qr_code_url =
+      $auth->qr_code( $secret32, $auth->key_id, $auth->issuer, );
+
+    $template->param(
+        issuer      => $auth->issuer,
+        key_id      => $auth->key_id,
+        secret32    => $secret32,
+        qr_code_url => $qr_code_url,
+    );
+    $auth->clear;
+    $op = 'register';
+}
+elsif ( $op eq 'disable-2FA' ) {
+    $logged_in_user->auth_method('password')->store;
+}
+
+$template->param(
+    csrf_token => Koha::Token->new->generate_csrf(
+        { session_id => scalar $cgi->cookie('CGISESSID') }
+    ),
+    patron => $logged_in_user,
+    op     => $op,
+);
+
+output_html_with_http_headers $cgi, $cookie, $template->output;
KOHA@FFZG based on git://git.koha.org/pub/scm/koha.git