gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 29894: Clear secret when disabling 2FA 

Test plan:
Deregister 2FA for patron.
Check if secret is empty in borrowers.secret.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
This commit is contained in:
Marcel de Rooy 2022-01-20 15:07:30 +00:00 committed by Fridolin Somers
parent d42cd2b629
commit 2e4345cc77
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
members/two_factor_auth.pl
View File

@ -68,11 +68,10 @@ if ( $op eq 'register-2FA' ) {
);
if ($verified) {
$logged_in_user->secret($secret32);
$op = 'registered';
# FIXME Generate a (new?) secret
$logged_in_user->secret($secret32);
$logged_in_user->auth_method('two-factor')->store;
$op = 'registered';
}
else {
$template->param( invalid_pin => 1, );
@ -81,7 +80,6 @@ if ( $op eq 'register-2FA' ) {
}
if ( $op eq 'enable-2FA' ) {
my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 );
my $auth = Koha::Auth::TwoFactorAuth->new(
{ patron => $logged_in_user, secret => $secret } );
@ -99,6 +97,7 @@ if ( $op eq 'enable-2FA' ) {
elsif ( $op eq 'disable-2FA' ) {
output_and_exit( $cgi, $cookie, $template, 'wrong_csrf_token' )
unless Koha::Token->new->check_csrf($csrf_pars);
$logged_in_user->secret(undef);
$logged_in_user->auth_method('password')->store;
}