gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Koha-clms/C4
History
Jonathan Druart b93e15c235
Bug 30588: Add the option to require 2FA setup on first staff login 
Bug 28786 added the ability to turn on a two-factor authentication,
using a One Time Password (OTP).
Once enabled on the system, librarian had the choice to enable or
disable it for themselves.
For security reason an administrator could decide to force the
librarians to use this second authentication step.

This patch adds a third option to the existing syspref, 'Enforced', for
that purpose.

QA notes: the code we had in the members/two_factor_auth.pl controller
has been moved to REST API controller methods (with their tests and
swagger specs), for reusability reason. Code from template has been
moved to an include file for the same reason.

Test plan:
A. Regression tests
As we modified the code we need first to confirm the existing features
are still working as expected.
1. Turn off TwoFactorAuthentication (disabled) and confirm that you are not able to
enable and access the second authentication step
2. Turn it on (enabled) and confirm that you are able to enable it in your account
3. Logout and confirm then that you are able to login into Koha

B. The new option
1. Set the pref to "enforced"
2. You are not logged out, logged in users stay logged in
3. Pick a user that does not have 2FA setup, login
4. Notice the new screen (UI is a bit ugly, suggestions welcomed)
5. Try to access Koha without enabling 2FA, you shouldn't be able to
access any pages
6. Setup 2FA and confirm that you are redirected to the login screen
7. Login, send the correct pin code
=> You are fully logged in!

Note that at 6 we could redirect to the mainpage, without the need to
login again, but I think it's preferable to reduce the change to
C4::Auth. If it's considered mandatory by QA I could have a look on
another bug report.

Sponsored-by: Rijksmuseum, Netherlands

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
 		2022-10-21 11:36:57 -03:00
..
AuthoritiesMarc Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
ClassSortRoutine Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ClassSplitRoutine Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Creators Bug 24001: Fix Card template/rpinter profile creation and edit 2022-04-28 10:49:20 -10:00
External Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Form Bug 28572: Remove C4::Debug 2021-06-22 12:04:32 +02:00
Heading Bug 30218: Add subfield g to field 150 in C4::Heading::MARC21 mappings 2022-08-19 15:45:09 -03:00
ILSDI Bug 31177: Fix misplaced import in C4::ILSDI::Services 2022-08-31 14:28:28 -03:00
Installer Bug 30731: Remove Readonly::XS::MAGIC_COOKIE 2022-06-01 16:15:26 -03:00
Labels Bug 29697: Replace GetMarcBiblio occurrences with $biblio->metadata->record 2022-07-22 15:24:11 -03:00
Linker Bug 30280: Add support for subject headings from different thesaurus when using Elasticsearch 2022-10-03 10:00:04 -03:00
Members Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
OAI Bug 30308: Fix bulkmarcimport.pl broken by OAI-PMH:AutoUpdateSets(EmbedItemData) 2022-07-29 15:43:39 -03:00
Output Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Patroncards Bug 25459: Makes barcode position respect units in patron cards layout 2021-11-02 16:50:01 +01:00
Reports Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
SIP Bug 31552: SIP2 option format_due_date not honored for AH field in item information response 2022-10-12 14:56:57 -03:00
Search Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Serials Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Utils Bug 29648: (QA follow-up) Minor POD fix 2022-04-27 11:20:45 -10:00
Accounts.pm Bug 29184: Fix warn about undefined replacecost 2022-09-08 10:50:30 -07:00
Acquisition.pm Bug 31649: Fix acquisition basket group CSV export if biblio does not exist 2022-10-11 10:00:13 -03:00
Auth.pm Bug 30588: Add the option to require 2FA setup on first staff login 2022-10-21 11:36:57 -03:00
Auth_cas_servers.yaml.sample
…
Auth_with_cas.pm Bug 27342: Remove dbh from C4::Auth 2022-08-16 10:45:41 -03:00
Auth_with_ldap.pm Bug 30646: (follow-up) Set to send immediately 2022-10-03 14:02:40 -03:00
Auth_with_shibboleth.pm Bug 30646: (follow-up) Set to send immediately 2022-10-03 14:02:40 -03:00
AuthoritiesMarc.pm Bug 28186: Use Koha::Authority in C4::AuthoritiesMarc::AddAuthority 2022-10-03 15:13:35 -03:00
BackgroundJob.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Barcodes.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Biblio.pm Bug 30025: Split BiblioAddsAuthorities into two sysprefs 2022-09-16 16:48:30 -03:00
Breeding.pm Bug 30813: (QA follow-up) Adjust three use statements 2022-06-08 11:40:32 -03:00
Budgets.pm Bug 27550: "Duplicate budget" does not keep users associated with that budget 2022-09-22 08:18:33 -03:00
Calendar.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Charset.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Circulation.pm Bug 25426: Allow return policy to be selected via syspref and not just home library 2022-10-18 09:14:52 -03:00
ClassSortRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSource.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
ClassSplitRoutine.pm Bug 29951: Fix EXPORT for C4::ClassS*Routine modules 2022-07-08 15:29:56 -03:00
Context.pm Bug 31614: Adds a koha-conf.xml config to set Zebra connection timeout 2022-10-12 09:10:07 -03:00
Contract.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
CourseReserves.pm Bug 30016: Remove GetOpenIssue subroutine 2022-08-31 08:50:37 -03:00
Creators.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
HTML5Media.pm Bug 18984: Remove NORMARC support 2021-10-07 15:36:40 +02:00
Heading.pm Bug 30280: (follow-up) Removing tab character in Heading.pm 2022-10-03 10:00:08 -03:00
HoldsQueue.pm Bug 29196: (Bug 27068 follow-up) - Remove unnecessary check 2022-10-03 13:39:30 -03:00
ImportBatch.pm Bug 27421: (QA follow-up) BatchCommitImportRecords needs param for skipping commits 2022-09-19 15:14:59 -03:00
ImportExportFramework.pm Bug 13952: (follow-up) JS translatability, clean warns, other 2022-04-04 16:23:46 +02:00
InstallAuth.pm Bug 26019: Koha should set SameSite attribute on cookies 2022-04-13 15:55:38 +02:00
Installer.pm Bug 29673: Allow English sql localization script 2022-08-16 10:24:41 -03:00
ItemCirculationAlertPreference.pm Bug 29844: Fix ->search occurrences 2022-02-09 15:36:23 -10:00
Items.pm Bug 31437: (bug 30718 follow-up) Prevent useless indexation call from ModDateLastSeen 2022-10-14 09:25:10 -03:00
Koha.pm Bug 29883: avoid uninitialized value warn in GetAuthorisedValues sub 2022-06-01 13:40:24 -03:00
Labels.pm
…
Languages.pm Bug 15067: Follow up to fix sorting 2021-08-04 14:06:43 +02:00
Letters.pm Bug 31626: Add letter id to the message queue table 2022-10-18 09:41:41 -03:00
Linker.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Log.pm Bug 31203: Add End action to cronjobs and log viewer 2022-10-05 16:12:55 -03:00
MarcModificationTemplates.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Matcher.pm Bug 28290: Don't send subfields to 'as_string' if none to send 2022-09-07 13:50:21 -07:00
Members.pm Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Message.pm Bug 30838: (QA follow-up) Add missing semicolon 2022-07-22 14:45:59 -03:00
Output.pm Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) 2022-07-25 11:18:11 -03:00
Overdues.pm Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Patroncards.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Record.pm Bug 29697: Fix t/db_dependent/Exporter/Record.t 2022-07-25 09:30:35 -03:00
Reports.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Reserves.pm Bug 30718: Fix imports 2022-08-19 10:12:06 -03:00
Ris.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
RotatingCollections.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
SMS.pm Bug 27673: Replace YAML with YAML::XS 2021-02-16 14:54:50 +01:00
Scheduler.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Scrubber.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Search.pm Bug 17170: Add the ability to create 'saved searches' for use as filters when searching the catalog 2022-10-21 11:15:18 -03:00
Serials.pm Bug 30718: Use flatpickr's altInput 2022-08-19 08:26:31 -03:00
Service.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
ShelfBrowser.pm Bug 29697: Replace GetMarcBiblio occurrences with $biblio->metadata->record 2022-07-22 15:24:11 -03:00
SocialData.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Stats.pm Bug 7021: Terminology - usercode -> categorycode 2022-09-22 09:31:28 -03:00
Suggestions.pm Bug 23991: (follow-up) Silence useless warnings 2022-06-27 13:23:06 -03:00
TTParser.pm Bug 26673: Remove #!/usr/bin/env perl from .pm modules too 2020-10-26 00:14:42 +01:00
Tags.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
Templates.pm Bug 31390: Remove noisy warns in C4::Templates 2022-08-22 13:25:00 -03:00
TmplToken.pm
…
TmplTokenType.pm Bug 17600: Standardize our EXPORT_OK 2021-07-16 08:58:47 +02:00
UsageStats.pm Bug 30025: Replace AllowManualAuthorityEditing with RequireChoosingExistingAuthority 2022-09-16 16:48:34 -03:00
XISBN.pm Bug 30813: (QA follow-up) Adjust three use statements 2022-06-08 11:40:32 -03:00
XSLT.pm Bug 28375: (follow-up) Use C4::Context->interface 2022-10-20 11:50:53 -03:00