IntenseFinance/firefly-iii
3
0
Fork 0
mirror of https://github.com/firefly-iii/firefly-iii.git synced 2025-02-25 18:45:27 -06:00
Code Issues Packages Projects Releases Wiki Activity

Do not give the user the secret.

Browse Source
This commit is contained in:
James Cole 2016-03-19 07:56:57 +01:00
parent a26acf4a25
commit fb165ef28b
4 changed files with 9 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
app/Http/Controllers/PreferencesController.php
View File

@ -37,10 +37,11 @@ class PreferencesController extends Controller
{ {
$domain = $this->getDomain(); $domain = $this->getDomain();
$secret = $google2fa->generateSecretKey(16, Auth::user()->id); $secret = $google2fa->generateSecretKey(16, Auth::user()->id);
Session::flash('two-factor-secret', $secret);
$image = $google2fa->getQRCodeInline('Firefly III at ' . $domain, null, $secret, 150); $image = $google2fa->getQRCodeInline('Firefly III at ' . $domain, null, $secret, 150);
return view('preferences.code', compact('secret', 'image')); return view('preferences.code', compact('image'));
} }
/** /**

3
app/Http/Requests/TokenFormRequest.php
View File

@ -29,8 +29,7 @@ class TokenFormRequest extends Request
{ {
$rules = [ $rules = [
'secret' => 'required', 'code' => 'required|2faCode',
'code' => 'required|2faCode:secret',
]; ];
return $rules; return $rules;

6
app/Validation/FireflyValidator.php
View File

@ -18,8 +18,8 @@ use FireflyIII\Rules\Triggers\TriggerInterface;
use FireflyIII\User; use FireflyIII\User;
use Illuminate\Contracts\Encryption\DecryptException; use Illuminate\Contracts\Encryption\DecryptException;
use Illuminate\Validation\Validator; use Illuminate\Validation\Validator;
use Input;
use Log; use Log;
use Session;
use Symfony\Component\Translation\TranslatorInterface; use Symfony\Component\Translation\TranslatorInterface;
/** /**
@ -59,9 +59,7 @@ class FireflyValidator extends Validator
return false; return false;
} }
// Retrieve the secret from our hidden form field. $secret = Session::get('two-factor-secret');
$secret = Input::get($parameters[0]);
$google2fa = app('PragmaRX\Google2FA\Google2FA'); $google2fa = app('PragmaRX\Google2FA\Google2FA');
return $google2fa->verifyKey($secret, $value); return $google2fa->verifyKey($secret, $value);

13
resources/views/preferences/code.twig
View File

@ -6,8 +6,6 @@
{% block content %} {% block content %}
{{ Form.open({'class' : 'form-horizontal','id' : 'preferences.code'}) }} {{ Form.open({'class' : 'form-horizontal','id' : 'preferences.code'}) }}
<input type="hidden" name="secret" value="{{ secret }}"/>
<div class="row"> <div class="row">
<div class="col-lg-6 col-md-6 col-sm-6"> <div class="col-lg-6 col-md-6 col-sm-6">
<div class="box"> <div class="box">
@ -19,19 +17,14 @@
{{ 'pref_two_factor_auth_code_help'|_ }} {{ 'pref_two_factor_auth_code_help'|_ }}
</p> </p>
<div class="form group"> <div class="form group">
<div class="col-sm-8 col-md-offset-4"> <div class="col-sm-8 col-md-offset-4">
<img src="{{ image }}" /> <img src="{{ image }}" alt="" title="" />
<br /><br />
</div> </div>
</div> </div>
<div class="form group">
<div class="col-sm-8 col-md-offset-4">
<p>{{ secret }}</p>
</div>
</div>
{{ ExpandedForm.text('code', code, {'label' : 'Code'}) }} {{ ExpandedForm.text('code', code) }}
</div> </div>
</div> </div>
</div> </div>