@@ -17,121 +26,105 @@
{{/if}}
- {{#if model.second_factor_enabled}}
+ {{#if loaded}}
- {{#second-factor-form
- secondFactorMethod=secondFactorMethod
- backupEnabled=backupEnabled
- secondFactorToken=secondFactorToken
- secondFactorTitle=(i18n 'user.second_factor.title')
- isLogin=false}}
- {{second-factor-input value=secondFactorToken inputId='second-factor-token' secondFactorMethod=secondFactorMethod}}
- {{/second-factor-form}}
+
{{i18n "user.second_factor.totp.title"}}
+ {{d-button action=(action "createTotp")
+ class="btn-primary new-totp"
+ disabled=loading
+ label="user.second_factor.totp.add"}}
+ {{#each totps as |totp|}}
+
+ {{totp.name}}
+
+ {{#if isCurrentUser}}
+ {{d-button action=(action "editSecondFactor" totp)
+ class="btn-default btn-small btn-icon pad-left no-text edit"
+ disabled=loading
+ icon="pencil-alt"
+ }}
+ {{/if}}
+
+ {{/each}}
+
+
+
+
+
+
{{i18n "user.second_factor_backup.title"}}
+ {{#if model.second_factor_enabled}}
+ {{#if model.second_factor_backup_enabled}}
+ {{{i18n 'user.second_factor_backup.manage' count=model.second_factor_remaining_backup_codes}}}
+ {{else}}
+ {{i18n 'user.second_factor_backup.enable_long'}}
+ {{/if}}
+
+ {{#if isCurrentUser}}
+ {{d-button action=(action "editSecondFactorBackup")
+ class="btn-default btn-small btn-icon pad-left no-text edit edit-2fa-backup"
+ disabled=loading
+ icon="pencil-alt"
+ }}
+ {{/if}}
+ {{else}}
+ {{i18n "user.second_factor_backup.enable_prerequisites"}}
+ {{/if}}
+
+
+
+ {{#if model.second_factor_enabled}}
+ {{#unless showEnforcedNotice}}
+
+
+
{{i18n "user.second_factor.disable_title"}}
+ {{d-button action=(action "disableAllSecondFactors")
+ class="btn btn-danger"
+ disabled=loading
+ label="disable"}}
+
+
+ {{/unless}}
+ {{/if}}
+ {{else}}
+
+
+
+
+
+ {{text-field value=password
+ id="password"
+ type="password"
+ classNames="input-xxlarge"
+ autofocus="autofocus"}}
+
+
+ {{i18n 'user.second_factor.confirm_password_description'}}
+
- {{d-button action=(action "disableSecondFactor")
- class="btn btn-primary"
- disabled=loading
- label=disableButtonText}}
+ {{d-button action=(action "confirmPassword")
+ class="btn-primary"
+ disabled=loading
+ label="continue"}}
+
+ {{d-button action=(action "resetPassword")
+ class="btn"
+ disabled=resetPasswordLoading
+ icon="envelope"
+ label='user.change_password.action'}}
+
+ {{resetPasswordProgress}}
{{#unless showEnforcedNotice}}
{{cancel-link route="preferences.account" args= model.username}}
{{/unless}}
- {{else}}
- {{#if loaded}}
-
-
- {{{i18n 'user.second_factor.enable_description'}}}
-
- {{#if displayOAuthWarning}}
- {{i18n 'user.second_factor.oauth_enabled_warning'}}
- {{/if}}
-
-
-
-
-
-
-
-
-
- {{second-factor-input maxlength=6 value=secondFactorToken inputId='second-factor-token'}}
-
-
-
-
-
- {{d-button action=(action "enableSecondFactor")
- class="btn btn-primary"
- disabled=loading
- label=enableButtonText}}
-
- {{#unless showEnforcedNotice}}
- {{cancel-link route="preferences.account" args= model.username}}
- {{/unless}}
-
-
- {{else}}
-
-
-
-
-
- {{text-field value=password
- id="password"
- type="password"
- classNames="input-xxlarge"
- autofocus="autofocus"}}
-
-
- {{i18n 'user.second_factor.confirm_password_description'}}
-
-
-
-
-
-
- {{d-button action=(action "confirmPassword")
- class="btn btn-primary"
- disabled=loading
- label=submitButtonText}}
-
- {{d-button action=(action "resetPassword")
- class="btn"
- disabled=resetPasswordLoading
- icon="envelope"
- label='user.change_password.action'}}
-
- {{resetPasswordProgress}}
-
- {{#unless showEnforcedNotice}}
- {{cancel-link route="preferences.account" args= model.username}}
- {{/unless}}
-
-
- {{/if}}
{{/if}}
+ {{/conditional-loading-spinner}}
diff --git a/app/assets/javascripts/discourse/templates/preferences/account.hbs b/app/assets/javascripts/discourse/templates/preferences/account.hbs
index 7a1aef4dccb..666e147fcae 100644
--- a/app/assets/javascripts/discourse/templates/preferences/account.hbs
+++ b/app/assets/javascripts/discourse/templates/preferences/account.hbs
@@ -90,32 +90,11 @@
{{/unless}}
+ {{i18n 'user.second_factor.enable'}}
{{#if isCurrentUser}}
- {{#if model.second_factor_enabled}}
- {{#link-to "preferences.second-factor" class="btn btn-default"}}
- {{d-icon "unlock"}} {{i18n 'user.second_factor.disable'}}
- {{/link-to}}
- {{else}}
- {{#link-to "preferences.second-factor" class="btn btn-default"}}
- {{d-icon "lock"}} {{i18n 'user.second_factor.enable'}}
- {{/link-to}}
- {{/if}}
- {{/if}}
-
-
-
- {{#if model.second_factor_enabled}}
- {{#if isCurrentUser}}
- {{#link-to "preferences.second-factor-backup"}}
-
- {{#if model.second_factor_backup_enabled}}
- {{i18n 'user.second_factor_backup.manage'}}
- {{else}}
- {{i18n 'user.second_factor_backup.enable_long'}}
- {{/if}}
-
- {{/link-to}}
- {{/if}}
+ {{#link-to "preferences.second-factor" class="btn btn-default"}}
+ {{d-icon "lock"}} {{i18n 'user.second_factor.enable'}}
+ {{/link-to}}
{{/if}}
diff --git a/app/assets/stylesheets/common/base/user.scss b/app/assets/stylesheets/common/base/user.scss
index 676baa76324..7fb618214e9 100644
--- a/app/assets/stylesheets/common/base/user.scss
+++ b/app/assets/stylesheets/common/base/user.scss
@@ -695,6 +695,21 @@
}
}
+.second-factor {
+ &.instructions {
+ color: $primary-medium;
+ margin-top: 5px;
+ margin-bottom: 10px;
+ font-size: $font-down-1;
+ }
+ .second-factor-item {
+ margin-top: 0.75em;
+ }
+ .btn.edit {
+ min-height: auto;
+ }
+}
+
.primary-textual .staged,
#user-card .staged {
font-style: italic;
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 3b1ba66f8e9..bd0bf7ae62d 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -14,7 +14,8 @@ class UsersController < ApplicationController
requires_login only: [
:username, :update, :user_preferences_redirect, :upload_user_image,
:pick_avatar, :destroy_user_image, :destroy, :check_emails,
- :topic_tracking_state, :preferences, :create_second_factor,
+ :topic_tracking_state, :preferences, :create_second_factor_totp,
+ :enable_second_factor_totp, :disable_second_factor, :list_second_factors,
:update_second_factor, :create_second_factor_backup, :select_avatar,
:notification_level, :revoke_auth_token
]
@@ -25,6 +26,10 @@ class UsersController < ApplicationController
:my_redirect, :toggle_anon, :admin_login, :confirm_admin, :email_login, :summary
]
+ before_action :second_factor_check_confirmed_password, only: [
+ :create_second_factor_totp, :enable_second_factor_totp,
+ :disable_second_factor, :update_second_factor, :create_second_factor_backup]
+
before_action :respond_to_suspicious_request, only: [:create]
# we need to allow account creation with bad CSRF tokens, if people are caching, the CSRF token on the
@@ -1063,39 +1068,32 @@ class UsersController < ApplicationController
render layout: 'no_ember'
end
- def create_second_factor
+ def list_second_factors
raise Discourse::NotFound if SiteSetting.enable_sso || !SiteSetting.enable_local_logins
- RateLimiter.new(nil, "login-hr-#{request.remote_ip}", SiteSetting.max_logins_per_ip_per_hour, 1.hour).performed!
- RateLimiter.new(nil, "login-min-#{request.remote_ip}", SiteSetting.max_logins_per_ip_per_minute, 1.minute).performed!
- unless current_user.confirm_password?(params[:password])
- return render json: failed_json.merge(
- error: I18n.t("login.incorrect_password")
- )
+ unless params[:password].empty?
+ RateLimiter.new(nil, "login-hr-#{request.remote_ip}", SiteSetting.max_logins_per_ip_per_hour, 1.hour).performed!
+ RateLimiter.new(nil, "login-min-#{request.remote_ip}", SiteSetting.max_logins_per_ip_per_minute, 1.minute).performed!
+ unless current_user.confirm_password?(params[:password])
+ return render json: failed_json.merge(
+ error: I18n.t("login.incorrect_password")
+ )
+ end
+ secure_session["confirmed-password-#{current_user.id}"] = "true"
end
- qrcode_svg = RQRCode::QRCode.new(current_user.totp_provisioning_uri).as_svg(
- offset: 0,
- color: '000',
- shape_rendering: 'crispEdges',
- module_size: 4
- )
-
- render json: success_json.merge(
- key: current_user.user_second_factors.totp.data.scan(/.{4}/).join(" "),
- qr: qrcode_svg
- )
+ if secure_session["confirmed-password-#{current_user.id}"] == "true"
+ render json: success_json.merge(
+ totps: current_user.totps.select(:id, :name, :last_used, :created_at, :method).order(:created_at)
+ )
+ else
+ render json: success_json.merge(
+ password_required: true
+ )
+ end
end
def create_second_factor_backup
- raise Discourse::NotFound if SiteSetting.enable_sso || !SiteSetting.enable_local_logins
-
- unless current_user.authenticate_second_factor(params[:second_factor_token], params[:second_factor_method].to_i)
- return render json: failed_json.merge(
- error: I18n.t("login.invalid_second_factor_code")
- )
- end
-
backup_codes = current_user.generate_backup_codes
render json: success_json.merge(
@@ -1103,54 +1101,93 @@ class UsersController < ApplicationController
)
end
- def update_second_factor
- params.require(:second_factor_token)
- params.require(:second_factor_method)
- params.require(:second_factor_target)
+ def create_second_factor_totp
+ totp_data = ROTP::Base32.random_base32
+ secure_session["staged-totp-#{current_user.id}"] = totp_data
+ qrcode_svg = RQRCode::QRCode.new(current_user.totp_provisioning_uri(totp_data)).as_svg(
+ offset: 0,
+ color: '000',
+ shape_rendering: 'crispEdges',
+ module_size: 4
+ )
- auth_method = params[:second_factor_method].to_i
+ render json: success_json.merge(
+ key: totp_data.scan(/.{4}/).join(" "),
+ qr: qrcode_svg
+ )
+ end
+
+ def enable_second_factor_totp
+ params.require(:second_factor_token)
+ params.require(:name)
auth_token = params[:second_factor_token]
- update_second_factor_method = params[:second_factor_target].to_i
+ totp_data = secure_session["staged-totp-#{current_user.id}"]
+ totp_object = current_user.get_totp_object(totp_data)
[request.remote_ip, current_user.id].each do |key|
RateLimiter.new(nil, "second-factor-min-#{key}", 3, 1.minute).performed!
end
+ authenticated = !auth_token.blank? && totp_object.verify_with_drift(auth_token, 30)
+ unless authenticated
+ return render json: failed_json.merge(
+ error: I18n.t("login.invalid_second_factor_code")
+ )
+ end
+ current_user.create_totp(data: totp_data, name: params[:name], enabled: true)
+ render json: success_json
+ end
+
+ def disable_second_factor
+ # delete all second factors for a user
+ current_user.user_second_factors.destroy_all
+
+ Jobs.enqueue(
+ :critical_user_email,
+ type: :account_second_factor_disabled,
+ user_id: current_user.id
+ )
+
+ render json: success_json
+ end
+
+ def update_second_factor
+ params.require(:second_factor_target)
+ update_second_factor_method = params[:second_factor_target].to_i
+
if update_second_factor_method == UserSecondFactor.methods[:totp]
- user_second_factor = current_user.user_second_factors.totp
+ params.require(:id)
+ second_factor_id = params[:id].to_i
+ user_second_factor = current_user.user_second_factors.totps.find_by(id: second_factor_id)
elsif update_second_factor_method == UserSecondFactor.methods[:backup_codes]
user_second_factor = current_user.user_second_factors.backup_codes
end
raise Discourse::InvalidParameters unless user_second_factor
- unless current_user.authenticate_second_factor(auth_token, auth_method)
- return render json: failed_json.merge(
- error: I18n.t("login.invalid_second_factor_code")
- )
+ if params[:name] && !params[:name].blank?
+ user_second_factor.update!(name: params[:name])
end
-
- if params[:enable] == "true"
- user_second_factor.update!(enabled: true)
- else
- # when disabling totp, backup is disabled too
- if update_second_factor_method == UserSecondFactor.methods[:totp]
- current_user.user_second_factors.destroy_all
-
- Jobs.enqueue(
- :critical_user_email,
- type: :account_second_factor_disabled,
- user_id: current_user.id
- )
- elsif update_second_factor_method == UserSecondFactor.methods[:backup_codes]
+ if params[:disable] == "true"
+ # Disabling backup codes deletes *all* backup codes
+ if update_second_factor_method == UserSecondFactor.methods[:backup_codes]
current_user.user_second_factors.where(method: UserSecondFactor.methods[:backup_codes]).destroy_all
+ else
+ user_second_factor.update!(enabled: false)
end
+
end
render json: success_json
end
+ def second_factor_check_confirmed_password
+ raise Discourse::NotFound if SiteSetting.enable_sso || !SiteSetting.enable_local_logins
+
+ raise Discourse::InvalidAccess.new unless current_user && secure_session["confirmed-password-#{current_user.id}"] == "true"
+ end
+
def revoke_account
user = fetch_user_from_params
guardian.ensure_can_edit!(user)
diff --git a/app/models/concerns/second_factor_manager.rb b/app/models/concerns/second_factor_manager.rb
index 1d88fa9b2fe..67caf8adf0b 100644
--- a/app/models/concerns/second_factor_manager.rb
+++ b/app/models/concerns/second_factor_manager.rb
@@ -3,35 +3,39 @@
module SecondFactorManager
extend ActiveSupport::Concern
- def totp
- self.create_totp
- ROTP::TOTP.new(self.user_second_factors.totp.data, issuer: SiteSetting.title)
- end
-
def create_totp(opts = {})
- if !self.user_second_factors.totp
- UserSecondFactor.create!({
- user_id: self.id,
- method: UserSecondFactor.methods[:totp],
- data: ROTP::Base32.random_base32
- }.merge(opts))
- end
+ UserSecondFactor.create!({
+ user_id: self.id,
+ method: UserSecondFactor.methods[:totp],
+ data: ROTP::Base32.random_base32
+ }.merge(opts))
end
- def totp_provisioning_uri
- self.totp.provisioning_uri(self.email)
+ def get_totp_object(data)
+ ROTP::TOTP.new(data, issuer: SiteSetting.title)
+ end
+
+ def totp_provisioning_uri(data)
+ get_totp_object(data).provisioning_uri(self.email)
end
def authenticate_totp(token)
- totp = self.totp
- last_used = 0
+ totps = self&.user_second_factors.totps
+ authenticated = false
+ totps.each do |totp|
- if self.user_second_factors.totp.last_used
- last_used = self.user_second_factors.totp.last_used.to_i
+ last_used = 0
+
+ if totp.last_used
+ last_used = totp.last_used.to_i
+ end
+
+ authenticated = !token.blank? && totp.get_totp_object.verify_with_drift_and_prior(token, 30, last_used)
+ if authenticated
+ totp.update!(last_used: DateTime.now)
+ break
+ end
end
-
- authenticated = !token.blank? && totp.verify_with_drift_and_prior(token, 30, last_used)
- self.user_second_factors.totp.update!(last_used: DateTime.now) if authenticated
!!authenticated
end
diff --git a/app/models/user_second_factor.rb b/app/models/user_second_factor.rb
index 7388751976b..0d3d8ee3512 100644
--- a/app/models/user_second_factor.rb
+++ b/app/models/user_second_factor.rb
@@ -11,6 +11,10 @@ class UserSecondFactor < ActiveRecord::Base
where(method: UserSecondFactor.methods[:totp], enabled: true)
end
+ scope :all_totps, -> do
+ where(method: UserSecondFactor.methods[:totp])
+ end
+
def self.methods
@methods ||= Enum.new(
totp: 1,
@@ -18,8 +22,12 @@ class UserSecondFactor < ActiveRecord::Base
)
end
- def self.totp
- where(method: self.methods[:totp]).first
+ def get_totp_object
+ ROTP::TOTP.new(self.data, issuer: SiteSetting.title)
+ end
+
+ def totp_provisioning_uri
+ get_totp_object.provisioning_uri(user.email)
end
end
diff --git a/config/locales/client.en.yml b/config/locales/client.en.yml
index 710d614a51d..06da3d7c24f 100644
--- a/config/locales/client.en.yml
+++ b/config/locales/client.en.yml
@@ -927,19 +927,19 @@ en:
disable: "Disable"
enable: "Enable"
enable_long: "Enable backup codes"
- manage: "Manage backup codes"
+ manage: "Manage backup codes. You have