mirrors/wallabag
1
0
Fork 0
mirror of https://github.com/wallabag/wallabag.git synced 2025-04-25 19:34:07 +00:00
Code Issues Projects Releases Wiki Activity

Hash backup codes in the database using password_hash

Browse source
This commit is contained in:
Jeremy Benoist 2019-01-23 14:43:39 +01:00
parent 7485a272ff
commit 4654a83b64
No known key found for this signature in database
GPG key ID: BCA73962457ACC3C
4 changed files with 38 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
src/Wallabag/CoreBundle/Controller/ConfigController.php
View file

@ -197,18 +197,25 @@ class ConfigController extends Controller
} }
$user = $this->getUser(); $user = $this->getUser();
$secret = $this->get('scheb_two_factor.security.google_authenticator')->generateSecret();
if (!$user->isGoogleTwoFactor()) { $user->setGoogleAuthenticatorSecret($secret);
$secret = $this->get('scheb_two_factor.security.google_authenticator')->generateSecret(); $user->setEmailTwoFactor(false);
$user->setGoogleAuthenticatorSecret($secret); $backupCodes = (new BackupCodes())->toArray();
$user->setEmailTwoFactor(false); $backupCodesHashed = array_map(
$user->setBackupCodes((new BackupCodes())->toArray()); function ($backupCode) {
return password_hash($backupCode, PASSWORD_DEFAULT);
},
$backupCodes
);
$this->container->get('fos_user.user_manager')->updateUser($user, true); $user->setBackupCodes($backupCodesHashed);
}
$this->container->get('fos_user.user_manager')->updateUser($user, true);
return $this->render('WallabagCoreBundle:Config:otp_app.html.twig', [ return $this->render('WallabagCoreBundle:Config:otp_app.html.twig', [
'backupCodes' => $backupCodes,
'qr_code' => $this->get('scheb_two_factor.security.google_authenticator')->getQRContent($user), 'qr_code' => $this->get('scheb_two_factor.security.google_authenticator')->getQRContent($user),
]); ]);
} }

2
src/Wallabag/CoreBundle/Resources/views/themes/baggy/Config/otp_app.html.twig
View file

@ -20,7 +20,7 @@
<li> <li>
<p>{{ 'config.otp.app.two_factor_code_description_3'|trans }}</p> <p>{{ 'config.otp.app.two_factor_code_description_3'|trans }}</p>
<p><strong>{{ app.user.getBackupCodes|join("\n")|nl2br }}</strong></p> <p><strong>{{ backupCodes|join("\n")|nl2br }}</strong></p>
</li> </li>
<li> <li>
<p>{{ 'config.otp.app.two_factor_code_description_4'|trans }}</p> <p>{{ 'config.otp.app.two_factor_code_description_4'|trans }}</p>

2
src/Wallabag/CoreBundle/Resources/views/themes/material/Config/otp_app.html.twig
View file

@ -24,7 +24,7 @@
<li> <li>
<p>{{ 'config.otp.app.two_factor_code_description_3'|trans }}</p> <p>{{ 'config.otp.app.two_factor_code_description_3'|trans }}</p>
<p><strong>{{ app.user.getBackupCodes|join("\n")|nl2br }}</strong></p> <p><strong>{{ backupCodes|join("\n")|nl2br }}</strong></p>
</li> </li>
<li> <li>
<p>{{ 'config.otp.app.two_factor_code_description_4'|trans }}</p> <p>{{ 'config.otp.app.two_factor_code_description_4'|trans }}</p>

24
src/Wallabag/UserBundle/Entity/User.php
View file

@ -339,7 +339,7 @@ class User extends BaseUser implements EmailTwoFactorInterface, GoogleTwoFactorI
*/ */
public function isBackupCode(string $code): bool public function isBackupCode(string $code): bool
{ {
return \in_array($code, $this->backupCodes, true); return false === $this->findBackupCode($code) ? false : true;
} }
/** /**
@ -347,7 +347,7 @@ class User extends BaseUser implements EmailTwoFactorInterface, GoogleTwoFactorI
*/ */
public function invalidateBackupCode(string $code): void public function invalidateBackupCode(string $code): void
{ {
$key = array_search($code, $this->backupCodes, true); $key = $this->findBackupCode($code);
if (false !== $key) { if (false !== $key) {
unset($this->backupCodes[$key]); unset($this->backupCodes[$key]);
@ -385,4 +385,24 @@ class User extends BaseUser implements EmailTwoFactorInterface, GoogleTwoFactorI
return $this->clients->first(); return $this->clients->first();
} }
} }
/**
* Try to find a backup code from the list of backup codes of the current user.
*
* @param string $code Given code from the user
*
* @return string|false
*/
private function findBackupCode(string $code)
{
foreach ($this->backupCodes as $key => $backupCode) {
// backup code are hashed using `password_hash`
// see ConfigController->otpAppAction
if (password_verify($code, $backupCode)) {
return $key;
}
}
return false;
}
} }