@@ -16,15 +10,16 @@
{{/if}}
{{#if model.second_factor_enabled}}
-
-
- {{second-factor-input maxlength=6 value=secondFactorToken inputId='second-factor-token'}}
-
-
-
- {{i18n 'user.second_factor.disable_description'}}
+ {{#second-factor-form
+ secondFactorMethod=secondFactorMethod
+ backupEnabled=backupEnabled
+ secondFactorToken=secondFactorToken
+ secondFactorTitle=(i18n 'user.second_factor.title')
+ isLogin=false}}
+ {{second-factor-input value=secondFactorToken inputId='second-factor-token' secondFactorMethod=secondFactorMethod}}
+ {{/second-factor-form}}
@@ -91,15 +86,16 @@
- {{text-field value=password
+
+ {{text-field value=password
id="password"
type="password"
classNames="input-xxlarge"
autofocus="autofocus"}}
-
-
-
- {{i18n 'user.second_factor.confirm_password_description'}}
+
+
+ {{i18n 'user.second_factor.confirm_password_description'}}
+
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index efe426fb5f2..be2ba574f5f 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -477,7 +477,7 @@ class UsersController < ApplicationController
second_factor_token = params[:second_factor_token]
second_factor_method = params[:second_factor_method].to_i
- if second_factor_token.present? && second_factor_token[/\d{6}/] && UserSecondFactor.methods[second_factor_method]
+ if second_factor_token.present? && UserSecondFactor.methods[second_factor_method]
RateLimiter.new(nil, "second-factor-min-#{request.remote_ip}", 3, 1.minute).performed!
second_factor_authenticated = @user&.authenticate_second_factor(second_factor_token, second_factor_method)
end
@@ -1059,7 +1059,7 @@ class UsersController < ApplicationController
def create_second_factor_backup
raise Discourse::NotFound if SiteSetting.enable_sso || !SiteSetting.enable_local_logins
- unless current_user.authenticate_totp(params[:second_factor_token])
+ unless current_user.authenticate_second_factor(params[:second_factor_token], params[:second_factor_method].to_i)
return render json: failed_json.merge(
error: I18n.t("login.invalid_second_factor_code")
)
@@ -1075,22 +1075,26 @@ class UsersController < ApplicationController
def update_second_factor
params.require(:second_factor_token)
params.require(:second_factor_method)
+ params.require(:second_factor_target)
- second_factor_method = params[:second_factor_method].to_i
+ auth_method = params[:second_factor_method].to_i
+ auth_token = params[:second_factor_token]
+
+ update_second_factor_method = params[:second_factor_target].to_i
[request.remote_ip, current_user.id].each do |key|
RateLimiter.new(nil, "second-factor-min-#{key}", 3, 1.minute).performed!
end
- if second_factor_method == UserSecondFactor.methods[:totp]
+ if update_second_factor_method == UserSecondFactor.methods[:totp]
user_second_factor = current_user.user_second_factors.totp
- elsif second_factor_method == UserSecondFactor.methods[:backup_codes]
+ elsif update_second_factor_method == UserSecondFactor.methods[:backup_codes]
user_second_factor = current_user.user_second_factors.backup_codes
end
raise Discourse::InvalidParameters unless user_second_factor
- unless current_user.authenticate_totp(params[:second_factor_token])
+ unless current_user.authenticate_second_factor(auth_token, auth_method)
return render json: failed_json.merge(
error: I18n.t("login.invalid_second_factor_code")
)
@@ -1100,7 +1104,7 @@ class UsersController < ApplicationController
user_second_factor.update!(enabled: true)
else
# when disabling totp, backup is disabled too
- if second_factor_method == UserSecondFactor.methods[:totp]
+ if update_second_factor_method == UserSecondFactor.methods[:totp]
current_user.user_second_factors.destroy_all
Jobs.enqueue(
@@ -1108,7 +1112,7 @@ class UsersController < ApplicationController
type: :account_second_factor_disabled,
user_id: current_user.id
)
- elsif second_factor_method == UserSecondFactor.methods[:backup_codes]
+ elsif update_second_factor_method == UserSecondFactor.methods[:backup_codes]
current_user.user_second_factors.where(method: UserSecondFactor.methods[:backup_codes]).destroy_all
end
end
diff --git a/config/locales/client.en.yml b/config/locales/client.en.yml
index 9ee306acad0..65d4c0d891c 100644
--- a/config/locales/client.en.yml
+++ b/config/locales/client.en.yml
@@ -782,6 +782,7 @@ en:
copied_to_clipboard: "Copied to Clipboard"
copy_to_clipboard_error: "Error copying data to Clipboard"
remaining_codes: "You have
{{count}} backup codes remaining."
+ use: "
Use a backup code"
codes:
title: "Backup Codes Generated"
description: "Each of these backup codes can only be used once. Keep them somewhere safe but accessible."
@@ -800,6 +801,7 @@ en:
extended_description: |
Two factor authentication adds extra security to your account by requiring a one-time token in addition to your password. Tokens can be generated on
Android and
iOS devices.
oauth_enabled_warning: "Please note that social logins will be disabled once two factor authentication has been enabled on your account."
+ use: "
Use Authenticator app"
change_about:
title: "Change About Me"
diff --git a/spec/requests/users_controller_spec.rb b/spec/requests/users_controller_spec.rb
index 3d278abee76..6465bc3bb97 100644
--- a/spec/requests/users_controller_spec.rb
+++ b/spec/requests/users_controller_spec.rb
@@ -3107,6 +3107,7 @@ describe UsersController do
put "/users/second_factor.json", params: {
second_factor_token: '000000',
second_factor_method: UserSecondFactor.methods[:totp],
+ second_factor_target: UserSecondFactor.methods[:totp],
enable: 'true',
}
@@ -3122,8 +3123,9 @@ describe UsersController do
it 'should allow second factor for the user to be enabled' do
put "/users/second_factor.json", params: {
second_factor_token: ROTP::TOTP.new(user_second_factor.data).now,
- enable: 'true',
- second_factor_method: UserSecondFactor.methods[:totp]
+ second_factor_method: UserSecondFactor.methods[:totp],
+ second_factor_target: UserSecondFactor.methods[:totp],
+ enable: 'true'
}
expect(response.status).to eq(200)
@@ -3133,7 +3135,8 @@ describe UsersController do
it 'should allow second factor for the user to be disabled' do
put "/users/second_factor.json", params: {
second_factor_token: ROTP::TOTP.new(user_second_factor.data).now,
- second_factor_method: UserSecondFactor.methods[:totp]
+ second_factor_method: UserSecondFactor.methods[:totp],
+ second_factor_target: UserSecondFactor.methods[:totp]
}
expect(response.status).to eq(200)
@@ -3146,7 +3149,7 @@ describe UsersController do
context 'when token is missing' do
it 'returns the right response' do
put "/users/second_factor.json", params: {
- second_factor_method: UserSecondFactor.methods[:backup_codes],
+ second_factor_target: UserSecondFactor.methods[:backup_codes]
}
expect(response.status).to eq(400)
@@ -3157,7 +3160,8 @@ describe UsersController do
it 'returns the right response' do
put "/users/second_factor.json", params: {
second_factor_token: '000000',
- second_factor_method: UserSecondFactor.methods[:backup_codes],
+ second_factor_method: UserSecondFactor.methods[:totp],
+ second_factor_target: UserSecondFactor.methods[:backup_codes]
}
expect(response.status).to eq(200)
@@ -3172,7 +3176,8 @@ describe UsersController do
it 'should allow second factor backup for the user to be disabled' do
put "/users/second_factor.json", params: {
second_factor_token: ROTP::TOTP.new(user_second_factor.data).now,
- second_factor_method: UserSecondFactor.methods[:backup_codes]
+ second_factor_method: UserSecondFactor.methods[:totp],
+ second_factor_target: UserSecondFactor.methods[:backup_codes]
}
expect(response.status).to eq(200)
@@ -3189,7 +3194,8 @@ describe UsersController do
context 'when not logged in' do
it 'should return the right response' do
put "/users/second_factors_backup.json", params: {
- second_factor_token: 'wrongtoken'
+ second_factor_token: 'wrongtoken',
+ second_factor_method: UserSecondFactor.methods[:totp]
}
expect(response.status).to eq(403)
@@ -3204,7 +3210,8 @@ describe UsersController do
describe 'create 2fa request' do
it 'fails on incorrect password' do
put "/users/second_factors_backup.json", params: {
- second_factor_token: 'wrongtoken'
+ second_factor_token: 'wrongtoken',
+ second_factor_method: UserSecondFactor.methods[:totp]
}
expect(response.status).to eq(200)
@@ -3219,7 +3226,8 @@ describe UsersController do
SiteSetting.enable_local_logins = false
put "/users/second_factors_backup.json", params: {
- second_factor_token: ROTP::TOTP.new(user_second_factor.data).now
+ second_factor_token: ROTP::TOTP.new(user_second_factor.data).now,
+ second_factor_method: UserSecondFactor.methods[:totp]
}
expect(response.status).to eq(404)
@@ -3232,7 +3240,8 @@ describe UsersController do
SiteSetting.enable_sso = true
put "/users/second_factors_backup.json", params: {
- second_factor_token: ROTP::TOTP.new(user_second_factor.data).now
+ second_factor_token: ROTP::TOTP.new(user_second_factor.data).now,
+ second_factor_method: UserSecondFactor.methods[:totp]
}
expect(response.status).to eq(404)
@@ -3243,7 +3252,8 @@ describe UsersController do
user_second_factor
put "/users/second_factors_backup.json", params: {
- second_factor_token: ROTP::TOTP.new(user_second_factor.data).now
+ second_factor_token: ROTP::TOTP.new(user_second_factor.data).now,
+ second_factor_method: UserSecondFactor.methods[:totp]
}
expect(response.status).to eq(200)