nocebo/diaspora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use :database_authenticatable strategy to check password for OTP user

Browse source 
This:
* makes sure that after_database_authentication is called for users with
enabled 2fa.
* handles paranoid mode correctly
This commit is contained in:
Benjamin Neff 2019-06-16 04:46:42 +02:00
parent ef31ea6b96
commit 88e35d3f3a
No known key found for this signature in database
GPG key ID: 971464C3F1A90194
2 changed files with 5 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
app/controllers/sessions_controller.rb
View file

@ -19,14 +19,14 @@ class SessionsController < Devise::SessionsController
def authenticate_with_2fa def authenticate_with_2fa
self.resource = find_user self.resource = find_user
u = find_user
return true unless u&.otp_required_for_login? return true unless resource&.otp_required_for_login?
if params[:user][:otp_attempt].present? && session[:otp_user_id] if params[:user][:otp_attempt].present? && session[:otp_user_id]
authenticate_with_two_factor_via_otp(u) authenticate_with_two_factor_via_otp(resource)
elsif u&.valid_password?(params[:user][:password]) else
prompt_for_two_factor(u) strategy = Warden::Strategies[:database_authenticatable].new(warden.env, :user)
prompt_for_two_factor(strategy.user) if strategy.valid? && strategy._run!.successful?
end end
end end

5
config/initializers/devise.rb
View file

@ -15,11 +15,6 @@ end
# Use this hook to configure devise mailer, warden hooks and so forth. # Use this hook to configure devise mailer, warden hooks and so forth.
# Many of these configuration options can be set straight in your model. # Many of these configuration options can be set straight in your model.
Devise.setup do |config| Devise.setup do |config|
config.warden do |manager|
manager.default_strategies(scope: :user).unshift :two_factor_authenticatable
manager.default_strategies(scope: :user).unshift :two_factor_backupable
end
# The secret key used by Devise. Devise uses this key to generate # The secret key used by Devise. Devise uses this key to generate
# random tokens. Changing this key will render invalid all existing # random tokens. Changing this key will render invalid all existing
# confirmation, reset password and unlock tokens in the database. # confirmation, reset password and unlock tokens in the database.