From a4b60e9ba4874b9ab427bec41d8b2cd252ec4782 Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Wed, 18 Sep 2019 02:48:40 +0200
Subject: [PATCH] Fix TOTP codes not being filtered from logs during
enabling/disabling (#11877)
Not a serious issue because they are meaningless past single use
---
.../two_factor_authentication/confirmations_controller.rb | 4 ++--
.../settings/two_factor_authentications_controller.rb | 6 +++---
app/models/form/two_factor_confirmation.rb | 2 +-
.../two_factor_authentication/confirmations/new.html.haml | 2 +-
.../settings/two_factor_authentications/show.html.haml | 2 +-
.../confirmations_controller_spec.rb | 6 +++---
.../settings/two_factor_authentications_controller_spec.rb | 4 ++--
7 files changed, 13 insertions(+), 13 deletions(-)
diff --git a/app/controllers/settings/two_factor_authentication/confirmations_controller.rb b/app/controllers/settings/two_factor_authentication/confirmations_controller.rb
index 3145e092da..46c90bf74a 100644
--- a/app/controllers/settings/two_factor_authentication/confirmations_controller.rb
+++ b/app/controllers/settings/two_factor_authentication/confirmations_controller.rb
@@ -15,7 +15,7 @@ module Settings
end
def create
- if current_user.validate_and_consume_otp!(confirmation_params[:code])
+ if current_user.validate_and_consume_otp!(confirmation_params[:otp_attempt])
flash.now[:notice] = I18n.t('two_factor_authentication.enabled_success')
current_user.otp_required_for_login = true
@@ -33,7 +33,7 @@ module Settings
private
def confirmation_params
- params.require(:form_two_factor_confirmation).permit(:code)
+ params.require(:form_two_factor_confirmation).permit(:otp_attempt)
end
def prepare_two_factor_form
diff --git a/app/controllers/settings/two_factor_authentications_controller.rb b/app/controllers/settings/two_factor_authentications_controller.rb
index 6904076e42..c93b175770 100644
--- a/app/controllers/settings/two_factor_authentications_controller.rb
+++ b/app/controllers/settings/two_factor_authentications_controller.rb
@@ -34,7 +34,7 @@ module Settings
private
def confirmation_params
- params.require(:form_two_factor_confirmation).permit(:code)
+ params.require(:form_two_factor_confirmation).permit(:otp_attempt)
end
def verify_otp_required
@@ -42,8 +42,8 @@ module Settings
end
def acceptable_code?
- current_user.validate_and_consume_otp!(confirmation_params[:code]) ||
- current_user.invalidate_otp_backup_code!(confirmation_params[:code])
+ current_user.validate_and_consume_otp!(confirmation_params[:otp_attempt]) ||
+ current_user.invalidate_otp_backup_code!(confirmation_params[:otp_attempt])
end
end
end
diff --git a/app/models/form/two_factor_confirmation.rb b/app/models/form/two_factor_confirmation.rb
index b8cf76d058..27ada65333 100644
--- a/app/models/form/two_factor_confirmation.rb
+++ b/app/models/form/two_factor_confirmation.rb
@@ -3,5 +3,5 @@
class Form::TwoFactorConfirmation
include ActiveModel::Model
- attr_accessor :code
+ attr_accessor :otp_attempt
end
diff --git a/app/views/settings/two_factor_authentication/confirmations/new.html.haml b/app/views/settings/two_factor_authentication/confirmations/new.html.haml
index e641552991..86cf1f695e 100644
--- a/app/views/settings/two_factor_authentication/confirmations/new.html.haml
+++ b/app/views/settings/two_factor_authentication/confirmations/new.html.haml
@@ -12,7 +12,7 @@
%samp.qr-alternative__code= current_user.otp_secret.scan(/.{4}/).join(' ')
.fields-group
- = f.input :code, wrapper: :with_label, hint: t('two_factor_authentication.code_hint'), label: t('simple_form.labels.defaults.otp_attempt'), input_html: { :autocomplete => 'off' }, required: true
+ = f.input :otp_attempt, wrapper: :with_label, hint: t('two_factor_authentication.code_hint'), label: t('simple_form.labels.defaults.otp_attempt'), input_html: { :autocomplete => 'off' }, required: true
.actions
= f.button :button, t('two_factor_authentication.enable'), type: :submit
diff --git a/app/views/settings/two_factor_authentications/show.html.haml b/app/views/settings/two_factor_authentications/show.html.haml
index 259bcd1ef3..93509e022f 100644
--- a/app/views/settings/two_factor_authentications/show.html.haml
+++ b/app/views/settings/two_factor_authentications/show.html.haml
@@ -10,7 +10,7 @@
%hr/
= simple_form_for @confirmation, url: settings_two_factor_authentication_path, method: :delete do |f|
- = f.input :code, wrapper: :with_label, hint: t('two_factor_authentication.code_hint'), label: t('simple_form.labels.defaults.otp_attempt'), input_html: { :autocomplete => 'off' }, required: true
+ = f.input :otp_attempt, wrapper: :with_label, hint: t('two_factor_authentication.code_hint'), label: t('simple_form.labels.defaults.otp_attempt'), input_html: { :autocomplete => 'off' }, required: true
.actions
= f.button :button, t('two_factor_authentication.disable'), type: :submit
diff --git a/spec/controllers/settings/two_factor_authentication/confirmations_controller_spec.rb b/spec/controllers/settings/two_factor_authentication/confirmations_controller_spec.rb
index 2222a7559b..2e5a9325cf 100644
--- a/spec/controllers/settings/two_factor_authentication/confirmations_controller_spec.rb
+++ b/spec/controllers/settings/two_factor_authentication/confirmations_controller_spec.rb
@@ -68,7 +68,7 @@ describe Settings::TwoFactorAuthentication::ConfirmationsController do
true
end
- post :create, params: { form_two_factor_confirmation: { code: '123456' } }
+ post :create, params: { form_two_factor_confirmation: { otp_attempt: '123456' } }
expect(assigns(:recovery_codes)).to eq otp_backup_codes
expect(flash[:notice]).to eq 'Two-factor authentication successfully enabled'
@@ -85,7 +85,7 @@ describe Settings::TwoFactorAuthentication::ConfirmationsController do
false
end
- post :create, params: { form_two_factor_confirmation: { code: '123456' } }
+ post :create, params: { form_two_factor_confirmation: { otp_attempt: '123456' } }
end
it 'renders the new view' do
@@ -99,7 +99,7 @@ describe Settings::TwoFactorAuthentication::ConfirmationsController do
context 'when not signed in' do
it 'redirects if not signed in' do
- post :create, params: { form_two_factor_confirmation: { code: '123456' } }
+ post :create, params: { form_two_factor_confirmation: { otp_attempt: '123456' } }
expect(response).to redirect_to('/auth/sign_in')
end
end
diff --git a/spec/controllers/settings/two_factor_authentications_controller_spec.rb b/spec/controllers/settings/two_factor_authentications_controller_spec.rb
index f7c6287569..922231ded6 100644
--- a/spec/controllers/settings/two_factor_authentications_controller_spec.rb
+++ b/spec/controllers/settings/two_factor_authentications_controller_spec.rb
@@ -91,7 +91,7 @@ describe Settings::TwoFactorAuthenticationsController do
true
end
- post :destroy, params: { form_two_factor_confirmation: { code: '123456' } }
+ post :destroy, params: { form_two_factor_confirmation: { otp_attempt: '123456' } }
expect(response).to redirect_to(settings_two_factor_authentication_path)
user.reload
@@ -105,7 +105,7 @@ describe Settings::TwoFactorAuthenticationsController do
false
end
- post :destroy, params: { form_two_factor_confirmation: { code: '057772' } }
+ post :destroy, params: { form_two_factor_confirmation: { otp_attempt: '057772' } }
user.reload
expect(user.otp_required_for_login).to eq(true)