squeegily/pleroma
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Saner TOTP provisioning

Browse Source 
A user's e-mail address may be fluid, and the site "instance name"
may be strange or change regularly. There's no reason to use these
over the user's stable ID and the site's stable hostname for TOTP
parameters. Even if the system is built to TOLERATE changes (as it
is -- I tested it), it seems much more elegant to have these para-
meters as stable identifiers.
This commit is contained in:
James Edington 2022-03-15 12:56:27 -05:00
parent 0b2119d4a7
commit 21fe97fa16
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/pleroma/mfa/totp.ex
View File

@ -34,7 +34,7 @@ defmodule Pleroma.MFA.TOTP do
defp default_digits, do: Config.get(@config_ns ++ [:digits]) defp default_digits, do: Config.get(@config_ns ++ [:digits])
defp default_issuer, defp default_issuer,
do: Config.get(@config_ns ++ [:issuer], Config.get([:instance, :name])) do: Config.get(@config_ns ++ [:issuer], Config.get([:instance, :host]))
@doc "Creates a random Base 32 encoded string" @doc "Creates a random Base 32 encoded string"
def generate_secret do def generate_secret do

2
lib/pleroma/web/pleroma_api/controllers/two_factor_authentication_controller.ex
View File

@ -41,7 +41,7 @@ defmodule Pleroma.Web.PleromaAPI.TwoFactorAuthenticationController do
def setup(%{assigns: %{user: user}} = conn, %{"method" => "totp"} = _params) do def setup(%{assigns: %{user: user}} = conn, %{"method" => "totp"} = _params) do
with {:ok, user} <- MFA.setup_totp(user), with {:ok, user} <- MFA.setup_totp(user),
%{secret: secret} = _ <- user.multi_factor_authentication_settings.totp do %{secret: secret} = _ <- user.multi_factor_authentication_settings.totp do
provisioning_uri = TOTP.provisioning_uri(secret, "#{user.email}") provisioning_uri = TOTP.provisioning_uri(secret, "#{user.ap_id}")
json(conn, %{provisioning_uri: provisioning_uri, key: secret}) json(conn, %{provisioning_uri: provisioning_uri, key: secret})
else else