10 commits

Author	SHA1	Message	Date
djmaze	a67c85885e	@ZaphodB fix(security): two-factor-auth could be switched off with only a session ... With 2-step verification enabled, these plugin actions needed nothing but a session (and the CSRF token that comes with it): - EnableTwoFactor with Enable=0 switched it off, - ClearTwoFactorInfo deleted it, - CreateTwoFactorSecret overwrote the secret with Enable false, i.e. also switched it off, - ShowTwoFactorSecret returned the secret and QR code. A stolen cookie or an unlocked machine was enough to drop or copy the second factor. While 2FA is enabled, all four now require a current TOTP or backup code, checked as at login; a backup code used here is spent. Enabling and the first setup are unchanged. Backup codes come from random_int() instead of rand(). The settings page asks for the code (the existing "Verification Code" label) before those actions and sends it. A refused change reloads the real state; before, any error made the page show 2FA as not configured. A cancelled or refused "off" puts the checkbox back. TwoFactorAuthSettings.min.js, which is what is served, is now the same file as the source rather than a separate hand-minified copy. test/two-factor-reauth.php drives the real gate with storage and provider stubbed: open while not enabled; refused with no, a wrong or an unknown backup code while enabled; allowed with a valid TOTP or backup code, which is spent.	2026-10-27 22:27:03 +01:00
the-djmaze	656c5f2a3e	Bugfix: 2FA enforcement #349	2022-05-20 12:36:30 +02:00
the-djmaze	a06b59784a	Changes for #349	2022-04-29 13:23:04 +02:00
the-djmaze	8b3cfc7a67	Add support for global 2FA enforcement #349	2022-04-25 16:21:16 +02:00
the-djmaze	e4b70c2af1	Cleanup two-factor-auth extension	2022-02-28 15:31:21 +01:00
the-djmaze	7265cf03d9	https://github.com/the-djmaze/snappymail/issues/236#issuecomment-1041465503	2022-02-16 15:01:26 +01:00
the-djmaze	f6400b6da2	Remove rl.showScreenPopup in favour of AbstractViewPopup.showModal	2022-02-07 15:20:39 +01:00
djmaze	2d1f99a8ce	Get 2FA plugin somesort of working	2021-07-23 13:36:38 +02:00
djmaze	54d2fb93cc	Prepare more 2fa data	2021-04-14 10:11:09 +02:00
djmaze	d9bab28bfe	#84 as plugin	2021-04-13 11:42:06 +02:00