Skip to content

Commit 2252fdb

Browse files
GargronMage
Gargron
authored and
Mage
committed
Add e-mail-based sign in challenge for users with disabled 2FA (mastodon#14013)
1 parent 07b5c70 commit 2252fdb

14 files changed

Lines changed: 368 additions & 51 deletions

‎app/controllers/auth/sessions_controller.rb‎

Lines changed: 5 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ class Auth::SessionsController < Devise::SessionsController
99
skip_before_action :require_no_authentication, only: [:create]
1010
skip_before_action :require_functional!
1111

12-
prepend_before_action :authenticate_with_two_factor, if: :two_factor_enabled?, only: [:create]
12+
include TwoFactorAuthenticationConcern
13+
include SignInTokenAuthenticationConcern
1314

1415
before_action :set_instance_presenter, only: [:new]
1516
before_action :set_body_classes
@@ -40,8 +41,8 @@ def destroy
4041
protected
4142

4243
def find_user
43-
if session[:otp_user_id]
44-
User.find(session[:otp_user_id])
44+
if session[:attempt_user_id]
45+
User.find(session[:attempt_user_id])
4546
else
4647
user = User.authenticate_with_ldap(user_params) if Devise.ldap_authentication
4748
user ||= User.authenticate_with_pam(user_params) if Devise.pam_authentication
@@ -51,7 +52,7 @@ def find_user
5152
end
5253

5354
def user_params
54-
params.require(:user).permit(:email, :password, :otp_attempt)
55+
params.require(:user).permit(:email, :password, :otp_attempt, :sign_in_token_attempt)
5556
end
5657

5758
def after_sign_in_path_for(resource)
@@ -72,47 +73,6 @@ def after_sign_out_path_for(_resource_or_scope)
7273
super
7374
end
7475

75-
def two_factor_enabled?
76-
find_user&.otp_required_for_login?
77-
end
78-
79-
def valid_otp_attempt?(user)
80-
user.validate_and_consume_otp!(user_params[:otp_attempt]) ||
81-
user.invalidate_otp_backup_code!(user_params[:otp_attempt])
82-
rescue OpenSSL::Cipher::CipherError
83-
false
84-
end
85-
86-
def authenticate_with_two_factor
87-
user = self.resource = find_user
88-
89-
if user_params[:otp_attempt].present? && session[:otp_user_id]
90-
authenticate_with_two_factor_via_otp(user)
91-
elsif user.present? && (user.encrypted_password.blank? || user.valid_password?(user_params[:password]))
92-
# If encrypted_password is blank, we got the user from LDAP or PAM,
93-
# so credentials are already valid
94-
95-
prompt_for_two_factor(user)
96-
end
97-
end
98-
99-
def authenticate_with_two_factor_via_otp(user)
100-
if valid_otp_attempt?(user)
101-
session.delete(:otp_user_id)
102-
remember_me(user)
103-
sign_in(user)
104-
else
105-
flash.now[:alert] = I18n.t('users.invalid_otp_token')
106-
prompt_for_two_factor(user)
107-
end
108-
end
109-
110-
def prompt_for_two_factor(user)
111-
session[:otp_user_id] = user.id
112-
@body_classes = 'lighter'
113-
render :two_factor
114-
end
115-
11676
def require_no_authentication
11777
super
11878
# Delete flash message that isn't entirely useful and may be confusing in

‎app/controllers/concerns/sign_in_token_authentication_concern.rb‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# frozen_string_literal: true
2+
3+
module SignInTokenAuthenticationConcern
4+
extend ActiveSupport::Concern
5+
6+
included do
7+
prepend_before_action :authenticate_with_sign_in_token, if: :sign_in_token_required?, only: [:create]
8+
end
9+
10+
def sign_in_token_required?
11+
find_user&.suspicious_sign_in?(request.remote_ip)
12+
end
13+
14+
def valid_sign_in_token_attempt?(user)
15+
Devise.secure_compare(user.sign_in_token, user_params[:sign_in_token_attempt])
16+
end
17+
18+
def authenticate_with_sign_in_token
19+
user = self.resource = find_user
20+
21+
if user_params[:sign_in_token_attempt].present? && session[:attempt_user_id]
22+
authenticate_with_sign_in_token_attempt(user)
23+
elsif user.present? && user.external_or_valid_password?(user_params[:password])
24+
prompt_for_sign_in_token(user)
25+
end
26+
end
27+
28+
def authenticate_with_sign_in_token_attempt(user)
29+
if valid_sign_in_token_attempt?(user)
30+
session.delete(:attempt_user_id)
31+
remember_me(user)
32+
sign_in(user)
33+
else
34+
flash.now[:alert] = I18n.t('users.invalid_sign_in_token')
35+
prompt_for_sign_in_token(user)
36+
end
37+
end
38+
39+
def prompt_for_sign_in_token(user)
40+
if user.sign_in_token_expired?
41+
user.generate_sign_in_token && user.save
42+
UserMailer.sign_in_token(user, request.remote_ip, request.user_agent, Time.now.utc.to_s).deliver_later!
43+
end
44+
45+
session[:attempt_user_id] = user.id
46+
@body_classes = 'lighter'
47+
render :sign_in_token
48+
end
49+
end

‎app/controllers/concerns/two_factor_authentication_concern.rb‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# frozen_string_literal: true
2+
3+
module TwoFactorAuthenticationConcern
4+
extend ActiveSupport::Concern
5+
6+
included do
7+
prepend_before_action :authenticate_with_two_factor, if: :two_factor_enabled?, only: [:create]
8+
end
9+
10+
def two_factor_enabled?
11+
find_user&.otp_required_for_login?
12+
end
13+
14+
def valid_otp_attempt?(user)
15+
user.validate_and_consume_otp!(user_params[:otp_attempt]) ||
16+
user.invalidate_otp_backup_code!(user_params[:otp_attempt])
17+
rescue OpenSSL::Cipher::CipherError
18+
false
19+
end
20+
21+
def authenticate_with_two_factor
22+
user = self.resource = find_user
23+
24+
if user_params[:otp_attempt].present? && session[:attempt_user_id]
25+
authenticate_with_two_factor_attempt(user)
26+
elsif user.present? && user.external_or_valid_password?(user_params[:password])
27+
prompt_for_two_factor(user)
28+
end
29+
end
30+
31+
def authenticate_with_two_factor_attempt(user)
32+
if valid_otp_attempt?(user)
33+
session.delete(:attempt_user_id)
34+
remember_me(user)
35+
sign_in(user)
36+
else
37+
flash.now[:alert] = I18n.t('users.invalid_otp_token')
38+
prompt_for_two_factor(user)
39+
end
40+
end
41+
42+
def prompt_for_two_factor(user)
43+
session[:attempt_user_id] = user.id
44+
@body_classes = 'lighter'
45+
render :two_factor
46+
end
47+
end

‎app/mailers/user_mailer.rb‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,4 +126,21 @@ def warning(user, warning, status_ids = nil)
126126
reply_to: Setting.site_contact_email
127127
end
128128
end
129+
130+
def sign_in_token(user, remote_ip, user_agent, timestamp)
131+
@resource = user
132+
@instance = Rails.configuration.x.local_domain
133+
@remote_ip = remote_ip
134+
@user_agent = user_agent
135+
@detection = Browser.new(user_agent)
136+
@timestamp = timestamp.to_time.utc
137+
138+
return if @resource.disabled?
139+
140+
I18n.with_locale(@resource.locale || I18n.default_locale) do
141+
mail to: @resource.email,
142+
subject: I18n.t('user_mailer.sign_in_token.subject'),
143+
reply_to: Setting.site_contact_email
144+
end
145+
end
129146
end

‎app/models/user.rb‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@
3838
# chosen_languages :string is an Array
3939
# created_by_application_id :bigint(8)
4040
# approved :boolean default(TRUE), not null
41+
# sign_in_token :string
42+
# sign_in_token_sent_at :datetime
4143
#
4244

4345
class User < ApplicationRecord
@@ -114,7 +116,7 @@ class User < ApplicationRecord
114116
:advanced_layout, :use_blurhash, :use_pending_items, :trends, :crop_images,
115117
to: :settings, prefix: :setting, allow_nil: false
116118

117-
attr_reader :invite_code
119+
attr_reader :invite_code, :sign_in_token_attempt
118120
attr_writer :external
119121

120122
def confirmed?
@@ -168,6 +170,10 @@ def active_for_authentication?
168170
true
169171
end
170172

173+
def suspicious_sign_in?(ip)
174+
!otp_required_for_login? && current_sign_in_at.present? && current_sign_in_at < 2.weeks.ago && !recent_ip?(ip)
175+
end
176+
171177
def functional?
172178
confirmed? && approved? && !disabled? && !account.suspended? && account.moved_to_account_id.nil?
173179
end
@@ -270,6 +276,13 @@ def password_required?
270276
super
271277
end
272278

279+
def external_or_valid_password?(compare_password)
280+
# If encrypted_password is blank, we got the user from LDAP or PAM,
281+
# so credentials are already valid
282+
283+
encrypted_password.blank? || valid_password?(compare_password)
284+
end
285+
273286
def send_reset_password_instructions
274287
return false if encrypted_password.blank?
275288

@@ -305,6 +318,15 @@ def recent_ips
305318
end
306319
end
307320

321+
def sign_in_token_expired?
322+
sign_in_token_sent_at.nil? || sign_in_token_sent_at < 5.minutes.ago
323+
end
324+
325+
def generate_sign_in_token
326+
self.sign_in_token = Devise.friendly_token(6)
327+
self.sign_in_token_sent_at = Time.now.utc
328+
end
329+
308330
protected
309331

310332
def send_devise_notification(notification, *args)
@@ -321,6 +343,10 @@ def send_devise_notification(notification, *args)
321343

322344
private
323345

346+
def recent_ip?(ip)
347+
recent_ips.any? { |(_, recent_ip)| recent_ip == ip }
348+
end
349+
324350
def send_pending_devise_notifications
325351
pending_devise_notifications.each do |notification, args|
326352
render_and_send_devise_message(notification, *args)

‎app/views/auth/sessions/sign_in_token.html.haml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
- content_for :page_title do
2+
= t('auth.login')
3+
4+
= simple_form_for(resource, as: resource_name, url: session_path(resource_name), method: :post) do |f|
5+
%p.hint.otp-hint= t('users.suspicious_sign_in_confirmation')
6+
7+
.fields-group
8+
= f.input :sign_in_token_attempt, type: :number, wrapper: :with_label, label: t('simple_form.labels.defaults.sign_in_token_attempt'), input_html: { 'aria-label' => t('simple_form.labels.defaults.sign_in_token_attempt'), :autocomplete => 'off' }, autofocus: true
9+
10+
.actions
11+
= f.button :button, t('auth.login'), type: :submit
12+
13+
- if Setting.site_contact_email.present?
14+
%p.hint.subtle-hint= t('users.generic_access_help_html', email: mail_to(Setting.site_contact_email, nil))

‎app/views/user_mailer/sign_in_token.html.haml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
%table.email-table{ cellspacing: 0, cellpadding: 0 }
2+
%tbody
3+
%tr
4+
%td.email-body
5+
.email-container
6+
%table.content-section{ cellspacing: 0, cellpadding: 0 }
7+
%tbody
8+
%tr
9+
%td.content-cell.hero
10+
.email-row
11+
.col-6
12+
%table.column{ cellspacing: 0, cellpadding: 0 }
13+
%tbody
14+
%tr
15+
%td.column-cell.text-center.padded
16+
%table.hero-icon.alert-icon{ align: 'center', cellspacing: 0, cellpadding: 0 }
17+
%tbody
18+
%tr
19+
%td
20+
= image_tag full_pack_url('media/images/mailer/icon_email.png'), alt: ''
21+
22+
%h1= t 'user_mailer.sign_in_token.title'
23+
%p.lead= t 'user_mailer.sign_in_token.explanation'
24+
25+
%table.email-table{ cellspacing: 0, cellpadding: 0 }
26+
%tbody
27+
%tr
28+
%td.email-body
29+
.email-container
30+
%table.content-section{ cellspacing: 0, cellpadding: 0 }
31+
%tbody
32+
%tr
33+
%td.content-cell.content-start
34+
%table.column{ cellspacing: 0, cellpadding: 0 }
35+
%tbody
36+
%tr
37+
%td.column-cell.input-cell
38+
%table.input{ align: 'center', cellspacing: 0, cellpadding: 0 }
39+
%tbody
40+
%tr
41+
%td= @resource.sign_in_token
42+
43+
%table.email-table{ cellspacing: 0, cellpadding: 0 }
44+
%tbody
45+
%tr
46+
%td.email-body
47+
.email-container
48+
%table.content-section{ cellspacing: 0, cellpadding: 0 }
49+
%tbody
50+
%tr
51+
%td.content-cell
52+
.email-row
53+
.col-6
54+
%table.column{ cellspacing: 0, cellpadding: 0 }
55+
%tbody
56+
%tr
57+
%td.column-cell.text-center
58+
%p= t 'user_mailer.sign_in_token.details'
59+
%tr
60+
%td.column-cell.text-center
61+
%p
62+
%strong= "#{t('sessions.ip')}:"
63+
= @remote_ip
64+
%br/
65+
%strong= "#{t('sessions.browser')}:"
66+
%span{ title: @user_agent }= t 'sessions.description', browser: t("sessions.browsers.#{@detection.id}", default: "#{@detection.id}"), platform: t("sessions.platforms.#{@detection.platform.id}", default: "#{@detection.platform.id}")
67+
%br/
68+
= l(@timestamp)
69+
70+
%table.email-table{ cellspacing: 0, cellpadding: 0 }
71+
%tbody
72+
%tr
73+
%td.email-body
74+
.email-container
75+
%table.content-section{ cellspacing: 0, cellpadding: 0 }
76+
%tbody
77+
%tr
78+
%td.content-cell
79+
.email-row
80+
.col-6
81+
%table.column{ cellspacing: 0, cellpadding: 0 }
82+
%tbody
83+
%tr
84+
%td.column-cell.text-center
85+
%p= t 'user_mailer.sign_in_token.further_actions'
86+
87+
%table.email-table{ cellspacing: 0, cellpadding: 0 }
88+
%tbody
89+
%tr
90+
%td.email-body
91+
.email-container
92+
%table.content-section{ cellspacing: 0, cellpadding: 0 }
93+
%tbody
94+
%tr
95+
%td.content-cell
96+
%table.column{ cellspacing: 0, cellpadding: 0 }
97+
%tbody
98+
%tr
99+
%td.column-cell.button-cell
100+
%table.button{ align: 'center', cellspacing: 0, cellpadding: 0 }
101+
%tbody
102+
%tr
103+
%td.button-primary
104+
= link_to edit_user_registration_url do
105+
%span= t 'settings.account_settings'

0 commit comments

Comments
 (0)
⚡