zydronium/enigma-bbs
1
0
Fork 0
mirror of https://github.com/NuSkooler/enigma-bbs.git synced 2025-06-06 12:47:13 +02:00
Code Issues Projects Releases Packages Wiki Activity

Don't store hashed versions of backup codes

Browse source 
* Really no point; secret must be in plain-text and only ever used in conjunction with pass/etc.
* Better oputil handling
This commit is contained in:
Bryan Ashby 2019-05-09 20:25:47 -06:00
parent 6070bc94e7
commit 2767f3c4e3
No known key found for this signature in database
GPG key ID: B49EB437951D2542
3 changed files with 39 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

29
core/oputil/oputil_user.js
View file

@ -373,7 +373,7 @@ function twoFactorAuth(user) {
qrType : argv['qr-type'] || 'ascii',
};
prepareOTP(otpType, otpOpts, (err, otpInfo) => {
return callback(err, otpInfo);
return callback(err, Object.assign(otpInfo, { otpType }));
});
},
function storeOrDisplayQR(otpInfo, callback) {
@ -381,20 +381,35 @@ function twoFactorAuth(user) {
return callback(null, otpInfo);
}
if('-' === argv.out) {
console.info(otpInfo.qr);
return callback(null, otpInfo);
}
fs.writeFile(argv.out, otpInfo.qr, 'utf8', err => {
return callback(err, otpInfo);
});
},
function persist(otpInfo, callback) {
const props = {
[ UserProps.AuthFactor2OTP ] : otpInfo.otpType,
[ UserProps.AuthFactor2OTPSecret ] : otpInfo.secret,
[ UserProps.AuthFactor2OTPBackupCodes ] : JSON.stringify(otpInfo.backupCodes),
};
user.persistProperties(props, err => {
return callback(err, otpInfo);
});
}
],
(err) => {
(err, otpInfo) => {
if(err) {
console.error(err.message);
} else {
console.info(`OTP enabled for ${user.username}.`);
console.info(`Secret: ${otpInfo.secret}`);
console.info(`Backup codes: ${otpInfo.backupCodes.join(', ')}`);
if(!argv.out) {
console.info('QR code:');
console.info(otpInfo.qr);
} else {
console.info(`QR code saved to ${argv.out}`);
}
}
}
);