login: allow password to contain totp code
This commit is contained in:
parent
80bea81bfc
commit
2fcacd5074
|
@ -27,8 +27,17 @@ class LoginController < ApplicationController
|
||||||
raise "no user"
|
raise "no user"
|
||||||
end
|
end
|
||||||
|
|
||||||
if !user.try(:authenticate, params[:password].to_s)
|
if !user.authenticate(params[:password].to_s)
|
||||||
raise "authentication failed"
|
# if the user has 2fa enabled and the password looks like it has a totp
|
||||||
|
# code attached, separate them
|
||||||
|
if user.has_2fa? &&
|
||||||
|
(m = params[:password].to_s.match(/\A(.+):(\d+)\z/)) &&
|
||||||
|
user.authenticate(m[1])
|
||||||
|
params[:password] = m[1]
|
||||||
|
params[:totp] = m[2]
|
||||||
|
else
|
||||||
|
raise "authentication failed"
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
if user.is_banned?
|
if user.is_banned?
|
||||||
|
@ -48,7 +57,9 @@ class LoginController < ApplicationController
|
||||||
|
|
||||||
if user.has_2fa?
|
if user.has_2fa?
|
||||||
if params[:totp].present?
|
if params[:totp].present?
|
||||||
if !user.authenticate_totp(params[:totp])
|
if user.authenticate_totp(params[:totp])
|
||||||
|
# ok, fall through
|
||||||
|
else
|
||||||
raise "invalid TOTP code"
|
raise "invalid TOTP code"
|
||||||
end
|
end
|
||||||
else
|
else
|
||||||
|
|
Loading…
Reference in a new issue