Skip to content

Commit 062d9d4

Browse files
DominicWatsonDominicWatson
committed
Merge branch 'feature-PRESIDECMS-2794_use-cookie-for-2fa-admin-persistence' into release-10.28.0
2 parents 928ec86 + 9495576 commit 062d9d4

File tree

8 files changed

+34
-52
lines changed

8 files changed

+34
-52
lines changed

‎system/base/AdminHandler.cfc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ component {
4545

4646
if ( !loginExcempt ) {
4747
var isAdminUser = event.isAdminUser();
48-
var isAuthenticated = isAdminUser && !loginService.twoFactorAuthenticationRequired( ipAddress = event.getClientIp(), userAgent = event.getUserAgent() );
48+
var isAuthenticated = isAdminUser && !loginService.twoFactorAuthenticationRequired();
4949

5050
if ( !isAuthenticated ) {
5151
if ( event.isAjax() ) {

‎system/coldboxModifications/RequestContextDecorator.cfc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -562,7 +562,7 @@ component accessors=true extends="preside.system.coldboxModifications.RequestCon
562562

563563
announceInterception( "onAdminLoginSuccess" );
564564

565-
if ( getModel( "loginService" ).twoFactorAuthenticationRequired( ipAddress = getClientIp(), userAgent = getUserAgent() ) ) {
565+
if ( getModel( "loginService" ).twoFactorAuthenticationRequired() ) {
566566
getController().relocate( url=buildAdminLink( linkto="login.twoStep" ), persistStruct={ postLoginUrl = postLoginUrl } );
567567
}
568568

‎system/forms/system-config/admin-login-security.xml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ This form is used for managing settings for two factor authentication, admin 're
1313
</tab>
1414
<tab id="2fa" sortorder="20" feature="twoFactorAuthentication">
1515
<fieldset id="2fa" sortorder="10">
16-
<field name="tfa_enabled" control="yesNoSwitch" required="false" />
17-
<field name="tfa_app_name" control="textinput" required="false" />
18-
<field name="tfa_enforced" control="yesNoSwitch" required="false" />
19-
<field name="tfa_trust_period" control="spinner" required="false" defaultvalue="7" minValue="0"/>
16+
<field name="tfa_enabled" control="yesNoSwitch" required="false" />
17+
<field name="tfa_app_name" control="textinput" required="false" />
18+
<field name="tfa_enforced" control="yesNoSwitch" required="false" />
19+
<field name="tfa_trust_period" control="spinner" required="false" defaultvalue="7" minValue="0"/>
2020
</fieldset>
2121
</tab>
2222
</form>

‎system/handlers/admin/EditProfile.cfc‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -161,11 +161,7 @@ component extends="preside.system.base.AdminHandler" {
161161
var authToken = formData.oneTimeToken ?: "";
162162

163163
if ( validationResult.validated() ) {
164-
var authVerified = loginService.attemptTwoFactorAuthentication(
165-
token = authToken
166-
, ipAddress = event.getClientIp()
167-
, userAgent = event.getUserAgent()
168-
);
164+
var authVerified = loginService.attemptTwoFactorAuthentication( token=authToken );
169165

170166
if ( authVerified ) {
171167
loginService.enableTwoFactorAuthenticationForUser();

‎system/handlers/admin/Login.cfc‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ component extends="preside.system.base.AdminHandler" {
7070
if ( !event.isAdminUser() ){
7171
setNextEvent( url=event.buildAdminLink( linkTo="login" ) );
7272
}
73-
if ( !loginService.twoFactorAuthenticationRequired( ipAddress = event.getClientIp(), userAgent = event.getUserAgent() ) ) {
73+
if ( !loginService.twoFactorAuthenticationRequired() ) {
7474
_redirectToDefaultAdminEvent( event );
7575
}
7676

@@ -91,17 +91,13 @@ component extends="preside.system.base.AdminHandler" {
9191
if ( !event.isAdminUser() ){
9292
setNextEvent( url=event.buildAdminLink( linkTo="login" ) );
9393
}
94-
if ( !loginService.twoFactorAuthenticationRequired( ipAddress = event.getClientIp(), userAgent = event.getUserAgent() ) ) {
94+
if ( !loginService.twoFactorAuthenticationRequired() ) {
9595
_redirectToDefaultAdminEvent( event );
9696
}
9797

9898
var postLoginUrl = event.getValue( name="postLoginUrl", defaultValue="" );
9999
var unsavedData = sessionStorage.getVar( "_unsavedFormData", {} );
100-
var authenticated = loginService.attemptTwoFactorAuthentication(
101-
token = ( rc.oneTimeToken ?: "" )
102-
, ipAddress = event.getClientIp()
103-
, userAgent = event.getUserAgent()
104-
);
100+
var authenticated = loginService.attemptTwoFactorAuthentication( token=( rc.oneTimeToken ?: "" ) );
105101

106102
if ( authenticated ) {
107103
if ( Len( Trim( postLoginUrl ) ) ) {

‎system/preside-objects/admin/security/security_user_two_factor_login_record.cfc‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,7 @@
99
* @feature twoFactorAuthentication
1010
*/
1111
component extends="preside.system.base.SystemPresideObject" displayName="User 2FA Login record" {
12-
property name="security_user" relationship="many-to-one" relatedTo="security_user" required=true uniqueindexes="user_machine|1";
12+
property name="security_user" relationship="many-to-one" relatedTo="security_user" required=true;
1313

14-
property name="ip_address" type="string" dbtype="varchar" maxLength="50" required=true uniqueindexes="user_machine|2";
15-
property name="user_agent" type="string" dbtype="varchar" maxLength="255" required=true uniqueindexes="user_machine|3";
16-
property name="logged_in_date" type="datetime" dbtype="datetime" required=false;
14+
property name="logged_in_date" type="datetime" dbtype="datetime" required=false;
1715
}

‎system/services/admin/LoginService.cfc‎

Lines changed: 21 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ component displayName="Admin login service" {
4444
_setCookieService( arguments.cookieService );
4545
_setQrCodeGenerator( arguments.qrCodeGenerator );
4646
_setRememberMeCookieKey( "_presidecms-admin-persist" );
47+
_setTwoFactorAuthCookiePersistKey( "_presidecms-admin-tfa-persist" );
4748

4849
return this;
4950
}
@@ -481,11 +482,9 @@ component displayName="Admin login service" {
481482
* by the user and whether or not the user is already authenticated.
482483
*
483484
* @autodoc
484-
* @ipAddress.hint The originating IP address of the request
485-
* @userAgent.hint The originating user agent of the request
486485
*/
487-
public boolean function twoFactorAuthenticationRequired( required string ipAddress, required string userAgent ) {
488-
if ( isTwoFactorAuthenticated( argumentCollection=arguments ) ) {
486+
public boolean function twoFactorAuthenticationRequired() {
487+
if ( isTwoFactorAuthenticated() ) {
489488
return false;
490489
}
491490

@@ -506,10 +505,8 @@ component displayName="Admin login service" {
506505
* authentication.
507506
*
508507
* @autodoc
509-
* @ipAddress.hint The originating IP address of the request
510-
* @userAgent.hint The originating user agent of the request
511508
*/
512-
public boolean function isTwoFactorAuthenticated( required string ipAddress, required string userAgent ) {
509+
public boolean function isTwoFactorAuthenticated() {
513510
var authenticated = _getSessionStorage().getVar( name=_getTwoFaSessionKey(), default="" );
514511

515512
if ( IsBoolean( authenticated ?: "" ) && authenticated ) {
@@ -525,9 +522,8 @@ component displayName="Admin login service" {
525522
selectFields = [ "logged_in_date" ]
526523
, filter = {
527524
security_user = getLoggedInUserId()
528-
, ip_address = arguments.ipAddress
529-
, user_agent = arguments.userAgent
530-
}
525+
, id = _getCookieService().getVar( name=_getTwoFactorAuthCookiePersistKey(), default="" )
526+
}
531527
);
532528

533529
if ( !tfaLoginRecord.recordCount ) {
@@ -654,11 +650,9 @@ component displayName="Admin login service" {
654650
*
655651
* @autodoc
656652
* @token.hint The user provided one time token (should have been generated by authenticator app)
657-
* @ipAddress.hint The IP address of the incoming request
658-
* @userAgent.hint The user agent ot the incoming request
659653
*
660654
*/
661-
public boolean function attemptTwoFactorAuthentication( required string token, required string ipAddress, required string userAgent ) {
655+
public boolean function attemptTwoFactorAuthentication( required string token ) {
662656
var userId = getLoggedInUserId();
663657
var key = getTwoFactorAuthenticationKey();
664658

@@ -677,21 +671,12 @@ component displayName="Admin login service" {
677671
two_step_auth_key_in_use = true
678672
} );
679673

680-
var loginRecordDao = $getPresideObject( "security_user_two_factor_login_record" );
681-
var updated = loginRecordDao.updateData( filter={
682-
security_user = userId
683-
, ip_address = arguments.ipAddress
684-
, user_agent = arguments.userAgent
685-
}, data={ logged_in_date=Now() } );
686-
687-
if ( !updated ) {
688-
loginRecordDao.insertData({
689-
security_user = userId
690-
, ip_address = arguments.ipAddress
691-
, user_agent = arguments.userAgent
692-
, logged_in_date = Now()
693-
});
694-
}
674+
var loginRecordId = $getPresideObject( "security_user_two_factor_login_record" ).insertData( {
675+
security_user = userId
676+
, logged_in_date = Now()
677+
} );
678+
679+
_getCookieService().setVar( name=_getTwoFactorAuthCookiePersistKey(), value=loginRecordId );
695680

696681
$audit(
697682
userId = userId
@@ -1056,4 +1041,12 @@ component displayName="Admin login service" {
10561041
_rememberMeCookieKey = arguments.rememberMeCookieKey;
10571042
}
10581043

1044+
private any function _getTwoFactorAuthCookiePersistKey(){
1045+
return variables._twoFactorAuthCookieKey;
1046+
}
1047+
1048+
private void function _setTwoFactorAuthCookiePersistKey( required any twoFactorAuthCookieKey ){
1049+
variables._twoFactorAuthCookieKey = arguments.twoFactorAuthCookieKey;
1050+
}
1051+
10591052
}

‎system/views/general/_adminToolbar.cfm‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
prc.adminToolbarDisplayMode = prc.adminToolbarDisplayMode ?: getSystemSetting( "frontend-editing", "admin_toolbar_mode", "fixed" );
55
}
66
</cfscript>
7-
<cfif event.isAdminUser() and !getModel( "loginService" ).twoFactorAuthenticationRequired( ipAddress=event.getClientIp(), userAgent=event.getUserAgent() ) and prc.adminToolbarDisplayMode neq "none">
7+
<cfif event.isAdminUser() and !getModel( "loginService" ).twoFactorAuthenticationRequired() and prc.adminToolbarDisplayMode neq "none">
88
<cfscript>
99
prc.hasCmsPageEditPermissions = prc.hasCmsPageEditPermissions ?: hasCmsPermission( permissionKey="sitetree.edit", context="page", contextKeys=event.getPagePermissionContext() );
1010
prc.adminQuickEditDisabled = prc.adminQuickEditDisabled ?: isTrue( getSystemSetting( "frontend-editing", "disable_quick_edit" ) );
@@ -162,4 +162,3 @@
162162
#ckEditorJs#
163163
</cfoutput>
164164
</cfif>
165-

0 commit comments

Comments
 (0)