mirror/FreshRSS
0
0
Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-05-19 05:44:39 -04:00
Code Issues Packages Projects Releases Wiki Activity

Implement sudo mode / reauthentication (#7753)

Browse Source 
* Implement sudo mode / reauthentication

* i18n: fr

* generate flags

* Improvements

* Remove HMAC check
* Don't require reauth to access logs when signed in as admin
* Notify user of bad login via notification instead

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
This commit is contained in:
Inverle
2025-07-31 13:53:14 +02:00
committed by GitHub
parent d0425f8c3a
commit 3ce64d271b
38 changed files with 323 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
app/Controllers/authController.php
View File

@@ -21,6 +21,10 @@ class FreshRSS_auth_Controller extends FreshRSS_ActionController {
Minz_Error::error(403);
}
if (FreshRSS_Auth::requestReauth()) {
return;
}
FreshRSS_View::prependTitle(_t('admin.auth.title') . ' · ');
if (Minz_Request::isPost()) {
@@ -219,6 +223,35 @@ class FreshRSS_auth_Controller extends FreshRSS_ActionController {
}
}
public function reauthAction(): void {
if (!FreshRSS_Auth::hasAccess()) {
Minz_Error::error(403);
return;
}
/** @var array{c?: string, a?: string, params?: array<string, mixed>} $redirect */
$redirect = Minz_Url::unserialize(Minz_Request::paramString('r'));
if (!FreshRSS_Auth::needsReauth()) {
Minz_Request::forward($redirect, true);
return;
}
if (Minz_Request::isPost()) {
$username = Minz_User::name() ?? '';
$nonce = Minz_Session::paramString('nonce');
$challenge = Minz_Request::paramString('challenge');
if (!FreshRSS_FormAuth::checkCredentials(
$username, FreshRSS_Context::userConf()->passwordHash, $nonce, $challenge
)) {
Minz_Request::setBadNotification(_t('feedback.auth.login.invalid'));
} else {
Minz_Session::_param('lastReauth', time());
Minz_Request::forward($redirect, true);
return;
}
}
FreshRSS_View::prependTitle(_t('gen.auth.reauth.title') . ' · ');
FreshRSS_View::appendScript(Minz_Url::display('/scripts/vendor/bcrypt.js?' . @filemtime(PUBLIC_PATH . '/scripts/vendor/bcrypt.js')));
}
/**
* This action removes all accesses of the current user.
*/