mirror/FreshRSS
0
0
Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-05-19 05:44:39 -04:00
Code Issues Packages Projects Releases Wiki Activity

Implement sudo mode / reauthentication (#7753)

Browse Source 
* Implement sudo mode / reauthentication

* i18n: fr

* generate flags

* Improvements

* Remove HMAC check
* Don't require reauth to access logs when signed in as admin
* Notify user of bad login via notification instead

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
This commit is contained in:
Inverle
2025-07-31 13:53:14 +02:00
committed by GitHub
parent d0425f8c3a
commit 3ce64d271b
38 changed files with 323 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
app/Controllers/userController.php
View File

@@ -72,6 +72,10 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
}
if (Minz_Request::isPost()) {
if (self::reauthRedirect()) {
return;
}
$username = Minz_Request::paramString('username');
$newPasswordPlain = Minz_User::name() !== $username ? Minz_Request::paramString('newPasswordPlain', true) : '';
@@ -190,21 +194,41 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
}
}
public static function reauthRedirect(): bool {
$url_redirect = [
'c' => 'user',
'a' => 'manage',
'params' => [],
];
$username = Minz_Request::paramStringNull('username');
if ($username !== null) {
$url_redirect['a'] = 'details';
$url_redirect['params']['username'] = $username;
}
return FreshRSS_Auth::requestReauth($url_redirect);
}
public function purgeAction(): void {
if (!FreshRSS_Auth::hasAccess('admin')) {
Minz_Error::error(403);
}
if (Minz_Request::isPost()) {
$username = Minz_Request::paramString('username');
if (!FreshRSS_UserDAO::exists($username)) {
Minz_Error::error(404);
}
$feedDAO = FreshRSS_Factory::createFeedDao($username);
$feedDAO->purge();
if (!Minz_Request::isPost()) {
Minz_Error::error(403);
}
if (self::reauthRedirect()) {
return;
}
$username = Minz_Request::paramString('username');
if (!FreshRSS_UserDAO::exists($username)) {
Minz_Error::error(404);
}
$feedDAO = FreshRSS_Factory::createFeedDao($username);
$feedDAO->purge();
}
/**
@@ -215,6 +239,10 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
Minz_Error::error(403);
}
if (self::reauthRedirect()) {
return;
}
FreshRSS_View::prependTitle(_t('admin.user.title') . ' · ');
if (Minz_Request::isPost()) {
@@ -337,6 +365,10 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
Minz_Error::error(403);
}
if (self::reauthRedirect()) {
return;
}
if (Minz_Request::isPost()) {
$new_user_name = Minz_Request::paramString('new_user_name');
$email = Minz_Request::paramString('new_user_email');
@@ -602,7 +634,10 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
$username, FreshRSS_Context::userConf()->passwordHash,
$nonce, $challenge
);
} elseif (self::reauthRedirect()) {
return;
}
if ($ok) {
$ok &= self::deleteUser($username);
}
@@ -647,6 +682,10 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
Minz_Error::error(403);
}
if (self::reauthRedirect()) {
return;
}
$username = Minz_Request::paramString('username');
if (!FreshRSS_UserDAO::exists($username)) {
Minz_Error::error(404);
@@ -682,6 +721,10 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
Minz_Error::error(403);
}
if (self::reauthRedirect()) {
return;
}
$username = Minz_Request::paramString('username');
if (!FreshRSS_UserDAO::exists($username)) {
Minz_Error::error(404);