[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] TOTP input not shown when accessing tiki-login.php in a fresh browser session
"Merci Jacob \(@mercihabam\) via TikiWiki-cvs" <[email protected]>
| Newsgroups | gmane.comp.cms.tiki.cvs |
|---|---|
| Message-ID | <694977032e77f_2a17fcdc86737@gitlab-sidekiq-low-urgency-cpu-bound-v2-f5d996fcf-gn45x.mail> |
Merci Jacob pushed to branch master at Tiki Wiki CMS Groupware / Tiki
Commits:
bebd5f87 by Merci Jacob at 2025-12-22T16:42:46+00:00
[FIX] TOTP input not shown when accessing tiki-login.php in a fresh browser session
---
* fix linter
* 1. refactor the 'Feedback::errorAndDie' method, redirecting to the login url when necessary, allowing all required variables to be computed in the login template
2. avoid displaying the login template through error.tpl
3. replace some occurrences of error.tpl alongside a 401 status with an appropriate call to 'Feedback::errorAndDie'
* die with a 403 satus when cookies are not detected
* cleanup variable assignement so its value can be understandable
* [FIX] TOTP input not shown when accessing tiki-login.php in a fresh browser session
See merge request tikiwiki/tiki!9161
- - - - -
9 changed files:
- lib/comments/commentslib.php
- lib/core/Feedback.php
- lib/tikiaccesslib.php
- templates/error.tpl
- templates/modules/mod-login_box.tpl
- templates/tiki-login.tpl
- tiki-live_support_admin.php
- tiki-login.php
- tiki-login_scr.php
Changes:
=====================================
lib/comments/commentslib.php
=====================================
@@ -126,10 +126,7 @@ class Comments extends TikiLib
|| ($forum_info['att'] == 'att_admin' && $perms->admin_forum == 'y')
|| ($forum_info['att'] == 'att_perm' && $perms->forum_attach == 'y'))
) {
- $smarty = TikiLib::lib('smarty');
- $smarty->assign('errortype', 401);
- $smarty->assign('msg', tra('Permission denied'));
- $smarty->display("error.tpl");
+ Feedback::errorAndDie(tra('Permission denied'), 401);
die;
}
if (! empty($prefs['forum_match_regex']) && ! preg_match($prefs['forum_match_regex'], $name)) {
=====================================
lib/core/Feedback.php
=====================================
@@ -79,6 +79,20 @@ class Feedback
public static function errorAndDie(string $message, int $httpCode, ?string $errorPage = null): never
{
+ global $access, $user, $prefs;
+ if (($httpCode == 401 || $httpCode == 403) && ! $user && $prefs['permission_denied_login_box'] == 'y') {
+ if ($prefs['login_autologin'] == 'y' && $prefs['login_autologin_redirectlogin'] == 'y' && ! empty($prefs['login_autologin_redirectlogin_url'])) {
+ $url = $prefs['login_autologin_redirectlogin_url'];
+ } else {
+ $url = $prefs['permission_denied_url'] ?: 'tiki-login.php';
+ }
+
+ $_SESSION['loginfrom'] = $_SERVER['REQUEST_URI'];
+
+ $access->redirect($url, $message, msgtype: 'error');
+ die;
+ }
+
$errorPage = $errorPage ?? "error.tpl";
$smarty = TikiLib::lib('smarty');
$smarty->assign('errortype', $httpCode);
=====================================
lib/tikiaccesslib.php
=====================================
@@ -1041,27 +1041,11 @@ class TikiAccessLib extends TikiLib
$smarty->assign('errortype', \Laminas\Http\Response::STATUS_CODE_409);
$smarty->display('error-ajax.tpl');
} else {
- if (
- ($errortype == 401 || $errortype == 403) &&
- empty($user) &&
- ($prefs['permission_denied_login_box'] == 'y' || ! empty($prefs['permission_denied_url']))
- ) {
- if (empty($_SESSION['loginfrom'])) {
- $_SESSION['loginfrom'] = $_SERVER['REQUEST_URI'];
- }
- if ($prefs['login_autologin'] == 'y' && $prefs['login_autologin_redirectlogin'] == 'y' && ! empty($prefs['login_autologin_redirectlogin_url'])) {
- $this->redirect($prefs['login_autologin_redirectlogin_url']);
- }
- }
-
$smarty->assign('errortitle', $detail['errortitle']);
- $smarty->assign('msg', $detail['message']);
- $smarty->assign('errortype', $detail['code']);
- $smarty->assign('twoFactorForm', $prefs['twoFactorAuth']);
if (isset($detail['page'])) {
$smarty->assign('page', $page);
}
- $smarty->display("error.tpl");
+ Feedback::errorAndDie($detail['message'], $errortype);
}
die;
}
=====================================
templates/error.tpl
=====================================
@@ -4,8 +4,7 @@
close();
{/jq}
{/if}
-{* 402: need login
- * 401, 403: perm
+{*
* 404: page does not exist
* no_redirect_login: error antibot, system...
* login: error login
@@ -15,102 +14,86 @@ close();
{if !isset($errortype)}{$errortype=''}{/if}
{capture assign=mid_data}
- {if ($errortype eq "402")}
- {include file='tiki-login.tpl'}
- {elseif ($errortype eq 401 or $errortype eq 403) and !empty($prefs.permission_denied_url) and $prefs.permission_denied_login_box ne 'y'}
- {redirect url=$prefs.permission_denied_url}
- {else}
+ {$errortitle="{tr}Error{/tr}"}
- {if ($errortype eq 401 || $errortype eq 403) && empty($user) and $prefs.permission_denied_login_box eq 'y'} {* permission denied *}
- {$errortitle="{tr}Please log in{/tr}"}
- {else}
- {$errortitle="{tr}Error{/tr}"}
+ {if $errortype eq "404" and isset($file_error)}
+ {remarksbox type='errors' title="{tr}File error{/tr}"}
+ {$file_error|escape}
+ {/remarksbox}
+ {elseif $errortype eq "404" and isset($page)}
+ {remarksbox type='errors' title=$errortitle}
+ {tr}Page not found{/tr}<br>{$page|escape}
+ {/remarksbox}
+ {if $prefs.feature_likePages eq 'y'}
+ {if $likepages}
+ <p>{tr}Perhaps you are looking for:{/tr}</p>
+ <ul>
+ {section name=back loop=$likepages}
+ <li><a href="{$likepages[back]|sefurl:"wiki"}" class="wiki">{$likepages[back]|escape}</a></li>
+ {/section}
+ </ul>
+ {else}
+ {remarksbox type="tip" title="{tr}Information{/tr}"}
+ {tr}There are no wiki pages similar to '{$page|escape}'{/tr}
+ {/remarksbox}
+ {/if}
{/if}
- {if $errortype eq "404" and isset($file_error)}
- {remarksbox type='errors' title="{tr}File error{/tr}"}
- {$file_error|escape}
+ {if $prefs.feature_search eq 'y' && $tiki_p_search eq 'y'}
+ {include file='tiki-searchindex_form.tpl' searchNoResults="true" searchStyle="menu" searchOrientation="horiz" words="$page" filter=$filter}
+ {/if}
+ {elseif $commenttype eq "note" and isset($msg)}
+ {remarksbox type='note' title=$title}
+ {$msg|safe_html}
+ {/remarksbox}
+ {else}
+ {if isset($token_error)}
+ {remarksbox type='errors' title="{tr}Token Error{/tr}"}
+ {$token_error|escape}
{/remarksbox}
- {elseif $errortype eq "404" and isset($page)}
+ {elseif !isset($user) and $errortype != 'no_redirect_login' and $errortype != 'login' and empty($msg)}
{remarksbox type='errors' title=$errortitle}
- {tr}Page not found{/tr}<br>{$page|escape}
+ {tr}You are not logged in.{/tr} <a href="tiki-login_scr.php" class="alert-link">{tr}Go to Log in Page{/tr}</a>
{/remarksbox}
- {if $prefs.feature_likePages eq 'y'}
- {if $likepages}
- <p>{tr}Perhaps you are looking for:{/tr}</p>
- <ul>
- {section name=back loop=$likepages}
- <li><a href="{$likepages[back]|sefurl:"wiki"}" class="wiki">{$likepages[back]|escape}</a></li>
- {/section}
- </ul>
- {else}
- {remarksbox type="tip" title="{tr}Information{/tr}"}
- {tr}There are no wiki pages similar to '{$page|escape}'{/tr}
+ {else}
+ {remarksbox type='errors' title=$errortitle}
+ {$msg|safe_html}
+ {if !empty($required_preferences)}
+ {remarksbox type='note' title="{tr}Settings{/tr}" close="n"}
+ <form method="post" action="tiki-admin.php" class="form">
+ {ticket}
+ {foreach from=$required_preferences item=pref}
+ {preference name=$pref visible="always"}
+ {/foreach}
+ <div class="text-center">
+ <input type="submit" class="btn btn-primary" value="{tr}Apply{/tr}">
+ </div>
+ {if isset($gobackto)}
+ <input type="hidden" name="gobackto" value="{$gobackto|escape}">
+ {/if}
+ </form>
{/remarksbox}
{/if}
- {/if}
-
- {if $prefs.feature_search eq 'y' && $tiki_p_search eq 'y'}
- {include file='tiki-searchindex_form.tpl' searchNoResults="true" searchStyle="menu" searchOrientation="horiz" words="$page" filter=$filter}
- {/if}
- {elseif $commenttype eq "note" and isset($msg)}
- {remarksbox type='note' title=$title}
- {$msg|safe_html}
{/remarksbox}
- {else}
- {if isset($token_error)}
- {remarksbox type='errors' title="{tr}Token Error{/tr}"}
- {$token_error|escape}
- {/remarksbox}
- {elseif ($errortype eq 401 || $errortype eq 403) && empty($user) and $prefs.permission_denied_login_box eq 'y'} {* permission denied *}
- {remarksbox type='errors' title=$errortitle}
- {tr}Permission denied{/tr}
- {/remarksbox}
- {include file='tiki-login.tpl'}
- {elseif !isset($user) and $errortype != 'no_redirect_login' and $errortype != 'login' and empty($msg)}
- {remarksbox type='errors' title=$errortitle}
- {tr}You are not logged in.{/tr} <a href="tiki-login_scr.php" class="alert-link">{tr}Go to Log in Page{/tr}</a>
- {/remarksbox}
- {else}
- {remarksbox type='errors' title=$errortitle}
- {$msg|safe_html}
- {if !empty($required_preferences)}
- {remarksbox type='note' title="{tr}Settings{/tr}" close="n"}
- <form method="post" action="tiki-admin.php" class="form">
- {ticket}
- {foreach from=$required_preferences item=pref}
- {preference name=$pref visible="always"}
- {/foreach}
- <div class="text-center">
- <input type="submit" class="btn btn-primary" value="{tr}Apply{/tr}">
- </div>
- {if isset($gobackto)}
- <input type="hidden" name="gobackto" value="{$gobackto|escape}">
- {/if}
- </form>
- {/remarksbox}
- {/if}
- {/remarksbox}
- {/if}
{/if}
+ {/if}
- {if isset($extraButton)}
- {remarksbox type='errors' title=$errortitle}
- {$extraButton.comment|safe_html}
- {button href=$extraButton.href _text=$extraButton.text}
- {/remarksbox}
- {/if}
+ {if isset($extraButton)}
+ {remarksbox type='errors' title=$errortitle}
+ {$extraButton.comment|safe_html}
+ {button href=$extraButton.href _text=$extraButton.text}
+ {/remarksbox}
+ {/if}
- {if isset($page) and $page and $create eq 'y' and ($tiki_p_admin eq 'y' or $tiki_p_admin_wiki eq 'y' or $tiki_p_edit eq 'y')}
- {button href="tiki-editpage.php?page=$page" _text="{tr}Create this page{/tr}"} <span class="ms-3">{tr}(page will be orphaned){/tr}</span>
- <br><br>
- {/if}
+ {if isset($page) and $page and $create eq 'y' and ($tiki_p_admin eq 'y' or $tiki_p_admin_wiki eq 'y' or $tiki_p_edit eq 'y')}
+ {button href="tiki-editpage.php?page=$page" _text="{tr}Create this page{/tr}"} <span class="ms-3">{tr}(page will be orphaned){/tr}</span>
+ <br><br>
+ {/if}
- {* Hide the error navigation on the homepage *}
- {if !isset($page) or $prefs.site_wikiHomePage neq $page}
- {button href=$prefs.tikiIndex _type="link" _icon_name="home" _text="{tr}Return to home page{/tr}"}
- {button _type="link" _icon_name="arrow-left" _onclick="javascript:history.back();return false;" _text="{tr}Go back{/tr}" _ajax="n"}
- {/if}
+ {* Hide the error navigation on the homepage *}
+ {if !isset($page) or $prefs.site_wikiHomePage neq $page}
+ {button href=$prefs.tikiIndex _type="link" _icon_name="home" _text="{tr}Return to home page{/tr}"}
+ {button _type="link" _icon_name="arrow-left" _onclick="javascript:history.back();return false;" _text="{tr}Go back{/tr}" _ajax="n"}
{/if}
{/capture}
=====================================
templates/modules/mod-login_box.tpl
=====================================
@@ -507,7 +507,7 @@ $(".collapse-toggle", ".siteloginbar_popup .dropdown-menu").on("click", function
|
{/if}
<li class="pass{if $mode eq 'popup'} dropdown-item{/if} list-item">
- <a href="tiki-login_scr.php?twoFactorForm" title="{if $prefs.twoFactorAuthType eq 'email2FA'}{tr}Login with 2FA{/tr}{else}{tr}Login with two-factor authenticator{/tr}{/if}">
+ <a href="tiki-login_scr.php?showTwoFactorForm" title="{if $prefs.twoFactorAuthType eq 'email2FA'}{tr}Login with 2FA{/tr}{else}{tr}Login with two-factor authenticator{/tr}{/if}">
{if $mode eq 'popup'}
{if $prefs.twoFactorAuthType eq 'email2FA'}{tr}Login with 2FA{/tr}{elseif $prefs.twoFactorAuthType eq 'google2FA'}{tr}Login with two-factor authenticator{/tr}{/if}
{/if}
=====================================
templates/tiki-login.tpl
=====================================
@@ -4,7 +4,7 @@
mode="module"
show_register="y"
show_forgot="y"
- show_two_factor_auth="{$twoFactorForm}"
+ show_two_factor_auth="{$showTwoFactorForm}"
error=""
flip=""
decorations=""
=====================================
tiki-live_support_admin.php
=====================================
@@ -25,10 +25,7 @@ include_once('lib/live_support/lsadminlib.php');
include_once('lib/live_support/lslib.php');
$access->check_feature('feature_live_support');
if ($tiki_p_live_support_admin != 'y' && ! $lsadminlib->is_operator($user)) {
- $smarty->assign('errortype', 401);
- $smarty->assign('msg', tra("You do not have the permission that is needed to use this feature"));
- $smarty->display("error.tpl");
- die;
+ Feedback::errorAndDie(tr("You do not have the permission that is needed to use this feature"), 401);
}
$smarty->assign('html', false);
if (isset($_REQUEST['show_html'])) {
=====================================
tiki-login.php
=====================================
@@ -23,7 +23,7 @@ $inputConfiguration = [
'username' => 'username', //post
'su' => 'word', //post
'intertiki' => 'string', //post
- 'twoFactorForm' => 'string', //post
+ 'showTwoFactorForm' => 'string', //post
'twoFactorAuthCode' => 'string', //post
'page' => 'pagename', //post
'url' => 'url', //post
@@ -67,7 +67,7 @@ if (! empty($_REQUEST['code']) && $prefs['auth_method'] == 'openid_connect' && T
$smarty->assign('errortype', 'login'); // to avoid any redirection to the login box if error
// Alert user if cookies are switched off
if (ini_get('session.use_cookies') == 1 && ! isset($_COOKIE[ session_name() ]) && $prefs['session_silent'] != 'y') {
- Feedback::errorAndDie(tra('Cookies must be enabled to log in to this site'), \Laminas\Http\Response::STATUS_CODE_401);
+ Feedback::errorAndDie(tra('Cookies must be enabled to log in to this site'), \Laminas\Http\Response::STATUS_CODE_403);
}
// Redirect to HTTPS if we are not in HTTPS but we require HTTPS login
@@ -154,12 +154,12 @@ if ($prefs['feature_intertiki'] == 'y' && $prefs['feature_intertiki_server'] !=
unset($_REQUEST['intertiki']);
}
-//Enable Two-Factor Auth Input
-$twoFactorForm = $prefs['twoFactorAuth'];
-if (isset($_REQUEST["$twoFactorForm"])) {
- $twoFactorForm = $_REQUEST["$twoFactorForm"];
+// Setup Two-Factor Auth form state
+$showTwoFactorForm = $prefs['twoFactorAuth'];
+if (isset($_REQUEST["showTwoFactorForm"])) {
+ $showTwoFactorForm = 'y';
}
-$smarty->assign('twoFactorForm', $twoFactorForm);
+$smarty->assign('showTwoFactorForm', $showTwoFactorForm);
// Go through the intertiki process
if (
@@ -336,7 +336,7 @@ if (
$_SESSION['tiki_creds_username'] = $_REQUEST['user'];
$_SESSION['tiki_creds_password'] = $_REQUEST['pass'];
$params = '&create2FaCodeNormalLogin&tiki_username=' . urlencode($_REQUEST['user']);
- header('Location: ' . $base_url . 'tiki-login_scr.php?twoFactorForm' . $params);
+ header('Location: ' . $base_url . 'tiki-login_scr.php?showTwoFactorForm' . $params);
exit;
}
@@ -344,7 +344,7 @@ if (
$is2FaPass = $twoFactorAuth->validateCode($requestedUser, $_REQUEST['twoFactorAuthCode']);
if (! $is2FaPass) {
$error = TWO_FA_INCORRECT;
- $smarty->assign('twoFactorForm', 'y');
+ $smarty->assign('showTwoFactorForm', 'y');
$_SESSION['tiki_creds_username'] = $_REQUEST['user'];
$_SESSION['tiki_creds_password'] = $_REQUEST['pass'];
$smarty->assign('create2FaCodeNormalLogin', "y");
=====================================
tiki-login_scr.php
=====================================
@@ -16,7 +16,7 @@ $section_class = 'tiki_login'; // This will be body class instead of $section
$inputConfiguration = [
[
'staticKeyFilters' => [
- 'twoFactorForm' => 'string', //post
+ 'showTwoFactorForm' => 'string', //post
'clearmenucache' => 'bool', //post
'user' => 'username', //post
'create2FaCodeNormalLogin' => 'alpha', //get
@@ -27,12 +27,12 @@ $inputConfiguration = [
include_once("tiki-setup.php");
-//Enable Two-Factor Auth Input
-$twoFactorForm = $prefs['twoFactorAuth'];
-if (isset($_REQUEST["$twoFactorForm"])) {
- $twoFactorForm = $_REQUEST["$twoFactorForm"];
+// Setup Two-Factor Auth form state
+$showTwoFactorForm = $prefs['twoFactorAuth'];
+if (isset($_REQUEST["showTwoFactorForm"])) {
+ $showTwoFactorForm = 'y';
}
-$smarty->assign('twoFactorForm', $twoFactorForm);
+$smarty->assign('showTwoFactorForm', $showTwoFactorForm);
$create2FaCodeNormalLogin = isset($_REQUEST["create2FaCodeNormalLogin"]) ? 'y' : 'n';
try {
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/bebd5f8794a013690600a9bad2d8ea4c1e4875f1
--
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/bebd5f8794a013690600a9bad2d8ea4c1e4875f1
You're receiving this email because of your account on gitlab.com.
_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs