github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-28 13:51:18 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FEATURE: Use second factor for admin confirmation (#14293)

Browse Source 
Administrators can use second factor to confirm granting admin access
without using email. The old method of confirmation via email is still
used as a fallback when second factor is unavailable.
This commit is contained in:
Bianca Nenciu
2021-09-14 15:19:28 +03:00
committed by GitHub
parent f517b6997c
commit 6a7ea66670
9 changed files with 253 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
app/controllers/admin/users_controller.rb
View File

@ -191,8 +191,25 @@ class Admin::UsersController < Admin::AdminController
end
def grant_admin
AdminConfirmation.new(@user, current_user).create_confirmation
render json: success_json
guardian.ensure_can_grant_admin!(@user)
if current_user.has_any_second_factor_methods_enabled?
second_factor_authentication_result = current_user.authenticate_second_factor(params, secure_session)
if second_factor_authentication_result.ok
@user.grant_admin!
StaffActionLogger.new(current_user).log_grant_admin(@user)
render json: success_json
else
failure_payload = second_factor_authentication_result.to_h
if current_user.security_keys_enabled?
Webauthn.stage_challenge(current_user, secure_session)
failure_payload.merge!(Webauthn.allowed_credentials(current_user, secure_session))
end
render json: failed_json.merge(failure_payload)
end
else
AdminConfirmation.new(@user, current_user).create_confirmation
render json: success_json.merge(email_confirmation_required: true)
end
end
def revoke_moderation