| Línea 40... |
Línea 40... |
| 40 |
$PAGE->set_title(get_string('unauthemail', 'factor_email'));
|
40 |
$PAGE->set_title(get_string('unauthemail', 'factor_email'));
|
| 41 |
$PAGE->set_cacheable(false);
|
41 |
$PAGE->set_cacheable(false);
|
| 42 |
$instance = $DB->get_record('tool_mfa', ['id' => $instanceid]);
|
42 |
$instance = $DB->get_record('tool_mfa', ['id' => $instanceid]);
|
| 43 |
$factor = \tool_mfa\plugininfo\factor::get_factor('email');
|
43 |
$factor = \tool_mfa\plugininfo\factor::get_factor('email');
|
| Línea -... |
Línea 44... |
| - |
|
44 |
|
| 44 |
|
45 |
// If pass is set, do checks and pass for this session.
|
| 45 |
// If pass is set, require login to force $SESSION and user, and pass for that session.
|
46 |
// Require login to force $SESSION and user, and pass for that session.
|
| 46 |
if (!empty($instance) && $pass != 0 && $secret != 0) {
|
47 |
if (!empty($instance) && $pass != 0 && $secret != 0) {
|
| 47 |
require_login();
|
48 |
require_login();
|
| 48 |
if ($factor->get_state() === \tool_mfa\plugininfo\factor::STATE_LOCKED) {
|
49 |
if ($factor->get_state() === \tool_mfa\plugininfo\factor::STATE_LOCKED) {
|
| 49 |
// Redirect through to auth, this will bounce them to the next factor.
|
50 |
// Redirect through to auth, this will bounce them to the next factor.
|
| Línea 67... |
Línea 68... |
| 67 |
|
68 |
|
| Línea 68... |
Línea 69... |
| 68 |
$form = new \factor_email\form\email($url);
|
69 |
$form = new \factor_email\form\email($url);
|
| 69 |
|
70 |
|
| - |
|
71 |
if ($form->is_cancelled()) {
|
| - |
|
72 |
redirect(new moodle_url('/'));
|
| - |
|
73 |
}
|
| 70 |
if ($form->is_cancelled()) {
|
74 |
|
| - |
|
75 |
// If submitted without the pass param, is a cancel request - do checks and revoke email factor.
|
| 71 |
redirect(new moodle_url('/'));
|
76 |
if ($fromform = $form->get_data()) {
|
| 72 |
} else if ($fromform = $form->get_data()) {
|
77 |
// Only allow revoke attempts from requests with a valid instance and secret.
|
| 73 |
if (empty($instance)) {
|
78 |
if (empty($instance) || empty($secret) || $instance->secret != $secret) {
|
| 74 |
$message = get_string('error:badcode', 'factor_email');
|
79 |
$message = get_string('error:badcode', 'factor_email');
|
| Línea 75... |
Línea 80... |
| 75 |
} else {
|
80 |
} else {
|
| 76 |
$user = $DB->get_record('user', ['id' => $instance->userid]);
|
81 |
$user = $DB->get_record('user', ['id' => $instance->userid]);
|
| Línea 77... |
Línea 82... |
| 77 |
|
82 |
|
| 78 |
// Stop attacker from using email factor at all, by revoking all email until admin fixes.
|
83 |
// Stop attacker from using email factor at all, by revoking all email until admin fixes.
|
| Línea 79... |
Línea 84... |
| 79 |
$DB->set_field('tool_mfa', 'revoked', 1, ['userid' => $user->id, 'factor' => 'email']);
|
84 |
$DB->set_field('tool_mfa', 'revoked', 1, ['userid' => $user->id, 'factor' => 'email']);
|
| 80 |
|
85 |
|
| 81 |
// Remotely logout all sessions for user.
|
86 |
// Remotely logout all sessions for user.
|
| 82 |
$manager = \core\session\manager::kill_user_sessions($instance->userid);
|
87 |
\core\session\manager::destroy_user_sessions($instance->userid);
|