josh/django-mfa2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #73 from jkirkcaldy/master

Browse Source 
grammar
This commit is contained in:
Mohamed El-Kalioby
2023-12-31 20:42:04 +02:00
committed by GitHub
parent 25be381ca9 b94faa1916
commit 16537baa6f
9 changed files with 97 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
CHANGELOG.md
View File

@@ -1,4 +1,12 @@
# Change Log
## 2.8.0
* Support For Django 4.0+ JSONField
* Removed jsonfield package from requirements
## 2.7.0
* Fixed #70
* Add QR Code for trusted device link
* Better formatting for trusted device start page.
## 2.6.1
* Fix: CVE-2022-42731: related to the possibility of registration replay attack.
Thanks to 'SSE (Secure Systems Engineering)'

10
README.md
View File

@@ -22,7 +22,9 @@ For FIDO2, the following are supported
* **android-safetynet** (Chrome 70+, Firefox 68+)
* **NFC devices using PCSC** (Not Tested, but as supported in fido2)
* **Soft Tokens**
* [krypt.co](https://krypt.co/): Login by a notification on your phone.
* ~~[krypt.co](https://krypt.co/): Login by a notification on your phone.~~
**Update**: Dec 2022, krypt.co has been killed by Google for Passkeys.
In English :), It allows you to verify the user by security keys on PC, Laptops or Mobiles, Windows Hello (Fingerprint, PIN) on Windows 10 Build 1903+ (May 2019 Update) Touch/Face ID on Macbooks (Chrome, Safari), Touch/Face ID on iPhone and iPad and Fingerprint/Face/Iris/PIN on Android Phones.
@@ -32,6 +34,8 @@ Trusted device is a mode for the user to add a device that doesn't support secur
Package tested with Django 1.8, Django 2.2 on Python 2.7 and Python 3.5+ but it was not checked with any version in between but open for issues.
If you just need WebAuthn and Passkeys, you can use **[django-passkeys](https://github.com/mkalioby/django-passkeys)**, which is a slim-down of this app and much easier to integrate.
Depends on
* pyotp
@@ -43,8 +47,12 @@ Depends on
# Installation
1. using pip
* For Django >= 4.0
`pip install django-mfa2`
* For Django < 4.0
`pip install django-mfa2 jsonfield`
2. Using Conda forge
`conda config --add channels conda-forge`

3
example/example/urls.py
View File

@@ -16,12 +16,13 @@ Including another URLconf
from django.contrib import admin
from django.urls import path,re_path,include
from . import views,auth
from mfa import TrustedDevice
urlpatterns = [
path('admin/', admin.site.urls),
path('mfa/', include('mfa.urls')),
path('auth/login',auth.loginView,name="login"),
path('auth/logout',auth.logoutView,name="logout"),
path('devices/add/', TrustedDevice.add,name="add_trusted_device"),
re_path('^$',views.home,name='home'),
path('registered/',views.registered,name='registered')
]

12
mfa/TrustedDevice.py
View File

@@ -7,10 +7,11 @@ from django.template.context_processors import csrf
from .models import *
import user_agents
from django.utils import timezone
from django.urls import reverse
def id_generator(size=6, chars=string.ascii_uppercase + string.digits):
x=''.join(random.choice(chars) for _ in range(size))
if not User_Keys.objects.filter(properties__shas="$.key="+x).exists(): return x
if not User_Keys.objects.filter(properties__icontains='"key": "%s"'%x).exists(): return x
else: return id_generator(size,chars)
def getUserAgent(request):
@@ -57,12 +58,13 @@ def getCookie(request):
def add(request):
context=csrf(request)
if request.method=="GET":
context.update({"username":request.GET.get('u',''),"key":request.GET.get('k','')})
return render(request,"TrustedDevices/Add.html",context)
else:
key=request.POST["key"].replace("-","").replace(" ","").upper()
context["username"] = request.POST["username"]
context["key"] = request.POST["key"]
trusted_keys=User_Keys.objects.filter(username=request.POST["username"],properties__has="$.key="+key)
trusted_keys=User_Keys.objects.filter(username=request.POST["username"],properties__icontains='"key": "%s"'%key)
cookie=False
if trusted_keys.exists():
tk=trusted_keys[0]
@@ -97,7 +99,7 @@ def start(request):
request.session["td_id"]=td.id
try:
if td==None: td=User_Keys.objects.get(id=request.session["td_id"])
context={"key":td.properties["key"]}
context={"key":td.properties["key"],"url":request.scheme+"://"+request.get_host() + reverse('add_trusted_device')}
except:
del request.session["td_id"]
return start(request)
@@ -124,12 +126,14 @@ def verify(request):
json= jwt.decode(request.COOKIES.get('deviceid'),settings.SECRET_KEY)
if json["username"].lower()== request.session['base_username'].lower():
try:
uk = User_Keys.objects.get(username=request.POST["username"].lower(), properties__has="$.key=" + json["key"])
uk = User_Keys.objects.get(username=request.POST["username"].lower(), properties__icontains='"key": "%s"'%json["key"])
if uk.enabled and uk.properties["status"] == "trusted":
uk.last_used=timezone.now()
uk.save()
request.session["mfa"] = {"verified": True, "method": "Trusted Device","id":uk.id}
return True
except:
import traceback
print(traceback.format_exc())
return False
return False

11
mfa/migrations/0005_auto_20181115_2014.py
View File

@@ -2,7 +2,14 @@
from __future__ import unicode_literals
from django.db import models, migrations
import jsonfield.fields
try:
from django.db.models import JSONField
except ImportError:
try:
from jsonfield.fields import JSONField
except ImportError:
raise ImportError("Can't find a JSONField implementation, please install jsonfield if django < 4.0")
def modify_json(apps, schema_editor):
@@ -24,7 +31,7 @@ class Migration(migrations.Migration):
migrations.AddField(
model_name='user_keys',
name='properties',
field=jsonfield.fields.JSONField(null=True),
field=JSONField(null=True),
),
migrations.RunPython(modify_json)
]

9
mfa/models.py
View File

@@ -1,5 +1,12 @@
from django.db import models
from jsonfield import JSONField
try:
from django.db.models import JSONField
except ModuleNotFoundError:
try:
from jsonfield import JSONField
except ModuleNotFoundError:
raise ModuleNotFoundError("Can't find a JSONField implementation, please install jsonfield if django < 4.0")
from jose import jwt
from django.conf import settings
#from jsonLookup import shasLookup, hasLookup

2
mfa/templates/MFA.html
View File

@@ -116,7 +116,7 @@
</tr>
{% endif %}
{% else %}
<tr><td colspan="7" align="center">You didn't have any keys yet.</td> </tr>
<tr><td colspan="7" align="center">You don't have any keys yet.</td> </tr>
{% endif %}
</table>
</div>

49
mfa/templates/TrustedDevices/start.html
View File

@@ -1,5 +1,7 @@
{% extends "base.html" %}
{% load static %}
{% block head %}
<script src="{% static 'mfa/js/qrious.min.js' %}" type="text/javascript"></script>
<style>
#two-factor-steps {
border: 1px solid #ccc;
@@ -12,6 +14,12 @@
</style>
<script type="text/javascript">
$(document).ready(function (){
var qr = new QRious({
element: document.getElementById('qr'),
value: "{{ url }}?u={{ request.user.username }}&k={{ key }}"
});
})
function sendEmail() {
$("#modal-title").html("Send Link")
$("#modal-body").html("Sending Email, Please wait....");
@@ -82,21 +90,52 @@
{% if not_allowed %}
<div class="alert alert-danger">You can't add any more devices, you need to remove previously trusted devices first.</div>
{% else %}
<p style="color: green">Allow access from mobile phone and tables.</p>
<p style="color: green">Allow access from mobile phone and tables.</p><br/>
<br/>
</div>
<div class="row">
<h5>Steps:</h5>
</div>
<div class="row">
<div class="col-md-6">
<h5>Using Camera</h5>
<ol>
<li>Using your mobile/table, open Chrome/Firefox.</li>
<li>Go to <b>{{ HOST }}{{ BASE_URL }}devices/add</b>&nbsp;&nbsp;<a href="javascript:void(0)" onclick="sendEmail()" title="Send to my email"><i class="fas fa-paper-plane"></i></a></li>
<li>Scan the following barcode <br/>
<img id="qr"/> <br/>
</li>
<li>Confirm the consent and submit form.</li>
</ol>
</div>
<div class="col-md-6">
<h5>Manual</h5>
<ol>
<li>Using your mobile/table, open Chrome/Firefox.</li>
<li>Go to <b>{{ url }}</b>&nbsp;&nbsp;</li>
<li>Enter your username & following 6 digits<br/>
<span style="font-size: 16px;font-weight: bold; margin-left: 50px">{{ key|slice:":3" }} - {{ key|slice:"3:" }}</span>
</li>
<li>This window will ask to confirm the device.</li>
<li>Confirm the consent and submit form.</li>
</div>
</div>
<div class="row">
<div class="col-md-8 offset-2">
This window will ask to confirm the device.
</div>
</div>
</ol>
{% endif %}
</div>
</div>
</div>
<br/>
<br/>
<br/>
<br/>
{% include "modal.html" %}
{% include 'mfa_check.html' %}
{% endblock %}

7
setup.py
View File

@@ -4,7 +4,7 @@ from setuptools import find_packages, setup
setup(
name='django-mfa2',
version='2.6.1',
version='2.8.0',
description='Allows user to add 2FA to their accounts',
long_description=open("README.md").read(),
long_description_content_type="text/markdown",
@@ -17,7 +17,6 @@ setup(
packages=find_packages(),
install_requires=[
'django >= 2.0',
'jsonfield',
'simplejson',
'pyotp',
'python-u2flib-server',
@@ -25,13 +24,13 @@ setup(
'user-agents',
'python-jose',
'fido2 == 1.0.0',
'jsonLookup'
],
python_requires=">=3.5",
include_package_data=True,
zip_safe=False, # because we're including static files
classifiers=[
"Development Status :: 5 - Production/Stable",
#"Development Status :: 4 - Beta",
"Environment :: Web Environment",
"Framework :: Django",
"Framework :: Django :: 2.0",
@@ -41,6 +40,7 @@ setup(
"Framework :: Django :: 3.1",
"Framework :: Django :: 3.2",
"Framework :: Django :: 4.0",
"Framework :: Django :: 4.1",
"Intended Audience :: Developers",
"Operating System :: OS Independent",
"Programming Language :: Python",
@@ -51,6 +51,7 @@ setup(
"Programming Language :: Python :: 3.8",
"Programming Language :: Python :: 3.9",
"Programming Language :: Python :: 3.10",
"Programming Language :: Python :: 3.11",
"Topic :: Software Development :: Libraries :: Python Modules",
]
)