diff --git a/mfa/Email.py b/mfa/Email.py new file mode 100644 index 0000000..8dba6d4 --- /dev/null +++ b/mfa/Email.py @@ -0,0 +1,55 @@ +from django.shortcuts import render,render_to_response +from django.template.context_processors import csrf +import datetime,random +from random import randint +from .models import * +from django.template.context import RequestContext +from .views import login + +def sendEmail(request,username,secret): + from django.contrib.auth import get_user_model + User = get_user_model() + user=User.objects.get(username=username) + print secret + res=render_to_response("mfa_email_token_template.html",{"request":request,"user":user,'otp':secret}) + from django.conf import settings + from django.core.mail import EmailMessage + From = "%s <%s>" % (settings.EMAIL_FROM, settings.EMAIL_HOST_USER) + email = EmailMessage("OTP",res.content,From,[user.email] ) + email.content_subtype = "html" + return email.send(False) + +def start(request): + context = csrf(request) + if request.method == "POST": + if request.session["email_secret"] == request.POST["otp"]: + uk=User_Keys() + uk.username=request.user.username + uk.key_type="Email" + uk.enabled=1 + uk.save() + from django.http import HttpResponseRedirect + from django.core.urlresolvers import reverse + return HttpResponseRedirect(reverse('mfa_home')) + context["invalid"] = True + else: + request.session["email_secret"] = str(randint(0,100000)) + if sendEmail(request, request.session["base_username"], request.session["email_secret"]): + context["sent"] = True + return render_to_response("Email/Add.html", context, context_instance=RequestContext(request)) +def auth(request): + context=csrf(request) + if request.method=="POST": + if request.session["email_secret"]==request.POST["otp"].strip(): + mfa = {"verified": True, "method": "Email"} + if getattr(settings, "MFA_RECHECK", False): + mfa["next_check"] = int((datetime.datetime.now() + datetime.timedelta( + seconds = random.randint(settings.MFA_RECHECK_MIN, settings.MFA_RECHECK_MAX))).strftime("%s")) + request.session["mfa"] = mfa + return login(request) + context["invalid"]=True + else: + request.session["email_secret"] = str(randint(0, 100000)) + if sendEmail(request, request.session["base_username"], request.session["email_secret"]): + context["sent"] = True + return render_to_response("Email/Auth.html", context, context_instance = RequestContext(request)) \ No newline at end of file diff --git a/mfa/templates/Email/Add.html b/mfa/templates/Email/Add.html new file mode 100644 index 0000000..9ba67fa --- /dev/null +++ b/mfa/templates/Email/Add.html @@ -0,0 +1,55 @@ +{% extends "base.html" %} +{% block head %} +{% endblock %} +{% block content %} +
+
+ +
+
+ Activate Token by email +
+
+ +
+ + + {% csrf_token %} + {% if invalid %} +
+ Sorry, The provided token is not valid. +
+ {% endif %} + {% if quota %} +
+ {{ quota }} +
+ {% endif %} +
+
+
+

Enter the 6-digits sent to your email.

+
+
+ +
+
+
+
+ + + + + +
+
+ +
+ + +
+
+
+
+
+{% endblock %} \ No newline at end of file diff --git a/mfa/templates/Email/Auth.html b/mfa/templates/Email/Auth.html new file mode 100644 index 0000000..bb58497 --- /dev/null +++ b/mfa/templates/Email/Auth.html @@ -0,0 +1,14 @@ +{% extends "mfa_auth_base.html" %} +{% block head %} + +{% endblock %} +{% block content %} +
+
+{% include "Email/recheck.html" with mode='auth' %} + +{% endblock %} diff --git a/mfa/templates/Email/mfa_email_token_template.html b/mfa/templates/Email/mfa_email_token_template.html new file mode 100644 index 0000000..7600a0c --- /dev/null +++ b/mfa/templates/Email/mfa_email_token_template.html @@ -0,0 +1,10 @@ + + + + +Dear {{ username }},
+Your OTP is: {{ otp }} + +Thanks + + \ No newline at end of file diff --git a/mfa/templates/Email/recheck.html b/mfa/templates/Email/recheck.html new file mode 100644 index 0000000..82f6d57 --- /dev/null +++ b/mfa/templates/Email/recheck.html @@ -0,0 +1,76 @@ + +
+ +
+
+
+ Email One Time Password +
+
+ +
+ + + {% csrf_token %} + {% if invalid %} +
+ Sorry, The provided token is not valid. +
+ {% endif %} + {% if quota %} +
+ {{ quota }} +
+ {% endif %} +
+
+
+

Enter the 6-digits sent to your email.

+
+
+ +
+
+
+
+ + + + + +
+
+ +
+ + +
+
+
+
+
+
+
+ {% if request.session.mfa_methods|length > 1 %} + Select Another Method + {% endif %} +
+
+
+
+
+
diff --git a/mfa/templates/MFA.html b/mfa/templates/MFA.html index 18c9db3..da1c785 100644 --- a/mfa/templates/MFA.html +++ b/mfa/templates/MFA.html @@ -51,6 +51,9 @@ {% if not 'TOTP' in UNALLOWED_AUTHEN_METHODS %}
  • Authenticator app
    • {% endif %} + {% if not 'Email' in UNALLOWED_AUTHEN_METHODS %} +
  • Email Token
    • + {% endif %} {% if not 'U2F' in UNALLOWED_AUTHEN_METHODS %}
  • Security Key
    • {% endif %} diff --git a/mfa/templates/select_mfa_method.html b/mfa/templates/select_mfa_method.html index 52d5434..d4bea9c 100644 --- a/mfa/templates/select_mfa_method.html +++ b/mfa/templates/select_mfa_method.html @@ -15,6 +15,7 @@
  • {% if method == "TOTP" %}Authenticator App + {% elif method == "Email" %}Send OTP by Email {% elif method == "U2F" %}Secure Key {% elif method == "FIDO2" %}FIDO2 Secure Key {% endif %} diff --git a/mfa/urls.py b/mfa/urls.py index 20404f9..406e048 100644 --- a/mfa/urls.py +++ b/mfa/urls.py @@ -1,5 +1,5 @@ from django.conf.urls import url -import views,totp,U2F,TrustedDevice,helpers,FIDO2 +from . import views,totp,U2F,TrustedDevice,helpers,FIDO2,Email urlpatterns = [ url(r'totp/start/', totp.start , name="start_new_otop"), @@ -8,6 +8,9 @@ url(r'totp/verify', totp.verify, name="verify_otop"), url(r'totp/auth', totp.auth, name="totp_auth"), url(r'totp/recheck', totp.recheck, name="totp_recheck"), +url(r'email/start/', Email.start , name="start_email"), +url(r'email/auth/', Email.auth , name="email_auth"), + url(r'u2f/$', U2F.start, name="start_u2f"), url(r'u2f/bind', U2F.bind, name="bind_u2f"), url(r'u2f/auth', U2F.auth, name="u2f_auth"),