logging in with totp on mobile was broken with these two commits:
pve-manager:
509d7a20 ("mobile ui: implement dummy message box and scrip loader")
and
pve-access-control:
cb64967 ("api: drop old verify_tfa api call")
the pve-manager one overwrote the Ext.MessageBox and Ext.Msg classes and
thus removed the Ext.MessageBox.OKCANCEL constant that represented the
buttons of popup messages (without those no buttons on message boxes
where shown).
This override did not work as intended, as we still showed the message
box by accident, because at that point the Ext.MessageBox was already
initialized (so it was overwritten), but Ext.Msg was not (this happens
later).
and the pve-access-control removed the old tfa verify api (which is now
done via the /access/ticket api)
so to fix that, we have to adapt to the api changes and restore the
stock Ext.MessageBox and Ext.Msg classes by removing the overrides
(i couldn't find where we would need those)
we still cannot handle u2f or recovery methods though
Signed-off-by: Dominik Csapak <d.csa...@proxmox.com>
---
www/mobile/Login.js | 8 ++++++--
www/mobile/Toolkit.js | 5 -----
2 files changed, 6 insertions(+), 7 deletions(-)
diff --git a/www/mobile/Login.js b/www/mobile/Login.js
index 0abc2a14..06c8b3d4 100644
--- a/www/mobile/Login.js
+++ b/www/mobile/Login.js
@@ -35,8 +35,12 @@ Ext.define('PVE.Login', {
message: 'Loading...',
});
Proxmox.Utils.API2Request({
- url: '/api2/extjs/access/tfa',
- params: { response: code },
+ url: '/api2/extjs/access/ticket',
+ params: {
+ username: ticketResponse.username,
+ 'tfa-challenge': ticketResponse.ticket,
+ password: `totp:${code}`
+ },
method: 'POST',
timeout: 5000, // it'll delay both success & failure
success: function(resp, opts) {
diff --git a/www/mobile/Toolkit.js b/www/mobile/Toolkit.js
index c6e4e4a0..7bde24e6 100644
--- a/www/mobile/Toolkit.js
+++ b/www/mobile/Toolkit.js
@@ -7,9 +7,4 @@ Ext.Ajax.setDisableCaching(false);
// do not send '_dc' parameter
Ext.Ajax.disableCaching = false;
-Ext.MessageBox = Ext.Msg = {
- alert: (title, message) => console.warn(title, message),
- show: ({ title, message }) => console.warn(title, message),
-};
-
Ext.Loader.injectScriptElement = (url) => console.warn(`surpressed loading
${url}`);
--
2.30.2
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
