Twofactor by Reflar

[deleted] · Dec 17, 2019

Kyrne omg... Thanks !

[deleted] · Dec 18, 2019

@Kyrne there still seems to be an issue with this extension. It's the same problem I reported before - see below

return [
    'up' => function (Builder $schema) {
        if (!$schema->hasColumn('users', 'twofa_enabled')) {
            $schema->table('users', function (Blueprint $table) {
                $table->boolean('twofa_enabled')->default(0);
                $table->string('google2fa_secret');
                $table->string('recovery_codes')->nullable;
            });
        }
        $schema->table('users', function (Blueprint $table) {
            $table->string('phone');
            $table->string('text_code');
            $table->string('pageId');
        });
    },
  'down' => function (Builder $schema) {
      $schema->table('users', function (Blueprint $table) {
          $table->dropColumn('google2fa_secret');
          $table->dropColumn('twofa_enabled');
          $table->dropColumn('recovery_codes');
          $table->dropColumn('phone');
          $table->dropColumn('text_code');
          $table->dropColumn('carrier');
      });
  },
  ];

These database entries are not being created, and there are no errors in the log. I'm still working through this, but my installation fails to work. The QR code when scanned says it's an invalid format, and the recovery codes are also missing.

[deleted] · Dec 18, 2019

Another issue - even if I create the fields from scratch in the database, I still get

Next Illuminate\Database\QueryException: SQLSTATE[42S22]: Column not found: 1054 Unknown column 'twofa_enabled' in 'field list' (SQL: update `users` set `twofa_enabled` = 1, `google2fa_secret` = ############ where `id` = 1) in /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/illuminate/database/Connection.php:664
Stack trace:
#0 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/illuminate/database/Connection.php(624): Illuminate\Database\Connection->runQueryCallback('update `users` ...', Array, Object(Closure))
#1 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/illuminate/database/Connection.php(490): Illuminate\Database\Connection->run('update `users` ...', Array, Object(Closure))
#2 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/illuminate/database/Connection.php(423): Illuminate\Database\Connection->affectingStatement('update `users` ...', Array)
#3 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/illuminate/database/Query/Builder.php(2659): Illuminate\Database\Connection->update('update `users` ...', Array)
#4 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/illuminate/database/Eloquent/Builder.php(818): Illuminate\Database\Query\Builder->update(Array)
#5 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/illuminate/database/Eloquent/Model.php(729): Illuminate\Database\Eloquent\Builder->update(Array)
#6 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/illuminate/database/Eloquent/Model.php(644): Illuminate\Database\Eloquent\Model->performUpdate(Object(Illuminate\Database\Eloquent\Builder))
#7 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/reflar/twofactor/src/TwoFactor.php(88): Illuminate\Database\Eloquent\Model->save()
#8 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/reflar/twofactor/src/Api/Controllers/VerifyCodeController.php(49): Reflar\twofactor\TwoFactor->prepareTOTP2Factor(Object(Flarum\User\User))
#9 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Api/Controller/AbstractSerializeController.php(96): Reflar\twofactor\Api\Controllers\VerifyCodeController->data(Object(Zend\Diactoros\ServerRequest), Object(Tobscure\JsonApi\Document))
#10 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Http/RouteHandlerFactory.php(38): Flarum\Api\Controller\AbstractSerializeController->handle(Object(Zend\Diactoros\ServerRequest))
#11 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Http/Middleware/DispatchRoute.php(65): Flarum\Http\RouteHandlerFactory->Flarum\Http\{closure}(Object(Zend\Diactoros\ServerRequest), Array)
#12 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Flarum\Http\Middleware\DispatchRoute->process(Object(Zend\Diactoros\ServerRequest), Object(Closure))
#13 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/fof/pwned-passwords/src/Middleware/CheckPasswordReset.php(55): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#14 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): FoF\PwnedPasswords\Middleware\CheckPasswordReset->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#15 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/fof/pwned-passwords/src/Middleware/CheckLoginPassword.php(45): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#16 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): FoF\PwnedPasswords\Middleware\CheckLoginPassword->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#17 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/fof/pwned-passwords/src/Middleware/PreventPwnedPassword.php(42): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#18 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): FoF\PwnedPasswords\Middleware\PreventPwnedPassword->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#19 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/fof/stopforumspam/src/Middleware/RegisterMiddleware.php(94): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#20 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): FoF\StopForumSpam\Middleware\RegisterMiddleware->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#21 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/fof/terms/src/Middlewares/RegisterMiddleware.php(54): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#22 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): FoF\Terms\Middlewares\RegisterMiddleware->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#23 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Http/Middleware/SetLocale.php(50): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#24 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Flarum\Http\Middleware\SetLocale->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#25 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Http/Middleware/CheckCsrfToken.php(31): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#26 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Flarum\Http\Middleware\CheckCsrfToken->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#27 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Http/Middleware/AuthenticateWithHeader.php(55): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#28 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Flarum\Http\Middleware\AuthenticateWithHeader->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#29 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Http/Middleware/AuthenticateWithSession.php(32): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#30 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Flarum\Http\Middleware\AuthenticateWithSession->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#31 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Http/Middleware/RememberFromCookie.php(51): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#32 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Flarum\Http\Middleware\RememberFromCookie->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#33 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Http/Middleware/StartSession.php(61): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#34 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Flarum\Http\Middleware\StartSession->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#35 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Api/Middleware/FakeHttpMethods.php(29): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#36 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Flarum\Api\Middleware\FakeHttpMethods->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#37 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Http/Middleware/ParseJsonBody.php(28): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#38 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Flarum\Http\Middleware\ParseJsonBody->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#39 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Http/Middleware/HandleErrors.php(57): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#40 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Flarum\Http\Middleware\HandleErrors->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#41 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/MiddlewarePipe.php(83): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#42 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/middlewares/request-handler/src/RequestHandler.php(84): Zend\Stratigility\MiddlewarePipe->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#43 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Middlewares\RequestHandler->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#44 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/middlewares/base-path-router/src/BasePathRouter.php(97): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#45 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Middlewares\BasePathRouter->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#46 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Middleware/OriginalMessages.php(41): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#47 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Zend\Stratigility\Middleware\OriginalMessages->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#48 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/middlewares/base-path/src/BasePath.php(53): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#49 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/Next.php(60): Middlewares\BasePath->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\Next))
#50 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/MiddlewarePipe.php(83): Zend\Stratigility\Next->handle(Object(Zend\Diactoros\ServerRequest))
#51 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-stratigility/src/MiddlewarePipe.php(72): Zend\Stratigility\MiddlewarePipe->process(Object(Zend\Diactoros\ServerRequest), Object(Zend\Stratigility\EmptyPipelineHandler))
#52 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/zendframework/zend-httphandlerrunner/src/RequestHandlerRunner.php(95): Zend\Stratigility\MiddlewarePipe->handle(Object(Zend\Diactoros\ServerRequest))
#53 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/vendor/flarum/core/src/Http/Server.php(44): Zend\HttpHandlerRunner\RequestHandlerRunner->run()
#54 /var/www/vhosts/phenomlab.com/forum.phenomlab.com/index.php(22): Flarum\Http\Server->listen()
#55 {main}

Despite the fields in the user table actually existing ??

[deleted] · Dec 18, 2019

Seems there's also an error with the SQL statement used

update 'users' set 'twofa_enabled' = 1, 'google2fa_secret' = GBAJQ4V454XDDOW3 where id = '1'

This doesn't work as quotes are missing - it should be

update 'users' set 'twofa_enabled' = 1, 'google2fa_secret' = 'GBAJQ4V454XDDOW3' where id = '1'

clarkwinkelmann · Dec 18, 2019

[deleted] I think it shows like that because it's a query binding. It does not show the escaped version in the error message. There would be an invalid syntax error instead of a column not found error if the SQL was invalid.

The error message does seem to indicate the column doesn't exist in your database.

[deleted] · Dec 18, 2019

clarkwinkelmann I agree, but the field is 100% there.

Ralkage · Dec 18, 2019

[deleted] could be DB Engine related, are you using MySQL or MariaDB? (could of sworn you were using MariaDB before and we did a fix in previous extensions for compatibility issues because you were using an older version).

[deleted] · Dec 18, 2019

Ralkage Nah, it's simpler than that. I was using the wrong f@£$%^ing database - how embarrassing is that ?? !!

However, to exonerate myself, I still have an issue where the QR code can't be read because of invalid format...

"Invalid Format - Token format not supported"

[deleted] · Dec 18, 2019

Kyrne Edit: upon looking at the photo for more than a milisecond (I rush sometimes) I noticed it's just straight up not a valid url I'll fix it soon.

Did this ever get fixed ? I have the same (somewhat annoying) issue !

[deleted] · Dec 19, 2019

For anyone reviewing this, it's fixed. Essentially, it's an issue with the URL. I was given a fix via Discord, so I expect that @Kyrne will release a patch for this shortly.

peopleinside · Dec 19, 2019

[deleted] I think i will not use the extension for now. Have some Flarum function made by an extension can create more issue that have function integrated. So if you don't hear from me a feedback about the extension is because for now i decided to not use and as i can see I'm skipping to have different issues.

[deleted] · Dec 19, 2019

peopleinside Ok, but it's stable - not sure if this makes a difference. I would like to see this extension ported to the FoF namespace though.

Kyrne · Dec 20, 2019

[deleted] FoF is made up of most of the same members as ReFlar and Flagrow.

Kyrne · Apr 17, 2020

Currently working on refactoring the extension to remove the requirement of blocking the normal login route and including a few other QOL features. Will hopefully have this done by the end of the weekend.

Yyv7pmrlcem · May 11, 2020

@Kyrne Are you planning to add U2F key support?

peopleinside · Jun 15, 2020

Kyrne the extension seems is not working with Beta 13.
After install it result to be active on all users.

datitisev · Jun 19, 2020

peopleinside Can you clarify what you mean by

After install it result to be active on all users.

?

Is 2FA active for all users instead of only those that enable it/set it up?

peopleinside · Jun 20, 2020

datitisev The option is active for all user, the button to disable doesn't work.
The extension seems to be broken, not compatible with Beta 13.

Once installed and activated the 2 factor should be disabled for users also why the cursor to turn on / off is not working? You click on it but nothing change.

I think this extension is no more compatible.

datitisev · Jun 20, 2020

peopleinside Is there an error in the JS console?

peopleinside · Jun 20, 2020

datitisev I don't know, i unistalled it.
Seems the extension has not received any update since some time.

Also the fact the two factor can be bypassed by a password reset is maybe a little bit a weakness.