Sudo Mode

clarkwinkelmann · Nov 19, 2022

Sudo Mode

This extension was quickly put together based on recent discussions about admin account security. I have only tested it locally with very few other extensions. All feedback welcome!

This Flarum extension requires users to enter their password again before performing security critical operations.
Sudo mode is then active for 1h before the password is required again.

This is mostly intended to protect admin accounts but some moderation actions are also protected.

API keys are not subject to sudo mode and can still perform any administrative action.
Access Tokens are subject to sudo mode and can theoretically pass the gate but it probably doesn't make sense since those use cases won't know the password.

The following actions are protected by sudo mode:

View admin panel info (list of extensions, PHP version, dashboard stats, etc.)
Enable/disable extensions
Edit settings
Edit permissions
Create/edit/delete group
Create/edit/delete tag
Edit user credentials, groups or delete user
Any other action protected by User::assertAdmin() in a third-party extension

Once the UI for developer tokens is finalized in a future Flarum version, developer access tokens could be made to bypass sudo mode and at the same time creating new tokens could be protected by sudo mode.

It's possible that you may be unable to see some restricted content on the forum pages until you enable sudo mode by going to the admin panel.
Please open an issue if you notice any place where this happens.

Installation

composer require clarkwinkelmann/flarum-ext-sudo-mode

If there is an error that makes you unable to access the admin panel, remove the extension with Composer: composer remove clarkwinkelmann/flarum-ext-sudo-mode.

Support

This extension is under minimal maintenance.

It was developed for a client and released as open-source for the benefit of the community.
I might publish simple bugfixes or compatibility updates for free.

You can contact me to sponsor additional features or updates.

Support is offered on a "best effort" basis through the Flarum community thread.

Links

[deleted] · Nov 19, 2022

clarkwinkelmann It's possible that you may be unable to see some restricted content on the forum pages until you enable sudo mode by going to the admin panel.

Sometimes link in dropdown menu "Administration" disappears, but Administration it is accessible via /#admin URL, so I guess it is intended.

Thanks for more security and safer online ambient!

clarkwinkelmann · Nov 19, 2022

[deleted] oops, thanks for spotting it! I have published version 1.0.1 that keeps the link visible for all admins outside of sudo mode.

[deleted] · Nov 19, 2022

clarkwinkelmann

Thanks! Successful update 1.0.1

CCyberGene · Nov 19, 2022

Thank you for this great extension, especially in light of the latest security vulnerability

BTW, just a very minor cosmetic issue, the description for this extension in the admin panel is "Transfer money to other users through post rewards".

P.S. I got Flarum Boot Error after I enabled the extension and tried to open the forum. However on subsequent attempts it's OK. Here's the log:

[2022-11-19 21:17:02] flarum.ERROR: PDOException: SQLSTATE[HY000] [2002] No such file or directory in /home/customer/www/myforum.com/public_html/forum/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php:40
Stack trace:
#0 /home/customer/www/myforum.com/public_html/forum/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOConnection.php(40): PDO->__construct('mysql:host=loca...', '*******', '*******', Array)
#1 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/database/Connectors/Connector.php(67): Doctrine\DBAL\Driver\PDOConnection->__construct('mysql:host=loca...', '*******', '*******', Array)
#2 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/database/Connectors/Connector.php(46): Illuminate\Database\Connectors\Connector->createPdoConnection('mysql:host=loca...', '*******', '*******', Array)
#3 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/database/Connectors/MySqlConnector.php(24): Illuminate\Database\Connectors\Connector->createConnection('mysql:host=loca...', Array, Array)
#4 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/database/Connectors/ConnectionFactory.php(184): Illuminate\Database\Connectors\MySqlConnector->connect(Array)
#5 [internal function]: Illuminate\Database\Connectors\ConnectionFactory->Illuminate\Database\Connectors\{closure}()
#6 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/database/Connection.php(1064): call_user_func(Object(Closure))
#7 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/database/Connection.php(1014): Illuminate\Database\Connection->getPdo()
#8 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/database/Connection.php(994): Illuminate\Database\Connection->getDoctrineConnection()
#9 /home/customer/www/myforum.com/public_html/forum/vendor/flarum/core/src/Database/Migrator.php(69): Illuminate\Database\Connection->getDoctrineSchemaManager()
#10 [internal function]: Flarum\Database\Migrator->__construct(Object(Flarum\Database\DatabaseMigrationRepository), Object(Illuminate\Database\MySqlConnection), Object(Illuminate\Filesystem\Filesystem))
#11 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/container/Container.php(917): ReflectionClass->newInstanceArgs(Array)
#12 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/container/Container.php(758): Illuminate\Container\Container->build('Flarum\\Database...')
#13 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/container/Container.php(694): Illuminate\Container\Container->resolve('Flarum\\Database...', Array)
#14 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/container/Container.php(1027): Illuminate\Container\Container->make('Flarum\\Database...')
#15 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/container/Container.php(947): Illuminate\Container\Container->resolveClass(Object(ReflectionParameter))
#16 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/container/Container.php(908): Illuminate\Container\Container->resolveDependencies(Array)
#17 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/container/Container.php(292): Illuminate\Container\Container->build('Flarum\\Extensio...')
#18 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/container/Container.php(873): Illuminate\Container\Container->Illuminate\Container\{closure}(Object(Illuminate\Container\Container), Array)
#19 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/container/Container.php(758): Illuminate\Container\Container->build(Object(Closure))
#20 /home/customer/www/myforum.com/public_html/forum/vendor/illuminate/container/Container.php(694): Illuminate\Container\Container->resolve('Flarum\\Extensio...', Array)
#21 /home/customer/www/myforum.com/public_html/forum/vendor/flarum/core/src/Extension/ExtensionServiceProvider.php(31): Illuminate\Container\Container->make('flarum.extensio...')
#22 [internal function]: Flarum\Extension\ExtensionServiceProvider->Flarum\Extension\{closure}(Object(Flarum\Foundation\Application))
#23 /home/customer/www/myforum.com/public_html/forum/vendor/flarum/core/src/Foundation/Application.php(329): call_user_func(Object(Closure), Object(Flarum\Foundation\Application))
#24 /home/customer/www/myforum.com/public_html/forum/vendor/flarum/core/src/Foundation/Application.php(270): Flarum\Foundation\Application->fireAppCallbacks(Array)
#25 /home/customer/www/myforum.com/public_html/forum/vendor/flarum/core/src/Foundation/InstalledSite.php(151): Flarum\Foundation\Application->boot()
#26 /home/customer/www/myforum.com/public_html/forum/vendor/flarum/core/src/Foundation/InstalledSite.php(82): Flarum\Foundation\InstalledSite->bootLaravel()
#27 /home/customer/www/myforum.com/public_html/forum/vendor/flarum/core/src/Http/Server.php(59): Flarum\Foundation\InstalledSite->bootApp()
#28 /home/customer/www/myforum.com/public_html/forum/vendor/flarum/core/src/Http/Server.php(36): Flarum\Http\Server->safelyBootAndGetHandler()
#29 /home/customer/www/myforum.com/public_html/forum/index.php(26): Flarum\Http\Server->listen()
#30 {main}

P.P.S. I'm not a PHP guy but a search on the Internet shows that this error might have been due to a temporary MySQL service unavailability. I actually had opened the SQL admin on my hosting to remove the API key (because I'm not using it at all, just tested some stuff in the past) and also removed an unused database and it's possible that the hosting restarted the SQL service or something. The error has not appeared again and is probably not related to this extension.

clarkwinkelmann · Nov 19, 2022

CyberGene PDOException: SQLSTATE[HY000] [2002] No such file or directory

Indeed, that looks like a temporary issue with the database server.

CyberGene description for this extension in the admin panel

Ooops, that was a leftover from some code I copy-pasted. I have pushed version 1.0.2 with a fixed description.

clarkwinkelmann · Jan 5, 2024

Version 1.1.0

Fix error messages not appearing in modal if the credentials are incorrect
Integrate with Passwordless extension by providing the one-time password request link in the sudo modal. Requires version 2.0+ of the Passwordless extension

The sudo form page (non-modal) does not integrate with Passwordless. Since it's only used for the admin panel and I wouldn't recommend admins not set a password on their accounts I'm not implementing it.