NottingHack / NottingHack/hms2
2fa, optional to users, required for Roles with sensitive access
Open
@dpslwk is already working on this.
Since Jan 19, 2019.
PR open
- Dominant language
- PHP
- Stars
- 14
- Forks
- 18
- PR merge metrics
- No merged PRs in 30d
Description
Use google 2fa TOTP/HTOP
Allow user to set this up if they want, and regen secrete, disable it
on login if setup redirect to a new page to submit the OTP
so new col on user to store key
new flag col on Role
role requires user to have 2fa setup
dont allow user to be added to a role until they have 2fa working
dont allow user with role to disable 2fa
add a array to config/hms
with list of permission that requires roles to have 2fa
when role->addPermission() check the list and kick back if not allowed (might need to do this in the role manager?? or a custom validation?)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.