[pve-devel] [RFC PATCH pve-manager 1/2] ui: mobile: fix totp login

[pve-devel] [RFC PATCH pve-manager 1/2] ui: mobile: fix totp login

[Dominik Csapak]

logging in with totp on mobile was broken with these two commits:

pve-manager:
509d7a20 ("mobile ui: implement dummy message box and scrip loader")
and
pve-access-control:
cb64967 ("api: drop old verify_tfa api call")

the pve-manager one overwrote the Ext.MessageBox and Ext.Msg classes and
thus removed the Ext.MessageBox.OKCANCEL constant that represented the
buttons of popup messages (without those no buttons on message boxes
where shown).

This override did not work as intended, as we still  showed the message
box by accident, because at that point the Ext.MessageBox was already
initialized (so it was overwritten), but Ext.Msg was not (this happens
later).

and the pve-access-control removed the old tfa verify api (which is now
done via the /access/ticket api)

so to fix that, we have to adapt to the api changes and restore the
stock Ext.MessageBox and Ext.Msg classes by removing the overrides
(i couldn't find where we would need those)

we still cannot handle u2f or recovery methods though

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 www/mobile/Login.js   | 8 ++++++--
 www/mobile/Toolkit.js | 5 -----
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/www/mobile/Login.js b/www/mobile/Login.js
index 0abc2a14..06c8b3d4 100644
--- a/www/mobile/Login.js
+++ b/www/mobile/Login.js
@@ -35,8 +35,12 @@ Ext.define('PVE.Login', {
 			    message: 'Loading...',
 			});
 			Proxmox.Utils.API2Request({
-			    url: '/api2/extjs/access/tfa',
-			    params: { response: code },
+			    url: '/api2/extjs/access/ticket',
+			    params: {
+				username: ticketResponse.username,
+				'tfa-challenge': ticketResponse.ticket,
+				password: `totp:${code}`
+			    },
 			    method: 'POST',
 			    timeout: 5000, // it'll delay both success & failure
 			    success: function(resp, opts) {
diff --git a/www/mobile/Toolkit.js b/www/mobile/Toolkit.js
index c6e4e4a0..7bde24e6 100644
--- a/www/mobile/Toolkit.js
+++ b/www/mobile/Toolkit.js
@@ -7,9 +7,4 @@ Ext.Ajax.setDisableCaching(false);
 // do not send '_dc' parameter
 Ext.Ajax.disableCaching = false;
 
-Ext.MessageBox = Ext.Msg = {
-    alert: (title, message) => console.warn(title, message),
-    show: ({ title, message }) => console.warn(title, message),
-};
-
 Ext.Loader.injectScriptElement = (url) => console.warn(`surpressed loading ${url}`);
-- 
2.30.2

[pve-devel] [RFC PATCH pve-manager 2/2] ui: mobile: enable subscription popup

[Dominik Csapak]

not sure if this was lost at some point or never implemented, but we
want to be consistent with the remaining web ui and apps, so show
the subscription popup here too.

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
 www/mobile/Workspace.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/www/mobile/Workspace.js b/www/mobile/Workspace.js
index 3844f099..79474488 100644
--- a/www/mobile/Workspace.js
+++ b/www/mobile/Workspace.js
@@ -111,6 +111,8 @@ Ext.define('PVE.Workspace', {
 	// also sets the cookie
 	Proxmox.Utils.setAuthData(loginData);
 
+	Proxmox.Utils.checked_command(Ext.emptyFn); // display subscription status
+
 	PVE.Workspace.gotoPage('');
     },
 
-- 
2.30.2

[pve-devel] applied: [RFC PATCH pve-manager 1/2] ui: mobile: fix totp login

[Thomas Lamprecht]

Am 14/12/2023 um 10:55 schrieb Dominik Csapak:
> logging in with totp on mobile was broken with these two commits:
> 
> pve-manager:
> 509d7a20 ("mobile ui: implement dummy message box and scrip loader")
> and
> pve-access-control:
> cb64967 ("api: drop old verify_tfa api call")
> 
> the pve-manager one overwrote the Ext.MessageBox and Ext.Msg classes and
> thus removed the Ext.MessageBox.OKCANCEL constant that represented the
> buttons of popup messages (without those no buttons on message boxes
> where shown).
> 
> This override did not work as intended, as we still  showed the message
> box by accident, because at that point the Ext.MessageBox was already
> initialized (so it was overwritten), but Ext.Msg was not (this happens
> later).
> 
> and the pve-access-control removed the old tfa verify api (which is now
> done via the /access/ticket api)
> 
> so to fix that, we have to adapt to the api changes and restore the
> stock Ext.MessageBox and Ext.Msg classes by removing the overrides
> (i couldn't find where we would need those)
> 
> we still cannot handle u2f or recovery methods though
> 
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
> ---
>  www/mobile/Login.js   | 8 ++++++--
>  www/mobile/Toolkit.js | 5 -----
>  2 files changed, 6 insertions(+), 7 deletions(-)
> 
>

applied both patches, thanks!


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel