From db66c911080bdc4490aff9eced1754b49d623aca Mon Sep 17 00:00:00 2001 From: Mira Weller Date: Fri, 20 Mar 2026 12:55:58 +0100 Subject: [PATCH] generate emergency tokens during 2fa activation --- .../pretixcontrol/user/2fa_enable.html | 36 ++++++++++++++++++- .../pretixcontrol/user/2fa_main.html | 24 +++++++++---- src/pretix/control/views/user.py | 31 ++++++++++++++-- 3 files changed, 81 insertions(+), 10 deletions(-) diff --git a/src/pretix/control/templates/pretixcontrol/user/2fa_enable.html b/src/pretix/control/templates/pretixcontrol/user/2fa_enable.html index 39f41268d4..a052f370f0 100644 --- a/src/pretix/control/templates/pretixcontrol/user/2fa_enable.html +++ b/src/pretix/control/templates/pretixcontrol/user/2fa_enable.html @@ -1,6 +1,7 @@ {% extends "pretixcontrol/base.html" %} {% load i18n %} {% load bootstrap3 %} +{% load icon %} {% block title %}{% trans "Enable two-factor authentication" %}{% endblock %} {% block content %}

{% trans "Enable two-factor authentication" %}

@@ -11,8 +12,41 @@

{% trans "You will no longer be able to log in to pretix without one of your configured devices." %} - {% trans "Please make sure to print out or copy the emergency tokens and store them in a safe place." %}

+ {% if new_emergency_tokens %} +
+
+

{% trans "Your emergency codes" %}

+
+
+

+ {% blocktrans trimmed %} + If you lose access to your devices, you can use one of your emergency tokens to log in. + We recommend to store them in a safe place, e.g. printed out or in a password manager. + Every token can be used at most once. + {% endblocktrans %} +

+
    + {% for code in new_emergency_tokens %} +
  • {{ code }}
    • + {% endfor %} +
+

+ +

+
+
+ {% else %} +

+ {% icon "info-circle" %} + {% blocktrans trimmed with generation_date_time=static_tokens_device.created_at %} + You generated your emergency tokens on {{ generation_date_time }}. + {% endblocktrans %} +

+ {% endif %}
{% trans "Cancel" %} diff --git a/src/pretix/control/templates/pretixcontrol/user/2fa_main.html b/src/pretix/control/templates/pretixcontrol/user/2fa_main.html index 0f08998349..653b17024d 100644 --- a/src/pretix/control/templates/pretixcontrol/user/2fa_main.html +++ b/src/pretix/control/templates/pretixcontrol/user/2fa_main.html @@ -1,5 +1,6 @@ {% extends "pretixcontrol/base.html" %} {% load i18n %} +{% load icon %} {% load bootstrap3 %} {% block title %}{% trans "Two-factor authentication" %}{% endblock %} {% block content %} @@ -152,19 +153,30 @@

{% if static_tokens_device %}

+ {% icon "info-circle" %} {% blocktrans trimmed with generation_date_time=static_tokens_device.created_at %} You generated your emergency tokens on {{ generation_date_time }}. {% endblocktrans %}

- {% else %} + + + {% trans "Generate new emergency tokens" %} + + {% elif user.require_2fa %}

- {% trans "You don't have any emergency tokens yet." %} + {% icon "warning" %} + {% trans "You don't have any emergency tokens yet." %} +

+ + + {% trans "Generate emergency tokens" %} + + {% else %} +

+ {% icon "info-circle" %} + {% trans "Emergency tokens will be generated when you enable two-factor authentication." %}

{% endif %} - - - {% trans "Generate new emergency tokens" %} -
{% endblock %} diff --git a/src/pretix/control/views/user.py b/src/pretix/control/views/user.py index 315b1ef041..412a56bc3f 100644 --- a/src/pretix/control/views/user.py +++ b/src/pretix/control/views/user.py @@ -584,14 +584,39 @@ class User2FAEnableView(RecentAuthenticationRequiredMixin, TemplateView): return redirect(reverse('control:user.settings.2fa')) return super().dispatch(request, *args, **kwargs) + def get(self, request, *args, **kwargs): + new_tokens = None + try: + static_tokens_device = StaticDevice.objects.get(user=self.request.user, name='emergency') + except StaticDevice.MultipleObjectsReturned: + static_tokens_device = StaticDevice.objects.filter( + user=self.request.user, name='emergency' + ).first() + except StaticDevice.DoesNotExist: + static_tokens_device = None + + new_tokens = [get_random_string(length=12, allowed_chars='1234567890') for _ in range(10)] + request.session['pretix_2fa_new_emergency_tokens'] = new_tokens + return super().get(request, *args, new_emergency_tokens=new_tokens, static_tokens_device=static_tokens_device, **kwargs) + def post(self, request, *args, **kwargs): + notices = [ + _('Two-factor authentication has been enabled.') + ] + if 'pretix_2fa_new_emergency_tokens' in request.session: + d = StaticDevice.objects.create(user=self.request.user, name='emergency') + for code in request.session['pretix_2fa_new_emergency_tokens']: + d.token_set.create(token=code) + self.request.user.log_action('pretix.user.settings.2fa.regenemergency', user=self.request.user) + notices += [ + _('Your two-factor emergency codes have been regenerated.') + ] + del request.session['pretix_2fa_new_emergency_tokens'] self.request.user.require_2fa = True self.request.user.save() self.request.user.log_action('pretix.user.settings.2fa.enabled', user=self.request.user) messages.success(request, _('Two-factor authentication is now enabled for your account.')) - self.request.user.send_security_notice([ - _('Two-factor authentication has been enabled.') - ]) + self.request.user.send_security_notice(notices) self.request.user.update_session_token() update_session_auth_hash(self.request, self.request.user) return redirect(reverse('control:user.settings.2fa'))