Add reset button

src/pretix/control/logdisplay.py

@@ -774,6 +774,7 @@ class CoreUserImpersonatedLogEntryType(UserImpersonatedLogEntryType):
     'pretix.user.settings.2fa.disabled': _('Two-factor authentication has been disabled.'),
     'pretix.user.settings.2fa.regenemergency': _('Your two-factor emergency codes have been regenerated.'),
     'pretix.user.settings.2fa.emergency': _('A two-factor emergency code has been generated.'),
+    'pretix.user.settings.2fa.resetdrift': _('TOTP drift has been reset.'),
     'pretix.user.settings.2fa.device.added': _('A new two-factor authentication device "{name}" has been added to '
                                                'your account.'),
     'pretix.user.settings.2fa.device.deleted': _('The two-factor authentication device "{name}" has been removed '

src/pretix/control/templates/pretixcontrol/users/form.html

@@ -1,6 +1,7 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% load icon %}
 {% block title %}{% trans "User" %}{% endblock %}
 {% block content %}
     <h1>{% trans "User" %} {{ user.email }}</h1>
@@ -16,6 +17,10 @@
                 {% csrf_token %}
                 <button class="btn btn-default">{% trans "Generate 2FA emergency token" %}</button>
             </form>
+            <form action="{% url "control:users.resetdrift" id=user.pk %}" method="post" class="form-inline helper-display-inline">
+                {% csrf_token %}
+                <button class="btn btn-default">{% trans "Reset 2FA drift" %}</button>
+            </form>
         {% endif %}
         <form action="{% url "control:users.impersonate" id=user.pk %}" method="post" class="form-inline helper-display-inline">
             {% csrf_token %}
@@ -59,8 +64,72 @@
                         {% bootstrap_field form.is_verified layout='control' %}
                     {% endif %}
                     {% bootstrap_field form.last_login layout='control' %}
-                    {% bootstrap_field form.require_2fa layout='control' %}
                     {% bootstrap_field form.needs_password_change layout='control' %}
+                    {% bootstrap_field form.require_2fa layout='control' %}
+                    <div class="form-group">
+                        <div class="col-md-9 col-md-offset-3">
+                            <div class="panel panel-default">
+                                <div class="panel-heading">
+                                    <h3 class="panel-title">
+                                        {% trans "Available two-factor authentication methods" %}
+                                    </h3>
+                                </div>
+                                <table class="panel-body table table-hover">
+                                    {% for d in devices %}
+                                    <tr>
+                                        <td>
+                                            {% if d.devicetype == 'totp' %}
+                                                TOTP
+                                            {% elif d.devicetype == 'u2f' %}
+                                                U2F
+                                            {% elif d.devicetype == 'webauthn' %}
+                                                WebAuthn
+                                            {% elif d.devicetype == 'emergency' %}
+                                                {% trans "Emergency tokens" %}
+                                            {% endif %}
+                                            {% if d.confirmed %}
+                                                {% icon "check" %}
+                                            {% else %}
+                                                {% icon "warning" %}
+                                            {% endif %}
+                                        </td>
+                                        <td>
+                                            {{ d.name }}
+                                        </td>
+                                        <td>
+                                            {% if d.throttling_failure_timestamp %}
+                                                {% blocktrans trimmed with date=d.throttling_failure_timestamp|date:"SHORT_DATETIME_FORMAT" count cnt=d.throttling_failure_count %}
+                                                    1 failed attempt since {{ date }}
+                                                {% plural %}
+                                                    {{ cnt }} failed attempts since {{ date }}
+                                                {% endblocktrans %}
+                                                <br>
+                                            {% endif %}
+                                            {% if d.devicetype == 'totp' %}
+                                                <small>
+                                                    <code>step = {{ d.step }},
+                                                    t0 = {{ d.t0 }},
+                                                    digits = {{ d.digits }},
+                                                    tolerance = {{ d.tolerance }},
+                                                    drift = {{ d.drift }},
+                                                    last_t = {{ d.last_t }}</code>
+                                                </small>
+                                            {% elif d.devicetype == 'u2f' %}
+                                                <small>
+                                                    <code>sign_count = {{ d.sign_count }}</code>
+                                                </small>
+                                            {% elif d.devicetype == 'emergency' %}
+                                                <small>
+                                                    <code>token_count = {{ d.token_set.count }}</code>
+                                                </small>
+                                            {% endif %}
+                                        </td>
+                                    </tr>
+                                    {% endfor %}
+                                </table>
+                            </div>
+                        </div>
+                    </div>
                 </fieldset>
                 <fieldset>
                     <legend>{% trans "Team memberships" %}</legend>

src/pretix/control/urls.py

@@ -78,6 +78,7 @@ urlpatterns = [
     re_path(r'^users/(?P<id>\d+)/impersonate$', users.UserImpersonateView.as_view(), name='users.impersonate'),
     re_path(r'^users/(?P<id>\d+)/anonymize$', users.UserAnonymizeView.as_view(), name='users.anonymize'),
     re_path(r'^users/(?P<id>\d+)/emergencytoken$', users.UserEmergencyTokenView.as_view(), name='users.emergencytoken'),
+    re_path(r'^users/(?P<id>\d+)/resetdrift$', users.Reset2FADriftView.as_view(), name='users.resetdrift'),
     re_path(r'^pdf/editor/webfonts.css', pdf.FontsCSSView.as_view(), name='pdf.css'),
     re_path(r'^settings/?$', user.UserSettings.as_view(), name='user.settings'),
     re_path(r'^settings/history/$', user.UserHistoryView.as_view(), name='user.settings.history'),

src/pretix/control/views/users.py

@@ -41,15 +41,18 @@ from django.utils.translation import gettext_lazy as _
 from django.views import View
 from django.views.generic import ListView, TemplateView
 from django_otp.plugins.otp_static.models import StaticDevice
+from django_otp.plugins.otp_totp.models import TOTPDevice
 from hijack import signals
 
 from pretix.base.auth import get_auth_backends
-from pretix.base.models import User
+from pretix.base.models import U2FDevice, User, WebAuthnDevice
 from pretix.control.forms.filter import UserFilterForm
 from pretix.control.forms.users import UserEditForm
 from pretix.control.permissions import AdministratorPermissionRequiredMixin
 from pretix.control.views import CreateView, UpdateView
-from pretix.control.views.user import RecentAuthenticationRequiredMixin
+from pretix.control.views.user import (
+    REAL_DEVICE_TYPES, RecentAuthenticationRequiredMixin,
+)
 
 
 def get_used_backend(request):
@@ -107,6 +110,21 @@ class UserEditView(AdministratorPermissionRequiredMixin, RecentAuthenticationReq
         ctx['backend'] = (
             b[self.object.auth_backend].verbose_name if self.object.auth_backend in b else self.object.auth_backend
         )
+
+        ctx['devices'] = []
+        for dt in [*REAL_DEVICE_TYPES, StaticDevice]:
+            objs = list(dt.objects.filter(user=self.request.user, confirmed=True))
+            for obj in objs:
+                if dt == TOTPDevice:
+                    obj.devicetype = 'totp'
+                elif dt == U2FDevice:
+                    obj.devicetype = 'u2f'
+                elif dt == WebAuthnDevice:
+                    obj.devicetype = 'webauthn'
+                elif dt == StaticDevice:
+                    obj.devicetype = 'emergency'
+            ctx['devices'] += objs
+
         return ctx
 
     def get_success_url(self):
@@ -183,6 +201,24 @@ class UserEmergencyTokenView(AdministratorPermissionRequiredMixin, RecentAuthent
         return reverse('control:users.edit', kwargs=self.kwargs)
 
 
+class Reset2FADriftView(AdministratorPermissionRequiredMixin, RecentAuthenticationRequiredMixin, View):
+
+    def get(self, request, *args, **kwargs):
+        return redirect(reverse('control:users.edit', kwargs=self.kwargs))
+
+    def post(self, request, *args, **kwargs):
+        self.object = get_object_or_404(User, pk=self.kwargs.get("id"))
+        self.object.totpdevice_set.update(drift=0)
+        self.object.log_action('pretix.user.settings.2fa.resetdrift', user=self.request.user)
+        messages.success(request, _(
+            'The drift values for TOTP devices have been reset.'
+        ))
+        return redirect(self.get_success_url())
+
+    def get_success_url(self):
+        return reverse('control:users.edit', kwargs=self.kwargs)
+
+
 class UserAnonymizeView(AdministratorPermissionRequiredMixin, RecentAuthenticationRequiredMixin, TemplateView):
     template_name = "pretixcontrol/users/anonymize.html"
 

src/pretix/static/pretixpresale/scss/_checkout.scss

@@ -157,11 +157,6 @@
 .profile-scope:last-child .profile-save-container {
   margin-bottom: -15px;
 }
-
-fieldset:not(:last-child) .profile-scope:last-child .profile-save-container {
-  margin-bottom: 0;
-}
-
 .profile-save-container .help-block {
   margin-bottom: 0;
 }