Denis Ledoux
a08a0b6454
Add the possibility to force the two-factor authentication for all users, using a two-factor authentication by email when the 2FA using an Authenticator app is not configured for the user. Two possibilities: - Force the 2FA only for employee users using the system parameter `auth_totp.policy=employee_required` - Force the 2FA for all users, employees and portals, using the system parameter `auth_totp.policy=all_required` closes odoo/odoo#83750 Signed-off-by: Denis Ledoux (dle) <dle@odoo.com>
27 lines
1.0 KiB
Python
27 lines
1.0 KiB
Python
# -*- coding: utf-8 -*-
|
|
import odoo.addons.auth_totp.controllers.home
|
|
|
|
from odoo import http
|
|
from odoo.exceptions import AccessDenied, UserError
|
|
from odoo.http import request
|
|
|
|
|
|
class Home(odoo.addons.auth_totp.controllers.home.Home):
|
|
@http.route()
|
|
def web_totp(self, redirect=None, **kwargs):
|
|
response = super().web_totp(redirect=redirect, **kwargs)
|
|
if response.status_code != 200 or response.qcontext['user']._mfa_type() != 'totp_mail':
|
|
# In case the response from the super is a redirection
|
|
# or the user has another TOTP method, we return the response from the call to super.
|
|
return response
|
|
assert request.session.pre_uid and not request.session.uid, \
|
|
"The user must still be in the pre-authentication phase"
|
|
|
|
# Send the email containing the code to the user inbox
|
|
try:
|
|
response.qcontext['user']._send_totp_mail_code()
|
|
except (AccessDenied, UserError) as e:
|
|
response.qcontext['error'] = str(e)
|
|
|
|
return response
|