Redmine

    # set the requesting IP of the twofa user (e.g. for security notifications)

    @user.remote_ip = request.remote_ip

class TwofaBackupCodesController < ApplicationController

  include TwofaHelper

  self.main_menu = false

  before_action :require_login, :require_active_twofa

  before_action :twofa_setup

  require_sudo_mode :init

  def init

    if @twofa.send_code(controller: 'twofa_backup_codes', action: 'create')

      flash[:notice] = l('twofa_code_sent')

    end

    redirect_to action: 'confirm'

  end

  def confirm

    @twofa_view = @twofa.otp_confirm_view_variables

  end

  def create

    if @twofa.verify!(params[:twofa_code].to_s)

      if time = @twofa.backup_codes.map(&:created_on).max

        flash[:warning] = t('twofa_warning_backup_codes_generated_invalidated', time: format_time(time))

      else

        flash[:notice] = t('twofa_notice_backup_codes_generated')

      end

      tokens = @twofa.init_backup_codes!

      flash[:twofa_backup_token_ids] = tokens.collect(&:id)

      redirect_to action: 'show'

    else

      flash[:error] = l('twofa_invalid_code')

      redirect_to action: 'confirm'

    end

  end

  def show

    # make sure we get only the codes that we should show

    tokens = @twofa.backup_codes.where(id: flash[:twofa_backup_token_ids])

    # Redmine will show all flash contents at the top of the rendered html

    # page, so we need to explicitely delete this here

    flash.delete(:twofa_backup_token_ids)

    if tokens.present? && (@created_at = tokens.collect(&:created_on).max) > 5.minutes.ago

      @backup_codes = tokens.collect(&:value)

    else

      flash[:warning] = l('twofa_backup_codes_already_shown', bc_path: my_twofa_backup_codes_init_path)

      redirect_to controller: 'my', action: 'account'

    end

  end

  private

  def twofa_setup

    @user = User.current

    @twofa = Redmine::Twofa.for_user(@user)

  end

end

  include TwofaHelper

      flash[:notice] = l('twofa_activated', bc_path: my_twofa_backup_codes_init_path)

module TwofaHelper

  def require_active_twofa

    Setting.twofa? ? true : deny_access

  end

end

  add_action :twofa_backup_code, max_instances: 10, validity_time: nil

      <%= link_to l('twofa_generate_backup_codes'), { controller: 'twofa_backup_codes', action: 'init' }, method: :post, data: { confirm: Redmine::Twofa.for_user(User.current).backup_codes.any? ? t('twofa_text_generate_backup_codes_confirmation') : nil } -%>

<div class="box">

  <p><%=l 'twofa_label_enter_otp' %></p>

  <div class="tabular">

    <p>

      <label for="twofa_code"><%=l 'twofa_label_code' -%></label>

      <%= text_field_tag :twofa_code, nil, autocomplete: 'off' -%>

    </p>

  </div>

</div>

    <%= render partial: 'twofa_code_form' -%>

<h2><%=l 'twofa_generate_backup_codes' -%></h2>

<div class="splitcontentleft">

  <%= form_tag({ action: :create },

               { method: :post,

                 id: 'twofa_form' }) do -%>

    <%= render partial: 'twofa/twofa_code_form' -%>

    <%= submit_tag l('button_submit'), name: :submit_otp -%>

    <%= link_to l('twofa_resend_code'), { action: 'init' }, method: :post if @twofa_view[:resendable] -%>

  <% end %>

</div>

<% content_for :sidebar do %>

<%= render :partial => 'my/sidebar' %>

<% end %>

<h2><%=l 'twofa_label_backup_codes' -%></h2>

<div class="splitcontentleft">

  <div class="box">

    <p><%=l 'twofa_text_backup_codes_hint' -%></p>

    <ul class="twofa_backup_codes">

    <% @backup_codes.each do |code| -%>

      <li><code><%= code.scan(/.{4}/).join(' ') -%></code></li>

    <% end -%>

    </ul>

    <p><em class="info"><%=l 'twofa_text_backup_codes_created_at', datetime: format_time(@created_at) -%></em></p>

  </div>

</div>

<% content_for :sidebar do %>

<%= render :partial => 'my/sidebar' %>

<% end %>

  twofa_activated: Zwei-Faktor-Authentifizierung erfolgreich eingerichtet. Es ist empfohlen hierzu <a data-method="post" href="%{bc_path}">Backup-Codes zu generieren</a>.

  twofa_mail_body_backup_codes_generated: "Neue Backup-Codes für Zwei-Faktor-Authentifizierung generiert."

  twofa_mail_body_backup_code_used: "Ein Backup-Code für Zwei-Faktor-Authentifizierung ist verwendet worden."

  twofa_generate_backup_codes: Backup-Codes generieren

  twofa_text_generate_backup_codes_confirmation: Im nächsten Schritt werden alle bestehenden Backup-Codes ungültig gemacht und neue generiert. Möchten Sie fortfahren?

  twofa_notice_backup_codes_generated: Ihre Backup-Codes wurden generiert.

  twofa_warning_backup_codes_generated_invalidated: Es wurden neue Backup-Codes generiert. Die bestehenden Codes vom %{time} sind nicht mehr gültig.

  twofa_label_backup_codes: Zwei-Faktor-Authentifizierung Backup-Codes

  twofa_text_backup_codes_hint: Sie können einen dieser Codes benutzen wenn Sie vorübergehend keinen Zugriff auf Ihren zweiten Faktor haben. Jeder Code kann nur ein Mal verwendet werden. Es wird empfohlen, diese Codes auszudrucken und sie an einem sicheren Ort zu verwahren.

  twofa_text_backup_codes_created_at: Backup-Codes generiert am %{datetime}.

  twofa_backup_codes_already_shown: Aus Sicherheitsgründen können Backup-Codes nicht erneut angezeigt werden. Bitte <a data-method="post" href="%{bc_path}">generieren Sie neue Codes</a> falls nötig.

  twofa_activated: Two-factor authentication successfully enabled. It is recommended to <a data-method="post" href="%{bc_path}">generate backup codes</a> for your account.

  twofa_mail_body_backup_codes_generated: "New two-factor authentication backup codes generated."

  twofa_mail_body_backup_code_used: "A two-factor authentication backup code has been used."

  twofa_generate_backup_codes: Generate backup codes

  twofa_text_generate_backup_codes_confirmation: This will invalidate all existing backup codes and generate new ones. Would you like to continue?

  twofa_notice_backup_codes_generated: Your backup codes have been generated.

  twofa_warning_backup_codes_generated_invalidated: New backup codes have been generated. Your existing codes from %{time} are now invalid.

  twofa_label_backup_codes: Two-factor authentication backup codes

  twofa_text_backup_codes_hint: Use these codes instead of a one-time password should you not have access to your second factor. Each code can only be used once. It is recommended to print and store them in a safe place.

  twofa_text_backup_codes_created_at: Backup codes generated %{datetime}.

  twofa_backup_codes_already_shown: Backup codes cannot be shown again, please <a data-method="post" href="%{bc_path}">generate new backup codes</a> if required.

  match 'my/twofa/backup_codes/init', :controller => 'twofa_backup_codes', :action => 'init', :via => :post

  match 'my/twofa/backup_codes/confirm', :controller => 'twofa_backup_codes', :action => 'confirm', :via => :get

  match 'my/twofa/backup_codes/create', :controller => 'twofa_backup_codes', :action => 'create', :via => [:get, :post]

  match 'my/twofa/backup_codes', :controller => 'twofa_backup_codes', :action => 'show', :via => [:get]

        # make sure an otp and not a backup code is used

        backup_codes.delete_all

        verify_otp!(code) || verify_backup_code!(code)

      def verify_backup_code!(code)

        # backup codes are case-insensitive and white-space-insensitive

        code = code.to_s.remove(/[[:space:]]/).downcase

        user_from_code = Token.find_active_user('twofa_backup_code', code)

        # invalidate backup code after usage

        Token.where(user_id: @user.id).find_token('twofa_backup_code', code).try(:delete)

        # make sure the user using the backup code is the same it's been issued to

        return false unless (@user.present? && @user == user_from_code)

        Mailer.security_notification(

          @user,

          User.current,

          {

            originator: @user,

            title: :label_my_account,

            message: 'twofa_mail_body_backup_code_used',

            url: { controller: 'my', action: 'account' }

          }

        ).deliver

        return true

      end

      def init_backup_codes!

        backup_codes.delete_all

        tokens = []

        10.times do

          token = Token.create(user_id: @user.id, action: 'twofa_backup_code')

          token.update_columns value: Redmine::Utils.random_hex(6)

          tokens << token

        end

        Mailer.security_notification(

          @user,

          User.current,

          {

            title: :label_my_account,

            message: 'twofa_mail_body_backup_codes_generated',

            url: { controller: 'my', action: 'account' }

          }

        ).deliver

        tokens

      end

      def backup_codes

        Token.where(user_id: @user.id, action: 'twofa_backup_code')

      end

ul.twofa_backup_codes { list-style-type: none; padding: 0; display: inline-block; }

ul.twofa_backup_codes li { float: left; }

ul.twofa_backup_codes li:nth-child(odd) { float: left; clear: left; padding-right: 4em; }