wikimedia/mediawiki-extensions-OATHAuth
1
0
Fork 0
mirror of https://gerrit.wikimedia.org/r/mediawiki/extensions/OATHAuth synced 2024-11-24 00:05:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make disableOATHAuthForUser.php log out the affected user

Browse source 
Bug: T189537
Change-Id: Ib8141aedd674ebbc7b103e1f2e8ba6bf99945b61
This commit is contained in:
Gergő Tisza 2018-11-20 19:55:17 -08:00 committed by Reedy
parent e0c47addf6
commit 30ed1852b2
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
maintenance/disableOATHAuthForUser.php
View file

@ -1,5 +1,7 @@
<?php
use MediaWiki\Session\SessionManager;
if ( getenv( 'MW_INSTALL_PATH' ) ) {
$IP = getenv( 'MW_INSTALL_PATH' );
} else {
@ -32,6 +34,11 @@ class DisableOATHAuthForUser extends Maintenance {
}
$repo->remove( $oathUser, 'Maintenance script' );
// Kill all existing sessions. If this disable was social-engineered by an attacker,
// the legitimate user will hopefully login again and notice that the second factor
// is missing or different, and alert the operators.
SessionManager::singleton()->invalidateSessionsForUser( $user );
$this->output( "OATHAuth disabled for $username.\n" );
}
}