mediawiki-extensions-OATHAuth/maintenance/disableOATHAuthForUser.php
Taavi Väänänen c09ec34213
Make Key objects aware of their database IDs
Bug: T242031
Depends-On: I1db9b04a42783b8b64ed69f1f950c794c8659209
Change-Id: I0d8d0a42ce627387949dbbbb32fc318088b3538e
2024-03-02 18:53:00 +02:00

50 lines
1.6 KiB
PHP

<?php
use MediaWiki\Extension\OATHAuth\OATHAuthServices;
use MediaWiki\MediaWikiServices;
use MediaWiki\Session\SessionManager;
if ( getenv( 'MW_INSTALL_PATH' ) ) {
$IP = getenv( 'MW_INSTALL_PATH' );
} else {
$IP = __DIR__ . '/../../..';
}
require_once "$IP/maintenance/Maintenance.php";
class DisableOATHAuthForUser extends Maintenance {
public function __construct() {
parent::__construct();
$this->addDescription( 'Remove all two-factor authentication devices from a specific user' );
$this->addArg( 'user', 'The username to remove 2FA devices from.' );
$this->requireExtension( 'OATHAuth' );
}
public function execute() {
$username = $this->getArg( 0 );
$user = MediaWikiServices::getInstance()->getUserFactory()
->newFromName( $username );
if ( $user === null || $user->getId() === 0 ) {
$this->fatalError( "User $username doesn't exist!" );
}
$repo = OATHAuthServices::getInstance()->getUserRepository();
$oathUser = $repo->findByUser( $user );
if ( !$oathUser->isTwoFactorAuthEnabled() ) {
$this->fatalError( "User $username does not have two-factor authentication enabled!" );
}
$repo->removeAll( $oathUser, 'Maintenance script', false );
// Kill all existing sessions.
// If this request to disable 2FA was social-engineered by an attacker,
// the legitimate user will hopefully log in again to the wiki, and notice that the second factor
// is missing or different, and alert the operators.
SessionManager::singleton()->invalidateSessionsForUser( $user );
$this->output( "Two-factor authentication disabled for $username.\n" );
}
}
$maintClass = DisableOATHAuthForUser::class;
require_once RUN_MAINTENANCE_IF_MAIN;