mirror of
https://gerrit.wikimedia.org/r/mediawiki/extensions/OATHAuth
synced 2024-12-18 02:50:33 +00:00
30fa5efcaf
Changes to the use statements done automatically via script Addition of missing use statement done manually Change-Id: I3b0d2a2a25d4c4c9d11906961634eac1d47afa80
51 lines
1.7 KiB
PHP
51 lines
1.7 KiB
PHP
<?php
|
|
|
|
use MediaWiki\Extension\OATHAuth\OATHAuthServices;
|
|
use MediaWiki\Maintenance\Maintenance;
|
|
use MediaWiki\MediaWikiServices;
|
|
use MediaWiki\Session\SessionManager;
|
|
|
|
if ( getenv( 'MW_INSTALL_PATH' ) ) {
|
|
$IP = getenv( 'MW_INSTALL_PATH' );
|
|
} else {
|
|
$IP = __DIR__ . '/../../..';
|
|
}
|
|
require_once "$IP/maintenance/Maintenance.php";
|
|
|
|
class DisableOATHAuthForUser extends Maintenance {
|
|
public function __construct() {
|
|
parent::__construct();
|
|
$this->addDescription( 'Remove all two-factor authentication devices from a specific user' );
|
|
$this->addArg( 'user', 'The username to remove 2FA devices from.' );
|
|
$this->requireExtension( 'OATHAuth' );
|
|
}
|
|
|
|
public function execute() {
|
|
$username = $this->getArg( 0 );
|
|
|
|
$user = MediaWikiServices::getInstance()->getUserFactory()
|
|
->newFromName( $username );
|
|
if ( $user === null || $user->getId() === 0 ) {
|
|
$this->fatalError( "User $username doesn't exist!" );
|
|
}
|
|
|
|
$repo = OATHAuthServices::getInstance()->getUserRepository();
|
|
$oathUser = $repo->findByUser( $user );
|
|
if ( !$oathUser->isTwoFactorAuthEnabled() ) {
|
|
$this->fatalError( "User $username does not have two-factor authentication enabled!" );
|
|
}
|
|
|
|
$repo->removeAll( $oathUser, 'Maintenance script', false );
|
|
// Kill all existing sessions.
|
|
// If this request to disable 2FA was social-engineered by an attacker,
|
|
// the legitimate user will hopefully log in again to the wiki, and notice that the second factor
|
|
// is missing or different, and alert the operators.
|
|
SessionManager::singleton()->invalidateSessionsForUser( $user );
|
|
|
|
$this->output( "Two-factor authentication disabled for $username.\n" );
|
|
}
|
|
}
|
|
|
|
$maintClass = DisableOATHAuthForUser::class;
|
|
require_once RUN_MAINTENANCE_IF_MAIN;
|