feat: Fixes openemr#6839 show mfa shared secret (openemr#6847)

* Fixes openemr#6839 show mfa shared secret In order to use a non-qr type TOTP code we need to show the shared secret when going to add the code. * Add MFA shared secret to setup page. In order to use an mfa TOTP app that doesn't support qr scanning we need to display a shared secret on the setup page.
sjpadgett · Sep 13, 2023 · b284377 · b284377
1 parent 5fa36a3
commit b284377
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 3 deletions.
diff --git a/interface/usergroup/mfa_totp.php b/interface/usergroup/mfa_totp.php
@@ -185,6 +185,8 @@ function docancel() {
                                             <br />
                                             <img src="<?php echo attr($qr); ?>" class="img-responsive center-block" style="height:200px !Important"/>
                                             <br />
+                                            <p><?php echo xlt("Or paste in the following code into your authenticator app"); ?></p>
+                                            <p><?php echo $mfaAuth->getSecret(); ?></p>
                                             <p><?php echo xlt('Example authenticator apps include'); ?></p>:
                                             <div class="col-sm-4 offset-sm-4">
                                                 <ul>

diff --git a/library/classes/Installer.class.php b/library/classes/Installer.class.php
@@ -490,6 +490,7 @@ public function on_care_coordination()
 
     /**
      * Generates the initial user's 2FA QR Code
+     * @deprecated Recommended to use get_initial_user_mfa_totp() instead
      * @return bool|string|void
      */
     public function get_initial_user_2fa_qr()
@@ -502,6 +503,19 @@ public function get_initial_user_2fa_qr()
         return false;
     }
 
+    /**
+     * Generates the initial user's 2FA QR Code
+     * @return bool|string|void
+     */
+    public function get_initial_user_mfa_totp()
+    {
+        if (($this->i2faEnable) && (!empty($this->i2faSecret)) && (class_exists('Totp'))) {
+            $adminTotp = new Totp($this->i2faSecret, $this->iuser);
+            return $adminTotp;
+        }
+        return false;
+    }
+
   /**
    * Create site directory if it is missing.
    * @global string $GLOBALS['OE_SITE_DIR'] contains the name of the site directory to create

diff --git a/setup.php b/setup.php
@@ -1375,9 +1375,11 @@ function cloneClicked() {
                     }
 
                     // If user has selected to set MFA App Based 2FA, display QR code to scan
-                    $qr = $installer->get_initial_user_2fa_qr();
-                    $qr_esc = attr($qr);
-                    if ($qr) {
+                    $mfa = $installer->get_initial_user_mfa_totp();
+                    if ($mfa !== false) {
+                        $qr = $mfa->generateQrCode();
+                        $qr_esc = attr($qr);
+                        $sharedSecret = text($mfa->getSecret());
                         $qrDisplay = <<<TOTP
                                     <br />
                                     <table>
@@ -1386,6 +1388,8 @@ function cloneClicked() {
                                                 <strong class='text-danger'>IMPORTANT!!</strong>
                                                 <p><strong>You must scan the following QR code with your preferred authenticator app.</strong></p>
                                                 <img src='$qr_esc' width="150" />
+                                                <p>Or paste in the following code into your authenticator app</p>
+                                                <p>$sharedSecret</p>
                                             </td>
                                         </tr>
                                         <tr>