bump version to 8.1.4

[pve-access-control.git] / src / PVE / API2 / TFA.pm

diff --git a/src/PVE/API2/TFA.pm b/src/PVE/API2/TFA.pm
index 954584233164f118b4183cc740eb30a7622cf533..62ddd959378008ae3caf6ea92e04d43b489fc358 100644 (file)
--- a/src/PVE/API2/TFA.pm
+++ b/src/PVE/API2/TFA.pm
@@ -18,8 +18,8 @@ use PVE::RESTHandler;
 
 use base qw(PVE::RESTHandler);
 
-my $OPTIONAL_PASSWORD_SCHEMA = {
-    description => "The current password.",
+our $OPTIONAL_PASSWORD_SCHEMA = {
+    description => "The current password of the user performing the change.",
     type => 'string',
     optional => 1, # Only required if not root@pam
     minLength => 5,
@@ -95,36 +95,6 @@ my $TFA_UPDATE_INFO_SCHEMA = {
     },
 };
 
-# Only root may modify root, regular users need to specify their password.
-#
-# Returns the userid returned from `verify_username`.
-# Or ($userid, $realm) in list context.
-my sub root_permission_check : prototype($$$$) {
-    my ($rpcenv, $authuser, $userid, $password) = @_;
-
-    ($userid, undef, my $realm) = PVE::AccessControl::verify_username($userid);
-    $rpcenv->check_user_exist($userid);
-
-    raise_perm_exc() if $userid eq 'root@pam' && $authuser ne 'root@pam';
-
-    # Regular users need to confirm their password to change TFA settings.
-    if ($authuser ne 'root@pam') {
-       raise_param_exc({ 'password' => 'password is required to modify TFA data' })
-           if !defined($password);
-
-       ($authuser, my $auth_username, my $auth_realm) =
-           PVE::AccessControl::verify_username($authuser);
-
-       my $domain_cfg = cfs_read_file('domains.cfg');
-       my $cfg = $domain_cfg->{ids}->{$auth_realm};
-       die "auth domain '$auth_realm' does not exist\n" if !$cfg;
-       my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
-       $plugin->authenticate_user($cfg, $auth_realm, $auth_username, $password);
-    }
-
-    return wantarray ? ($userid, $realm) : $userid;
-}
-
 # Set TFA to enabled if $tfa_cfg is passed, or to disabled if $tfa_cfg is undef,
 # When enabling we also merge the old user.cfg keys into the $tfa_cfg.
 my sub set_user_tfa_enabled : prototype($$$) {
@@ -242,12 +212,13 @@ __PACKAGE__->register_method ({
     code => sub {
        my ($param) = @_;
 
-       PVE::AccessControl::assert_new_tfa_config_available();
-       
        my $rpcenv = PVE::RPCEnvironment::get();
        my $authuser = $rpcenv->get_user();
-       my $userid =
-           root_permission_check($rpcenv, $authuser, $param->{userid}, $param->{password});
+       my $userid = $rpcenv->reauth_user_for_user_modification(
+           $authuser,
+           $param->{userid},
+           $param->{password},
+       );
 
        my $has_entries_left = PVE::AccessControl::lock_tfa_config(sub {
            my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
@@ -378,12 +349,13 @@ __PACKAGE__->register_method ({
     code => sub {
        my ($param) = @_;
 
-       PVE::AccessControl::assert_new_tfa_config_available();
-
        my $rpcenv = PVE::RPCEnvironment::get();
        my $authuser = $rpcenv->get_user();
-       my ($userid, $realm) =
-           root_permission_check($rpcenv, $authuser, $param->{userid}, $param->{password});
+       my ($userid, undef, $realm) = $rpcenv->reauth_user_for_user_modification(
+           $authuser,
+           $param->{userid},
+           $param->{password},
+       );
 
        my $type = delete $param->{type};
        my $value = delete $param->{value};
@@ -413,7 +385,7 @@ __PACKAGE__->register_method ({
        });
     }});
 
-sub validate_yubico_otp : prototype($$) {
+sub validate_yubico_otp : prototype($$$) {
     my ($userid, $realm, $value) = @_;
 
     my $domain_cfg = cfs_read_file('domains.cfg');
@@ -473,12 +445,13 @@ __PACKAGE__->register_method ({
     code => sub {
        my ($param) = @_;
 
-       PVE::AccessControl::assert_new_tfa_config_available();
-
        my $rpcenv = PVE::RPCEnvironment::get();
        my $authuser = $rpcenv->get_user();
-       my $userid =
-           root_permission_check($rpcenv, $authuser, $param->{userid}, $param->{password});
+       my $userid = $rpcenv->reauth_user_for_user_modification(
+           $authuser,
+           $param->{userid},
+           $param->{password},
+       );
 
        PVE::AccessControl::lock_tfa_config(sub {
            my $tfa_cfg = cfs_read_file('priv/tfa.cfg');