Skip to content

Refactor authorization configuration to enhance access control and add cancel link in TOTP forms #8182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
f2c-ci-robot merged 1 commit into from
Jan 7, 2026
Merged

Refactor authorization configuration to enhance access control and add cancel link in TOTP forms #8182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 19 additions & 6 deletions ...n/src/main/java/run/halo/app/security/authorization/AuthorizationExchangeConfigurers.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
import reactor.core.publisher.Mono;
import run.halo.app.core.user.service.RoleService;
import run.halo.app.security.authentication.SecurityConfigurer;
import run.halo.app.security.authentication.twofactor.TwoFactorAuthentication;

/**
* Authorization exchange configurers.
Expand Down Expand Up @@ -61,13 +62,25 @@ SecurityConfigurer preAuthenticationAuthorizationConfigurer() {
.hasRole(AuthorityUtils.SUPER_ROLE_NAME)
.pathMatchers("/logout/impersonate")
.hasAuthority(SwitchUserWebFilter.ROLE_PREVIOUS_ADMINISTRATOR)
.pathMatchers("/challenges/**")
.access((authentication, context) ->
authentication.map(TwoFactorAuthentication.class::isInstance)
.map(AuthorizationDecision::new)
.switchIfEmpty(Mono.fromSupplier(() -> new AuthorizationDecision(false)))
)
.pathMatchers(
"/login/**",
"/challenges/**",
"/password-reset/**",
"/signup"
)
.permitAll());
.permitAll()
.pathMatchers("/logout")
.access((authentication, context) ->
authentication.map(a -> !authenticationTrustResolver.isAnonymous(a))
.map(AuthorizationDecision::new)
.switchIfEmpty(Mono.fromSupplier(() -> new AuthorizationDecision(false)))
)
);
}

@Bean
Expand All @@ -76,10 +89,10 @@ SecurityConfigurer authenticatedAuthorizationConfigurer() {
// Anonymous user is not allowed
return http -> http.authorizeExchange(
spec -> spec.pathMatchers(
"/console/**",
"/uc/**",
"/logout"
).authenticated()
"/console/**",
"/uc/**"
)
.authenticated()
);
}

Expand Down
15 changes: 13 additions & 2 deletions application/src/main/resources/templates/challenges/two-factor/totp.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,26 @@
<!doctype html>
<html
xmlns:th="https://www.thymeleaf.org"
th:replace="~{gateway_fragments/layout :: layout(title = |#{title} - ${site.title}|, head = null, body = ~{::body})}"
th:replace="~{gateway_fragments/layout :: layout(title = |#{title} - ${site.title}|, head = ~{::head}, body = ~{::body})}"
>
<th:block th:fragment="body">
<div class="gateway-wrapper">
<div class="gateway-wrapper totp-page-wrapper">
<div th:replace="~{gateway_fragments/common::haloLogo}"></div>
<div class="halo-form-wrapper">
<h1 class="form-title" th:text="#{title}"></h1>
<form th:replace="~{gateway_fragments/totp::form}"></form>
</div>
</div>
</th:block>

<th:block th:fragment="head">
<style>
.totp-page-wrapper .cancel-link {
color: var(--color-link);
font-size: var(--text-sm);
text-decoration: none;
text-align: center;
}
</style>
</th:block>
</html>
3 changes: 3 additions & 0 deletions application/src/main/resources/templates/gateway_fragments/totp.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,4 +27,7 @@
<div class="form-item">
<button type="submit" th:text="#{form.submit}"></button>
</div>
<div class="form-item">
<a th:href="@{/logout}" class="cancel-link" th:text="#{form.cancel}"></a>
</div>
</form>
3 changes: 2 additions & 1 deletion application/src/main/resources/templates/gateway_fragments/totp.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
form.messages.invalidError=错误的验证码
form.code.label=验证码
form.submit=验证
form.submit=验证
form.cancel=取消
3 changes: 2 additions & 1 deletion application/src/main/resources/templates/gateway_fragments/totp_en.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
form.messages.invalidError=Invalid TOTP code
form.code.label=TOTP Code
form.submit=Verify
form.submit=Verify
form.cancel=Cancel
3 changes: 2 additions & 1 deletion application/src/main/resources/templates/gateway_fragments/totp_es.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
form.messages.invalidError=Código de verificación incorrecto
form.code.label=Código de Verificación
form.submit=Verificar
form.submit=Verificar
form.cancel=Cancelar
3 changes: 2 additions & 1 deletion application/src/main/resources/templates/gateway_fragments/totp_zh_TW.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
form.messages.invalidError=錯誤的驗證碼
form.code.label=驗證碼
form.submit=驗證
form.submit=驗證
form.cancel=取消
Loading