search

alexandregz / twofactor_gauthenticator

This RoundCube plugin adds the 2-step verification(OTP) to the login proccess
MIT License
216 stars 76 forks source link

'login_after' hook conflict with 'carddav' plugin; requires manual RC plugin ordering -- 2FA must be last ? #130

Closed pgnd closed 2 years ago

pgnd commented 3 years ago

I've installed RoundCube +

composer show | egrep "carddav|two"
    alexandregz/twofactor_gauthenticator dev-master fbeca4c This RoundCube plugin adds the Google 2-step verification to th...
    mstilkerich/carddavclient            v0.1.6             CardDAV client library to discover and synchronize with CardDAV...
    roundcube/carddav                    v4.0.0             CardDAV adapter for connecting to CardDAV-enabled addressbooks

2FA works.

manually added CardDAV addressbooks work.

auto-added, CardDAV addressbook presets FAIL to register/appear

in a bug files @ carddav

Preset adressbook not created, RC + rmcarddav v4 + sqlite3 
 https://github.com/blind-coder/rcmcarddav/issues/304

it appears the cause is a plugin-order dependency; 'fix' is to manually move 'twofactor_gauthenticator' AFTER 'carddav'.

Maybe it helps if you put twofactor_gauthenticator last in the list.

with

    $config['plugins'] = array(
        'archive',
        'managesieve',
        'password',
        'zipdownload',
-       'twofactor_gauthenticator',
        'carddav',
+       'twofactor_gauthenticator',
    );

the dev's comment there suggests a bug in 'twofactor_gauthenticator',

Each plugin can register hooks with roundcube that are executed on certain events, such as after login. I assume that roundcube calls the hook functions in the order registered, and initializes the plugin in the order listed in the configuration. That means that with the new ordering, the 2FA's login_after hooks are called after all the other plugins' ones.

The problem with the 2FA plugin is that it captures that hook, i.e. the login_after hook of that plugin does not return and thus no more login_after hooks that may follow in the list would be invoked. I consider this a bug in that plugin, but if this workaround works -> fine. Otherwise, there is also a 2FA plugin by the roundcube creators that does not have this behavior. (I never tried any of these plugins myself).