[java-idp-plugin-duo] branch main updated: Still need 2 forms unfortunately.

Tue Jan 9 14:20:51 UTC 2024

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-idp-plugin-duo.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-duo.git;a=commit;h=7108bf91350070d96ad4d5d2a348a76be47be47b

The following commit(s) were added to refs/heads/main by this push:
     new 7108bf91 Still need 2 forms unfortunately.
7108bf91 is described below

commit 7108bf91350070d96ad4d5d2a348a76be47be47b
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jan 9 09:20:48 2024 -0500

    Still need 2 forms unfortunately.
---
 .../idp/plugin/authn/duo/views/passwordless.vm        | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
index 6f0e73ba..57ad66aa 100644
--- a/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
+++ b/idp-duo-impl/src/main/resources/net/shibboleth/idp/plugin/authn/duo/views/passwordless.vm
@@ -25,6 +25,8 @@
 #end
 #set ($nonce = $cspNonce.generateIdentifier())
 $response.addHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")
+#set ($onClick = "document.forms.password.j_username.value = document.forms.passwordless.j_username.value")
+$response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onClick)'")
 ##
 <!DOCTYPE html>
 <html>
@@ -73,19 +75,24 @@ $response.addHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")
                 please enter your username below and press the corresponding button. To bypass this option, just press the alternate button
                 to perform a traditional login.")</blockquote>
 
-                <form action="$flowExecutionUrl" method="post">
+                <form name="password" action="$flowExecutionUrl" method="post">
                     #parse("csrf/csrf.vm")
+                    <input name="j_username" type="hidden" value="" />
                     <div class="grid">
                         <div class="grid-item">
-                            <button type="button" name="_eventId_cancel"
+                            <button type="submit" name="_eventId_cancel" onClick="$onClick"
                                 >#springMessageText("idp.duo.passwordless.cancel", "Login with Password")</button>
                         </div>
                     </div>
-                    
-                    #if ($eventId == "RequestUnsupported")
-                        <p class="output-message output--error">$encoder.encodeForHTML("#springMessageText('idp.duo.passwordless.unsupported', 'You have not enrolled a qualifying device for Passwordless use.')")</p>
-                    #end
+                </form>
+                
+                #if ($eventId == "RequestUnsupported")
+                    <p class="output-message output--error">$encoder.encodeForHTML("#springMessageText('idp.duo.passwordless.unsupported', 'You have not enrolled a qualifying device for Passwordless use.')")</p>
+                #end
                         
+                <form name="passwordless" action="$flowExecutionUrl" method="post">
+                    #parse("csrf/csrf.vm")
+                    
                     <label for="username">#springMessageText("idp.login.username", "Username")</label>
                     <input id="j_username" name="j_username" type="text"
                         value="#if($username)$encoder.encodeForHTML($username)#end" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
