ethiele/signage
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: ethiele:ac343cef675677d8068549dd12f0eabc5be8207d
Branches Tags
ethiele:main
...
compare: ethiele:c76a917a6d7bd194764d2428167e57d3ef39416c
Branches Tags
ethiele:main

2 Commits
ac343cef67 ... c76a917a6d

Author SHA1 Message Date
Erik Thiele
c76a917a6d chore: Version auf 6.2.4 heben 2026-09-07 10:46:09 +02:00
Erik Thiele
c56006c18d fix: Trusted Device bei MFA zuverlaessig speichern und pruefen 
- Dropdown fuer die Merk-Dauer aktiviert jetzt die Checkbox mit; bisher
  wurde die Auswahl ohne gesetzten Haken verworfen und trotzdem nach
  jedem Login ein Code verlangt.
- Abgelaufene oder defekte Trusted-Device-Eintraege fuehrten beim Login
  zu einem NameError (users_data war nicht geladen); Bereinigung neu
  geschrieben.
- Cookie erhaelt das Secure-Flag, wenn die Verbindung HTTPS ist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-09-07 10:46:09 +02:00
4 changed files with 331 additions and 40 deletions
Expand all files Collapse all files

44
app.py
View File

@@ -51,7 +51,7 @@ CONFIG_FILE = os.path.join(BASE_DIR, "config.json") # Persistente Konfiguration
USERS_FILE = os.path.join(BASE_DIR, "users.json") # User-Datenbank
HISTORY_FILE = os.path.join(BASE_DIR, "history.json") # Aktivitätsverlauf
APP_VERSION = "6.2.3"
APP_VERSION = "6.2.4"
UPLOAD_EXTENSIONS = {".jpg", ".jpeg", ".png", ".mp4"}
app = Flask(__name__)
@@ -731,29 +731,29 @@ def login():
trust_token = request.cookies.get("mfa_trust")
if trust_token:
now = datetime.now()
# Abgelaufene Einträge bereinigen
active = [d for d in user.trusted_devices
if d.get("token") != trust_token or
datetime.fromisoformat(d["expires"]) > now]
changed = len(active) != len(user.trusted_devices)
treffer = None
aktiv = []
for d in user.trusted_devices:
try:
expires = datetime.fromisoformat(d["expires"])
except (ValueError, KeyError, TypeError):
continue # kaputter Eintrag fliegt raus
if expires <= now:
continue # abgelaufener Eintrag fliegt raus
aktiv.append(d)
if d.get("token") == trust_token:
try:
expires = datetime.fromisoformat(d["expires"])
if expires > now:
# Trusted Device gültig → MFA überspringen
login_user(user)
add_history_entry("user_login", f"User '{email}' angemeldet (Trusted Device)", email)
if user.must_change_password:
return redirect("/change-password")
return redirect("/admin")
else:
pass
except (ValueError, KeyError):
pass
if changed:
users_data[email]["trusted_devices"] = active
treffer = d
if len(aktiv) != len(user.trusted_devices):
users_data = load_users()
users_data.setdefault(email, {})["trusted_devices"] = aktiv
save_users(users_data)
if treffer:
# Trusted Device gültig → MFA überspringen
login_user(user)
add_history_entry("user_login", f"User '{email}' angemeldet (Trusted Device)", email)
if user.must_change_password:
return redirect("/change-password")
return redirect("/admin")
session["mfa_user"] = email
session["mfa_password_ok"] = True
return redirect("/mfa/verify")
@@ -828,7 +828,7 @@ def mfa_verify():
resp.set_cookie("mfa_trust", token, max_age=days * 86400,
path="/",
httponly=True, samesite="Lax",
secure=False)
secure=request.is_secure)
return resp
except (ValueError, TypeError):
pass

300
history.json
View File

@@ -1,4 +1,304 @@
[
{
"timestamp": "2026-09-07 10:45:56",
"action": "user_login",
"detail": "User 't@x.de' angemeldet (Trusted Device)",
"user": "t@x.de"
},
{
"timestamp": "2026-09-07 10:45:56",
"action": "user_login",
"detail": "User 't@x.de' angemeldet (mit MFA, Ger\u00e4t f\u00fcr 7 Tage gespeichert)",
"user": "t@x.de"
},
{
"timestamp": "2026-09-07 10:44:24",
"action": "user_login",
"detail": "User 't@x.de' angemeldet (Trusted Device)",
"user": "t@x.de"
},
{
"timestamp": "2026-09-07 10:44:24",
"action": "user_login",
"detail": "User 't@x.de' angemeldet (mit MFA, Ger\u00e4t f\u00fcr 7 Tage gespeichert)",
"user": "t@x.de"
},
{
"timestamp": "2026-09-04 10:38:34",
"action": "user_login",
"detail": "User 'erik.thiele@cancom.de' angemeldet",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 17:58:05",
"action": "screen_deleted",
"detail": "Screen 'xxx' an Standort 'test' gel\u00f6scht",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 17:57:39",
"action": "screen_created",
"detail": "Screen 'xxx' an Standort 'test' angelegt",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 17:56:56",
"action": "background_uploaded",
"detail": "Hintergrundbild f\u00fcr Standort 'test' hochgeladen",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 17:53:02",
"action": "customer_added",
"detail": "Kunden (WIN, IBM, Gaufer) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: casino, vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 17:44:39",
"action": "screen_created",
"detail": "Screen 'casino' an Standort 'test' angelegt",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 17:44:31",
"action": "site_deleted",
"detail": "Standort 'casino' gel\u00f6scht",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 17:44:25",
"action": "site_created",
"detail": "Standort 'casino' angelegt",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 17:41:44",
"action": "customer_added",
"detail": "Kunden (WIN, IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 17:41:32",
"action": "customer_added",
"detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 17:40:55",
"action": "customer_added",
"detail": "Kunden (XXTT) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 16:10:33",
"action": "customer_added",
"detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:59:00",
"action": "customer_added",
"detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:52:39",
"action": "customer_added",
"detail": "Kunden (Teamshop Kuenzelsau, IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:52:13",
"action": "customer_added",
"detail": "Kunden (Teamshop Kuenzelsau, IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:52:04",
"action": "customer_added",
"detail": "Kunden (Teamshop Kuenzelsau, IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:42:42",
"action": "customer_added",
"detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:42:25",
"action": "customer_added",
"detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:36:52",
"action": "customer_added",
"detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "admin"
},
{
"timestamp": "2026-09-02 15:32:23",
"action": "customer_added",
"detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:32:06",
"action": "customer_added",
"detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:31:59",
"action": "customer_added",
"detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:31:44",
"action": "customer_added",
"detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:31:31",
"action": "customer_added",
"detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:31:14",
"action": "customer_added",
"detail": "Kunden (IBM) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:30:36",
"action": "customer_added",
"detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:28:22",
"action": "customer_added",
"detail": "Kunden (Teamshop Kuenzelsau) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "admin"
},
{
"timestamp": "2026-09-02 15:26:50",
"action": "customer_added",
"detail": "Kunden (HellesLogo) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "admin"
},
{
"timestamp": "2026-09-02 15:23:36",
"action": "customer_added",
"detail": "Kunden (UploadTest) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "admin"
},
{
"timestamp": "2026-09-02 15:22:22",
"action": "customer_added",
"detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:21:07",
"action": "customer_added",
"detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:19:35",
"action": "customer_added",
"detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:19:21",
"action": "customer_added",
"detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:09:15",
"action": "customer_added",
"detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:08:35",
"action": "customer_added",
"detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:08:14",
"action": "customer_added",
"detail": "Kunden (ibm) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:07:50",
"action": "customer_added",
"detail": "Kunden (ibm, lenovo, logitech) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:02:34",
"action": "customer_added",
"detail": "Kunden (ibm, lenovo, logitech) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:02:01",
"action": "customer_added",
"detail": "Kunden (ibm, lenovo, logitech) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 15:01:07",
"action": "customer_added",
"detail": "Kunden (ibm, lenovo, logitech) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: logos, vorstand)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 14:35:54",
"action": "customer_added",
"detail": "Kunden (Testkunde) zur Willkommensseite an Standort 'test' hinzugef\u00fcgt (Screens: vorstand)",
"user": "admin"
},
{
"timestamp": "2026-09-02 14:31:04",
"action": "screen_created",
"detail": "Screen 'vorstand' an Standort 'test' angelegt",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 14:30:58",
"action": "site_created",
"detail": "Standort 'test' angelegt",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 14:30:51",
"action": "user_login",
"detail": "User 'erik.thiele@cancom.de' angemeldet",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 14:29:42",
"action": "password_changed",
"detail": "Passwort f\u00fcr User 'erik.thiele@cancom.de' ge\u00e4ndert",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-09-02 14:29:34",
"action": "user_login",
"detail": "User 'erik.thiele@cancom.de' angemeldet (Passwort-\u00c4nderung erforderlich)",
"user": "erik.thiele@cancom.de"
},
{
"timestamp": "2026-08-29 16:20:09",
"action": "user_login",

9
templates/mfa_verify.html
View File

@@ -46,7 +46,7 @@
<input class="form-check-input" type="checkbox" id="remember" name="remember" value="7">
<label class="form-check-label" for="remember">
Gerät für
<select class="form-select form-select-sm d-inline-block w-auto" id="remember_days" onchange="document.getElementById('remember').value=this.value">
<select class="form-select form-select-sm d-inline-block w-auto" id="remember_days">
<option value="1">1 Tag</option>
<option value="3">3 Tage</option>
<option value="7" selected>7 Tage</option>
@@ -61,10 +61,13 @@
var cb = document.getElementById('remember');
var sel = document.getElementById('remember_days');
cb.addEventListener('change', function() {
if (this.checked) this.value = sel.value;
this.value = sel.value;
});
// Wer im Dropdown eine Dauer waehlt, will das Geraet merken:
// Checkbox automatisch mit aktivieren.
sel.addEventListener('change', function() {
if (cb.checked) cb.value = this.value;
cb.checked = true;
cb.value = this.value;
});
})();
</script>

16
users.json
View File

@@ -19,7 +19,6 @@
"trusted_devices": []
},
"erik.thiele@cancom.de": {
"password_hash": "scrypt:32768:8:1$D8XYprsEYMO5EPrG$2829b18f77bbd7d9f0cbb945b0bdbc32e16d7889f8711881f82dd35accd26ddb7c31d3fa85e3b89d19d6d1f0b92d8d18765e1c82044188cab8fd0db2d35a0d15",
"role": "admin",
"sites": [],
"must_change_password": false,
@@ -27,24 +26,13 @@
"last_name": "Thiele",
"department": "CSO",
"notes": "Standort Stuttgart",
"mfa_secret": "LR5DYI3SQPMW5XWKO33HPETHY5TPOWRG",
"mfa_enabled": true,
"mfa_recovery_codes": [
"7BBD93",
"EB1D3B",
"BEE291",
"D471D5",
"D43C00",
"75DBAC",
"8B00CB",
"7AF72D"
],
"trusted_devices": [
{
"token": "5kMgj4JPxd2IHuzV5MagAAcYyi_DBImyGimBSvZUNVg",
"expires": "2026-07-24T15:40:28.955130"
}
]
],
"password_hash": "scrypt:32768:8:1$9k9WAwHOnYTdKY4Q$869e9bec6a838c212543a228edc7a516933b37b9494bb1d10424f18adef3ea132d4c340ab939ca023c22ab0d4def13ad64c44a648f64ce519c2097adc0537f92"
},
"test1@test.de": {
"password_hash": "scrypt:32768:8:1$35kBhL79TJyVA3Rz$98b2e269db5ae96c9285323a274a0cc5b199fb45078e7530b5e72cdb9b96d5b522aa18fd06ce0f801bd19ec68ed323ffa04ce484cfb849eba73b9260ca6a50e1",