Add Admin Recovery System with multiple backup options
- Recovery key generation (32-char alphanumeric, dashed format) - Multiple backup methods: text file, QR code, stego image - QR codes obfuscated with XOR (RECOVERY_OBFUSCATION_KEY constant) - Stego backup hides key in image using Stegasoo itself - CLI: `stegasoo admin recover --db path/to/db` - Web routes: /recover, /account/recovery/regenerate - Toast notifications now auto-dismiss after 20s with fade - Updated WEB_UI.md and CLI.md documentation for v4.1.0 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Aaron D. Lee
@@ -48,6 +48,9 @@ from auth import (
|
||||
get_user_by_id,
|
||||
get_user_channel_keys,
|
||||
get_username,
|
||||
has_recovery_key,
|
||||
get_recovery_key_hash,
|
||||
clear_recovery_key,
|
||||
is_admin,
|
||||
is_authenticated,
|
||||
login_required,
|
||||
@@ -55,6 +58,8 @@ from auth import (
|
||||
logout_user,
|
||||
reset_user_password,
|
||||
save_channel_key,
|
||||
set_recovery_key_hash,
|
||||
verify_and_reset_admin_password,
|
||||
update_channel_key_last_used,
|
||||
update_channel_key_name,
|
||||
user_exists,
|
||||
@@ -1586,7 +1591,7 @@ def logout():
|
||||
|
||||
@app.route("/setup", methods=["GET", "POST"])
|
||||
def setup():
|
||||
"""First-run setup page - create admin account."""
|
||||
"""First-run setup page - create admin account (Step 1)."""
|
||||
if not app.config.get("AUTH_ENABLED", True):
|
||||
return redirect(url_for("index"))
|
||||
|
||||
@@ -1608,14 +1613,219 @@ def setup():
|
||||
if user:
|
||||
login_user(user)
|
||||
session.permanent = True
|
||||
flash("Admin account created successfully!", "success")
|
||||
return redirect(url_for("index"))
|
||||
# Redirect to recovery key setup (Step 2)
|
||||
return redirect(url_for("setup_recovery"))
|
||||
else:
|
||||
flash(message, "error")
|
||||
|
||||
return render_template("setup.html")
|
||||
|
||||
|
||||
@app.route("/setup/recovery", methods=["GET", "POST"])
|
||||
@login_required
|
||||
def setup_recovery():
|
||||
"""Recovery key setup page (Step 2 of initial setup)."""
|
||||
from stegasoo.recovery import generate_recovery_key, hash_recovery_key, generate_recovery_qr
|
||||
import base64
|
||||
|
||||
# Only allow during initial setup (no recovery key yet, first admin)
|
||||
if has_recovery_key():
|
||||
return redirect(url_for("index"))
|
||||
|
||||
current_user = get_current_user()
|
||||
if current_user.role != "admin":
|
||||
return redirect(url_for("index"))
|
||||
|
||||
if request.method == "POST":
|
||||
action = request.form.get("action")
|
||||
|
||||
if action == "skip":
|
||||
# No recovery key - most secure but no way to recover
|
||||
flash("Setup complete. No recovery key configured.", "warning")
|
||||
return redirect(url_for("index"))
|
||||
|
||||
elif action == "save":
|
||||
# User confirmed they saved the key
|
||||
recovery_key = request.form.get("recovery_key")
|
||||
if recovery_key:
|
||||
key_hash = hash_recovery_key(recovery_key)
|
||||
set_recovery_key_hash(key_hash)
|
||||
flash("Setup complete. Recovery key saved.", "success")
|
||||
return redirect(url_for("index"))
|
||||
|
||||
# Generate a new key to show
|
||||
recovery_key = generate_recovery_key()
|
||||
|
||||
# Generate QR code as base64
|
||||
try:
|
||||
qr_bytes = generate_recovery_qr(recovery_key)
|
||||
qr_base64 = base64.b64encode(qr_bytes).decode("utf-8")
|
||||
except ImportError:
|
||||
qr_base64 = None
|
||||
|
||||
return render_template(
|
||||
"setup_recovery.html",
|
||||
recovery_key=recovery_key,
|
||||
qr_base64=qr_base64,
|
||||
)
|
||||
|
||||
|
||||
@app.route("/recover", methods=["GET", "POST"])
|
||||
def recover():
|
||||
"""Password recovery page - reset password using recovery key."""
|
||||
# Don't show if no recovery key configured
|
||||
if not get_recovery_key_hash():
|
||||
flash("No recovery key configured for this instance", "error")
|
||||
return redirect(url_for("login"))
|
||||
|
||||
if request.method == "POST":
|
||||
recovery_key = request.form.get("recovery_key", "").strip()
|
||||
new_password = request.form.get("new_password", "")
|
||||
new_password_confirm = request.form.get("new_password_confirm", "")
|
||||
|
||||
if not recovery_key:
|
||||
flash("Please enter your recovery key", "error")
|
||||
elif new_password != new_password_confirm:
|
||||
flash("Passwords do not match", "error")
|
||||
elif len(new_password) < 8:
|
||||
flash("Password must be at least 8 characters", "error")
|
||||
else:
|
||||
success, message = verify_and_reset_admin_password(recovery_key, new_password)
|
||||
if success:
|
||||
flash("Password reset successfully. Please login.", "success")
|
||||
return redirect(url_for("login"))
|
||||
else:
|
||||
flash(message, "error")
|
||||
|
||||
return render_template("recover.html")
|
||||
|
||||
|
||||
@app.route("/account/recovery/regenerate", methods=["GET", "POST"])
|
||||
@login_required
|
||||
@admin_required
|
||||
def regenerate_recovery():
|
||||
"""Generate a new recovery key (replaces existing one)."""
|
||||
from stegasoo.recovery import generate_recovery_key, hash_recovery_key, generate_recovery_qr
|
||||
import base64
|
||||
|
||||
if request.method == "POST":
|
||||
action = request.form.get("action")
|
||||
|
||||
if action == "cancel":
|
||||
flash("Recovery key generation cancelled", "warning")
|
||||
return redirect(url_for("account"))
|
||||
|
||||
elif action == "save":
|
||||
# User confirmed they saved the key
|
||||
recovery_key = request.form.get("recovery_key")
|
||||
if recovery_key:
|
||||
key_hash = hash_recovery_key(recovery_key)
|
||||
set_recovery_key_hash(key_hash)
|
||||
flash("New recovery key saved successfully", "success")
|
||||
return redirect(url_for("account"))
|
||||
|
||||
# Generate a new key to show
|
||||
recovery_key = generate_recovery_key()
|
||||
|
||||
# Generate QR code as base64
|
||||
try:
|
||||
qr_bytes = generate_recovery_qr(recovery_key)
|
||||
qr_base64 = base64.b64encode(qr_bytes).decode("utf-8")
|
||||
except ImportError:
|
||||
qr_base64 = None
|
||||
|
||||
return render_template(
|
||||
"regenerate_recovery.html",
|
||||
recovery_key=recovery_key,
|
||||
qr_base64=qr_base64,
|
||||
has_existing=has_recovery_key(),
|
||||
)
|
||||
|
||||
|
||||
@app.route("/account/recovery/disable", methods=["POST"])
|
||||
@login_required
|
||||
@admin_required
|
||||
def disable_recovery():
|
||||
"""Disable recovery key (no password reset possible)."""
|
||||
if clear_recovery_key():
|
||||
flash("Recovery key disabled. Password reset is no longer possible.", "warning")
|
||||
else:
|
||||
flash("No recovery key was configured", "error")
|
||||
return redirect(url_for("account"))
|
||||
|
||||
|
||||
@app.route("/account/recovery/stego-backup", methods=["POST"])
|
||||
@login_required
|
||||
@admin_required
|
||||
def create_stego_backup():
|
||||
"""Create stego backup - hide recovery key in an image."""
|
||||
from stegasoo.recovery import create_stego_backup as make_backup
|
||||
|
||||
recovery_key = request.form.get("recovery_key", "")
|
||||
if not recovery_key:
|
||||
flash("No recovery key provided", "error")
|
||||
return redirect(url_for("regenerate_recovery"))
|
||||
|
||||
if "carrier_image" not in request.files:
|
||||
flash("No image uploaded", "error")
|
||||
return redirect(url_for("regenerate_recovery"))
|
||||
|
||||
carrier_file = request.files["carrier_image"]
|
||||
if not carrier_file.filename:
|
||||
flash("No image selected", "error")
|
||||
return redirect(url_for("regenerate_recovery"))
|
||||
|
||||
try:
|
||||
carrier_data = carrier_file.read()
|
||||
stego_data = make_backup(recovery_key, carrier_data)
|
||||
|
||||
# Return as downloadable PNG
|
||||
buffer = io.BytesIO(stego_data)
|
||||
return send_file(
|
||||
buffer,
|
||||
mimetype="image/png",
|
||||
as_attachment=True,
|
||||
download_name="stegasoo-recovery-backup.png",
|
||||
)
|
||||
except ValueError as e:
|
||||
flash(str(e), "error")
|
||||
return redirect(url_for("regenerate_recovery"))
|
||||
|
||||
|
||||
@app.route("/recover/stego", methods=["POST"])
|
||||
def recover_from_stego():
|
||||
"""Extract recovery key from stego backup image."""
|
||||
from stegasoo.recovery import extract_stego_backup
|
||||
|
||||
if "stego_image" not in request.files or "reference_image" not in request.files:
|
||||
flash("Both stego image and reference image are required", "error")
|
||||
return redirect(url_for("recover"))
|
||||
|
||||
stego_file = request.files["stego_image"]
|
||||
reference_file = request.files["reference_image"]
|
||||
|
||||
if not stego_file.filename or not reference_file.filename:
|
||||
flash("Both images must be selected", "error")
|
||||
return redirect(url_for("recover"))
|
||||
|
||||
try:
|
||||
stego_data = stego_file.read()
|
||||
reference_data = reference_file.read()
|
||||
|
||||
extracted_key = extract_stego_backup(stego_data, reference_data)
|
||||
|
||||
if extracted_key:
|
||||
# Return the key to pre-fill the recovery form
|
||||
return render_template("recover.html", prefilled_key=extracted_key)
|
||||
else:
|
||||
flash("Could not extract recovery key. Check images are correct.", "error")
|
||||
return redirect(url_for("recover"))
|
||||
|
||||
except Exception as e:
|
||||
flash(f"Extraction failed: {e}", "error")
|
||||
return redirect(url_for("recover"))
|
||||
|
||||
|
||||
@app.route("/account", methods=["GET", "POST"])
|
||||
@login_required
|
||||
def account():
|
||||
@@ -1641,6 +1851,7 @@ def account():
|
||||
username=current_user.username,
|
||||
user=current_user,
|
||||
is_admin=current_user.is_admin,
|
||||
has_recovery=has_recovery_key(),
|
||||
channel_keys=channel_keys,
|
||||
max_channel_keys=MAX_CHANNEL_KEYS,
|
||||
can_save_key=can_save_channel_key(current_user.id),
|
||||
|
||||
@@ -94,8 +94,9 @@ def init_db():
|
||||
# Fresh install - create new schema
|
||||
_create_schema(db)
|
||||
else:
|
||||
# Existing install - check for new tables (channel_keys migration)
|
||||
# Existing install - check for new tables (migrations)
|
||||
_ensure_channel_keys_table(db)
|
||||
_ensure_app_settings_table(db)
|
||||
|
||||
|
||||
def _create_schema(db: sqlite3.Connection):
|
||||
@@ -125,6 +126,15 @@ def _create_schema(db: sqlite3.Connection):
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_channel_keys_user ON user_channel_keys(user_id);
|
||||
|
||||
-- App-level settings (v4.1.0)
|
||||
-- Stores recovery key hash and other instance-wide settings
|
||||
CREATE TABLE IF NOT EXISTS app_settings (
|
||||
key TEXT PRIMARY KEY,
|
||||
value TEXT NOT NULL,
|
||||
created_at TEXT DEFAULT CURRENT_TIMESTAMP,
|
||||
updated_at TEXT DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
""")
|
||||
db.commit()
|
||||
|
||||
@@ -177,6 +187,131 @@ def _ensure_channel_keys_table(db: sqlite3.Connection):
|
||||
db.commit()
|
||||
|
||||
|
||||
def _ensure_app_settings_table(db: sqlite3.Connection):
|
||||
"""Ensure app_settings table exists (v4.1.0 migration)."""
|
||||
cursor = db.execute(
|
||||
"SELECT name FROM sqlite_master WHERE type='table' AND name='app_settings'"
|
||||
)
|
||||
if cursor.fetchone() is None:
|
||||
db.executescript("""
|
||||
CREATE TABLE IF NOT EXISTS app_settings (
|
||||
key TEXT PRIMARY KEY,
|
||||
value TEXT NOT NULL,
|
||||
created_at TEXT DEFAULT CURRENT_TIMESTAMP,
|
||||
updated_at TEXT DEFAULT CURRENT_TIMESTAMP
|
||||
);
|
||||
""")
|
||||
db.commit()
|
||||
|
||||
|
||||
# =============================================================================
|
||||
# App Settings (v4.1.0)
|
||||
# =============================================================================
|
||||
|
||||
|
||||
def get_app_setting(key: str) -> str | None:
|
||||
"""Get an app-level setting value."""
|
||||
db = get_db()
|
||||
row = db.execute(
|
||||
"SELECT value FROM app_settings WHERE key = ?", (key,)
|
||||
).fetchone()
|
||||
return row["value"] if row else None
|
||||
|
||||
|
||||
def set_app_setting(key: str, value: str) -> None:
|
||||
"""Set an app-level setting value."""
|
||||
db = get_db()
|
||||
db.execute(
|
||||
"""
|
||||
INSERT INTO app_settings (key, value)
|
||||
VALUES (?, ?)
|
||||
ON CONFLICT(key) DO UPDATE SET value = ?, updated_at = CURRENT_TIMESTAMP
|
||||
""",
|
||||
(key, value, value),
|
||||
)
|
||||
db.commit()
|
||||
|
||||
|
||||
def delete_app_setting(key: str) -> bool:
|
||||
"""Delete an app-level setting. Returns True if deleted."""
|
||||
db = get_db()
|
||||
cursor = db.execute("DELETE FROM app_settings WHERE key = ?", (key,))
|
||||
db.commit()
|
||||
return cursor.rowcount > 0
|
||||
|
||||
|
||||
# =============================================================================
|
||||
# Recovery Key Management (v4.1.0)
|
||||
# =============================================================================
|
||||
|
||||
|
||||
# Setting key for recovery hash
|
||||
RECOVERY_KEY_SETTING = "recovery_key_hash"
|
||||
|
||||
|
||||
def has_recovery_key() -> bool:
|
||||
"""Check if a recovery key has been configured."""
|
||||
return get_app_setting(RECOVERY_KEY_SETTING) is not None
|
||||
|
||||
|
||||
def get_recovery_key_hash() -> str | None:
|
||||
"""Get the stored recovery key hash."""
|
||||
return get_app_setting(RECOVERY_KEY_SETTING)
|
||||
|
||||
|
||||
def set_recovery_key_hash(key_hash: str) -> None:
|
||||
"""Store a recovery key hash."""
|
||||
set_app_setting(RECOVERY_KEY_SETTING, key_hash)
|
||||
|
||||
|
||||
def clear_recovery_key() -> bool:
|
||||
"""Remove the recovery key. Returns True if removed."""
|
||||
return delete_app_setting(RECOVERY_KEY_SETTING)
|
||||
|
||||
|
||||
def verify_and_reset_admin_password(recovery_key: str, new_password: str) -> tuple[bool, str]:
|
||||
"""
|
||||
Verify recovery key and reset the first admin's password.
|
||||
|
||||
Args:
|
||||
recovery_key: User-provided recovery key
|
||||
new_password: New password to set
|
||||
|
||||
Returns:
|
||||
(success, message) tuple
|
||||
"""
|
||||
from stegasoo.recovery import verify_recovery_key
|
||||
|
||||
stored_hash = get_recovery_key_hash()
|
||||
if not stored_hash:
|
||||
return False, "No recovery key configured for this instance"
|
||||
|
||||
if not verify_recovery_key(recovery_key, stored_hash):
|
||||
return False, "Invalid recovery key"
|
||||
|
||||
# Find first admin user
|
||||
db = get_db()
|
||||
admin = db.execute(
|
||||
"SELECT id, username FROM users WHERE role = 'admin' ORDER BY id LIMIT 1"
|
||||
).fetchone()
|
||||
|
||||
if not admin:
|
||||
return False, "No admin user found"
|
||||
|
||||
# Reset password
|
||||
new_hash = ph.hash(new_password)
|
||||
db.execute(
|
||||
"UPDATE users SET password_hash = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?",
|
||||
(new_hash, admin["id"]),
|
||||
)
|
||||
db.commit()
|
||||
|
||||
# Invalidate all sessions for this user
|
||||
invalidate_user_sessions(admin["id"])
|
||||
|
||||
return True, f"Password reset for '{admin['username']}'"
|
||||
|
||||
|
||||
# =============================================================================
|
||||
# User Queries
|
||||
# =============================================================================
|
||||
|
||||
@@ -25,6 +25,45 @@
|
||||
<i class="bi bi-people me-2"></i>Manage Users
|
||||
</a>
|
||||
</div>
|
||||
|
||||
<!-- Recovery Key Management (Admin only) -->
|
||||
<div class="card bg-dark mb-4">
|
||||
<div class="card-body py-3">
|
||||
<div class="d-flex justify-content-between align-items-center">
|
||||
<div>
|
||||
<i class="bi bi-shield-lock me-2"></i>
|
||||
<strong>Recovery Key</strong>
|
||||
{% if has_recovery %}
|
||||
<span class="badge bg-success ms-2">Configured</span>
|
||||
{% else %}
|
||||
<span class="badge bg-secondary ms-2">Not Set</span>
|
||||
{% endif %}
|
||||
</div>
|
||||
<div class="btn-group btn-group-sm">
|
||||
<a href="{{ url_for('regenerate_recovery') }}" class="btn btn-outline-warning"
|
||||
onclick="return confirm('Generate a new recovery key? This will invalidate any existing key.')">
|
||||
<i class="bi bi-arrow-repeat me-1"></i>
|
||||
{{ 'Regenerate' if has_recovery else 'Generate' }}
|
||||
</a>
|
||||
{% if has_recovery %}
|
||||
<form method="POST" action="{{ url_for('disable_recovery') }}" style="display:inline;">
|
||||
<button type="submit" class="btn btn-outline-danger"
|
||||
onclick="return confirm('Disable recovery? If you forget your password, you will NOT be able to recover your account.')">
|
||||
<i class="bi bi-x-lg"></i>
|
||||
</button>
|
||||
</form>
|
||||
{% endif %}
|
||||
</div>
|
||||
</div>
|
||||
<small class="text-muted d-block mt-2">
|
||||
{% if has_recovery %}
|
||||
Allows password reset if you're locked out.
|
||||
{% else %}
|
||||
No recovery option - most secure, but no password reset possible.
|
||||
{% endif %}
|
||||
</small>
|
||||
</div>
|
||||
</div>
|
||||
{% endif %}
|
||||
|
||||
<h6 class="text-muted mb-3">Change Password</h6>
|
||||
|
||||
@@ -72,7 +72,7 @@
|
||||
<div class="toast-container position-fixed end-0 p-3" style="z-index: 1100; top: 70px;">
|
||||
{% with messages = get_flashed_messages(with_categories=true) %}
|
||||
{% for category, message in messages %}
|
||||
<div class="toast show align-items-center text-bg-{{ 'danger' if category == 'error' else ('warning' if category == 'warning' else 'success') }} border-0" role="alert" data-bs-autohide="true" data-bs-delay="4000">
|
||||
<div class="toast show align-items-center text-bg-{{ 'danger' if category == 'error' else ('warning' if category == 'warning' else 'success') }} border-0 fade" role="alert" data-bs-autohide="true" data-bs-delay="20000">
|
||||
<div class="d-flex">
|
||||
<div class="toast-body">
|
||||
<i class="bi bi-{{ 'exclamation-triangle' if category == 'error' else ('exclamation-circle' if category == 'warning' else 'check-circle') }} me-2"></i>
|
||||
|
||||
@@ -38,6 +38,12 @@
|
||||
<i class="bi bi-box-arrow-in-right me-2"></i>Login
|
||||
</button>
|
||||
</form>
|
||||
|
||||
<div class="text-center mt-3">
|
||||
<a href="{{ url_for('recover') }}" class="text-muted small">
|
||||
<i class="bi bi-key me-1"></i> Forgot password?
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
129
frontends/web/templates/recover.html
Normal file
129
frontends/web/templates/recover.html
Normal file
@@ -0,0 +1,129 @@
|
||||
{% extends "base.html" %}
|
||||
|
||||
{% block title %}Password Recovery - Stegasoo{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<div class="row justify-content-center">
|
||||
<div class="col-md-6 col-lg-5">
|
||||
<div class="card">
|
||||
<div class="card-header text-center">
|
||||
<i class="bi bi-shield-lock fs-1 d-block mb-2"></i>
|
||||
<h5 class="mb-0">Password Recovery</h5>
|
||||
</div>
|
||||
<div class="card-body">
|
||||
<p class="text-muted text-center mb-4">
|
||||
Enter your recovery key to reset your admin password.
|
||||
</p>
|
||||
|
||||
<!-- Extract from Stego Backup -->
|
||||
<div class="accordion mb-3" id="stegoAccordion">
|
||||
<div class="accordion-item">
|
||||
<h2 class="accordion-header">
|
||||
<button class="accordion-button collapsed py-2" type="button"
|
||||
data-bs-toggle="collapse" data-bs-target="#stegoExtract">
|
||||
<i class="bi bi-incognito me-2"></i>
|
||||
<small>Extract from stego backup</small>
|
||||
</button>
|
||||
</h2>
|
||||
<div id="stegoExtract" class="accordion-collapse collapse"
|
||||
data-bs-parent="#stegoAccordion">
|
||||
<div class="accordion-body py-2">
|
||||
<form method="POST" action="{{ url_for('recover_from_stego') }}"
|
||||
enctype="multipart/form-data">
|
||||
<div class="mb-2">
|
||||
<label class="form-label small mb-1">Stego Image</label>
|
||||
<input type="file" name="stego_image"
|
||||
class="form-control form-control-sm"
|
||||
accept="image/*" required>
|
||||
</div>
|
||||
<div class="mb-2">
|
||||
<label class="form-label small mb-1">Original Reference</label>
|
||||
<input type="file" name="reference_image"
|
||||
class="form-control form-control-sm"
|
||||
accept="image/*" required>
|
||||
</div>
|
||||
<button type="submit" class="btn btn-sm btn-outline-primary w-100">
|
||||
<i class="bi bi-unlock me-1"></i> Extract Key
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<form method="POST" action="{{ url_for('recover') }}" id="recoverForm">
|
||||
<!-- Recovery Key Input -->
|
||||
<div class="mb-3">
|
||||
<label class="form-label">
|
||||
<i class="bi bi-key-fill me-1"></i> Recovery Key
|
||||
</label>
|
||||
<textarea name="recovery_key" class="form-control font-monospace"
|
||||
rows="2" required
|
||||
placeholder="XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX"
|
||||
style="font-size: 0.9em;">{{ prefilled_key or '' }}</textarea>
|
||||
<div class="form-text">
|
||||
Paste your full recovery key (with or without dashes)
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<hr>
|
||||
|
||||
<!-- New Password -->
|
||||
<div class="mb-3">
|
||||
<label class="form-label">
|
||||
<i class="bi bi-lock me-1"></i> New Password
|
||||
</label>
|
||||
<div class="input-group">
|
||||
<input type="password" name="new_password" class="form-control"
|
||||
id="passwordInput" required minlength="8">
|
||||
<button class="btn btn-outline-secondary" type="button"
|
||||
onclick="togglePassword('passwordInput', this)">
|
||||
<i class="bi bi-eye"></i>
|
||||
</button>
|
||||
</div>
|
||||
<div class="form-text">Minimum 8 characters</div>
|
||||
</div>
|
||||
|
||||
<!-- Confirm Password -->
|
||||
<div class="mb-4">
|
||||
<label class="form-label">
|
||||
<i class="bi bi-lock-fill me-1"></i> Confirm Password
|
||||
</label>
|
||||
<div class="input-group">
|
||||
<input type="password" name="new_password_confirm" class="form-control"
|
||||
id="passwordConfirmInput" required minlength="8">
|
||||
<button class="btn btn-outline-secondary" type="button"
|
||||
onclick="togglePassword('passwordConfirmInput', this)">
|
||||
<i class="bi bi-eye"></i>
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<button type="submit" class="btn btn-primary w-100">
|
||||
<i class="bi bi-check-lg me-2"></i>Reset Password
|
||||
</button>
|
||||
</form>
|
||||
|
||||
<div class="text-center mt-3">
|
||||
<a href="{{ url_for('login') }}" class="text-muted small">
|
||||
<i class="bi bi-arrow-left me-1"></i> Back to Login
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="alert alert-warning mt-4 small">
|
||||
<i class="bi bi-exclamation-triangle me-2"></i>
|
||||
<strong>Note:</strong> This will reset the admin password. If you don't have a valid recovery key,
|
||||
you'll need to delete the database and reconfigure Stegasoo.
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{% endblock %}
|
||||
|
||||
{% block scripts %}
|
||||
<script src="{{ url_for('static', filename='js/auth.js') }}"></script>
|
||||
<script>
|
||||
StegasooAuth.initPasswordConfirmation('recoverForm', 'passwordInput', 'passwordConfirmInput');
|
||||
</script>
|
||||
{% endblock %}
|
||||
183
frontends/web/templates/regenerate_recovery.html
Normal file
183
frontends/web/templates/regenerate_recovery.html
Normal file
@@ -0,0 +1,183 @@
|
||||
{% extends "base.html" %}
|
||||
|
||||
{% block title %}Regenerate Recovery Key - Stegasoo{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<div class="row justify-content-center">
|
||||
<div class="col-md-8 col-lg-6">
|
||||
<div class="card">
|
||||
<div class="card-header text-center">
|
||||
<i class="bi bi-arrow-repeat fs-1 d-block mb-2"></i>
|
||||
<h5 class="mb-0">{{ 'Regenerate' if has_existing else 'Generate' }} Recovery Key</h5>
|
||||
</div>
|
||||
<div class="card-body">
|
||||
{% if has_existing %}
|
||||
<!-- Warning for existing key -->
|
||||
<div class="alert alert-warning">
|
||||
<i class="bi bi-exclamation-triangle me-2"></i>
|
||||
<strong>Warning:</strong> Your existing recovery key will be invalidated.
|
||||
Make sure to save this new key before continuing.
|
||||
</div>
|
||||
{% else %}
|
||||
<!-- Info for first-time setup -->
|
||||
<div class="alert alert-info">
|
||||
<i class="bi bi-info-circle me-2"></i>
|
||||
<strong>What is a recovery key?</strong><br>
|
||||
If you forget your admin password, this key is the ONLY way to reset it.
|
||||
</div>
|
||||
{% endif %}
|
||||
|
||||
<!-- Recovery Key Display -->
|
||||
<div class="mb-4">
|
||||
<label class="form-label">
|
||||
<i class="bi bi-key-fill me-1"></i> Your New Recovery Key
|
||||
</label>
|
||||
<div class="input-group">
|
||||
<input type="text" class="form-control font-monospace text-center"
|
||||
id="recoveryKey" value="{{ recovery_key }}" readonly
|
||||
style="font-size: 1.1em; letter-spacing: 0.5px;">
|
||||
<button class="btn btn-outline-secondary" type="button"
|
||||
onclick="copyToClipboard()" title="Copy to clipboard">
|
||||
<i class="bi bi-clipboard" id="copyIcon"></i>
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- QR Code (if available) -->
|
||||
{% if qr_base64 %}
|
||||
<div class="mb-4 text-center">
|
||||
<label class="form-label d-block">
|
||||
<i class="bi bi-qr-code me-1"></i> QR Code
|
||||
</label>
|
||||
<img src="data:image/png;base64,{{ qr_base64 }}"
|
||||
alt="Recovery Key QR Code" class="img-fluid border rounded"
|
||||
style="max-width: 200px;" id="qrImage">
|
||||
</div>
|
||||
{% endif %}
|
||||
|
||||
<!-- Download Options -->
|
||||
<div class="mb-4">
|
||||
<label class="form-label">
|
||||
<i class="bi bi-download me-1"></i> Download Options
|
||||
</label>
|
||||
<div class="d-flex gap-2 flex-wrap">
|
||||
<button class="btn btn-outline-primary btn-sm" onclick="downloadTextFile()">
|
||||
<i class="bi bi-file-text me-1"></i> Text File
|
||||
</button>
|
||||
{% if qr_base64 %}
|
||||
<button class="btn btn-outline-primary btn-sm" onclick="downloadQRImage()">
|
||||
<i class="bi bi-image me-1"></i> QR Image
|
||||
</button>
|
||||
{% endif %}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Stego Backup Option -->
|
||||
<div class="mb-4">
|
||||
<label class="form-label">
|
||||
<i class="bi bi-incognito me-1"></i> Hide in Image
|
||||
</label>
|
||||
<form method="POST" action="{{ url_for('create_stego_backup') }}"
|
||||
enctype="multipart/form-data" class="d-flex gap-2 align-items-end">
|
||||
<input type="hidden" name="recovery_key" value="{{ recovery_key }}">
|
||||
<div class="flex-grow-1">
|
||||
<input type="file" name="carrier_image" class="form-control form-control-sm"
|
||||
accept="image/jpeg,image/png" required>
|
||||
<div class="form-text">JPG/PNG, 50KB-2MB</div>
|
||||
</div>
|
||||
<button type="submit" class="btn btn-outline-secondary btn-sm">
|
||||
<i class="bi bi-download me-1"></i> Stego
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
|
||||
<hr>
|
||||
|
||||
<!-- Confirmation Form -->
|
||||
<form method="POST" id="recoveryForm">
|
||||
<input type="hidden" name="recovery_key" value="{{ recovery_key }}">
|
||||
|
||||
<!-- Confirm checkbox -->
|
||||
<div class="form-check mb-3">
|
||||
<input class="form-check-input" type="checkbox" id="confirmSaved"
|
||||
onchange="updateButtons()">
|
||||
<label class="form-check-label" for="confirmSaved">
|
||||
I have saved my recovery key in a secure location
|
||||
</label>
|
||||
</div>
|
||||
|
||||
<div class="d-flex gap-2 justify-content-between">
|
||||
<!-- Cancel button -->
|
||||
<button type="submit" name="action" value="cancel"
|
||||
class="btn btn-outline-secondary">
|
||||
<i class="bi bi-x-lg me-1"></i> Cancel
|
||||
</button>
|
||||
|
||||
<!-- Save button -->
|
||||
<button type="submit" name="action" value="save"
|
||||
class="btn btn-primary" id="saveBtn" disabled>
|
||||
<i class="bi bi-check-lg me-1"></i> Save New Key
|
||||
</button>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{% endblock %}
|
||||
|
||||
{% block scripts %}
|
||||
<script>
|
||||
// Copy recovery key to clipboard
|
||||
function copyToClipboard() {
|
||||
const keyInput = document.getElementById('recoveryKey');
|
||||
navigator.clipboard.writeText(keyInput.value).then(() => {
|
||||
const icon = document.getElementById('copyIcon');
|
||||
icon.className = 'bi bi-clipboard-check';
|
||||
setTimeout(() => { icon.className = 'bi bi-clipboard'; }, 2000);
|
||||
});
|
||||
}
|
||||
|
||||
// Download as text file
|
||||
function downloadTextFile() {
|
||||
const key = document.getElementById('recoveryKey').value;
|
||||
const content = `Stegasoo Recovery Key
|
||||
=====================
|
||||
|
||||
${key}
|
||||
|
||||
IMPORTANT:
|
||||
- Keep this file in a secure location
|
||||
- Anyone with this key can reset admin passwords
|
||||
- Do not store with your password
|
||||
|
||||
Generated: ${new Date().toISOString()}
|
||||
`;
|
||||
const blob = new Blob([content], { type: 'text/plain' });
|
||||
const url = URL.createObjectURL(blob);
|
||||
const a = document.createElement('a');
|
||||
a.href = url;
|
||||
a.download = 'stegasoo-recovery-key.txt';
|
||||
a.click();
|
||||
URL.revokeObjectURL(url);
|
||||
}
|
||||
|
||||
// Download QR as image
|
||||
function downloadQRImage() {
|
||||
const img = document.getElementById('qrImage');
|
||||
if (!img) return;
|
||||
|
||||
const a = document.createElement('a');
|
||||
a.href = img.src;
|
||||
a.download = 'stegasoo-recovery-qr.png';
|
||||
a.click();
|
||||
}
|
||||
|
||||
// Enable save button when checkbox is checked
|
||||
function updateButtons() {
|
||||
const checkbox = document.getElementById('confirmSaved');
|
||||
const saveBtn = document.getElementById('saveBtn');
|
||||
saveBtn.disabled = !checkbox.checked;
|
||||
}
|
||||
</script>
|
||||
{% endblock %}
|
||||
176
frontends/web/templates/setup_recovery.html
Normal file
176
frontends/web/templates/setup_recovery.html
Normal file
@@ -0,0 +1,176 @@
|
||||
{% extends "base.html" %}
|
||||
|
||||
{% block title %}Recovery Key Setup - Stegasoo{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<div class="row justify-content-center">
|
||||
<div class="col-md-8 col-lg-6">
|
||||
<div class="card">
|
||||
<div class="card-header text-center">
|
||||
<i class="bi bi-shield-lock fs-1 d-block mb-2"></i>
|
||||
<h5 class="mb-0">Recovery Key Setup</h5>
|
||||
<small class="text-muted">Step 2 of 2</small>
|
||||
</div>
|
||||
<div class="card-body">
|
||||
<!-- Explanation -->
|
||||
<div class="alert alert-info">
|
||||
<i class="bi bi-info-circle me-2"></i>
|
||||
<strong>What is a recovery key?</strong><br>
|
||||
If you forget your admin password, this key is the ONLY way to reset it.
|
||||
Save it somewhere safe - it will not be shown again.
|
||||
</div>
|
||||
|
||||
<!-- Recovery Key Display -->
|
||||
<div class="mb-4">
|
||||
<label class="form-label">
|
||||
<i class="bi bi-key-fill me-1"></i> Your Recovery Key
|
||||
</label>
|
||||
<div class="input-group">
|
||||
<input type="text" class="form-control font-monospace text-center"
|
||||
id="recoveryKey" value="{{ recovery_key }}" readonly
|
||||
style="font-size: 1.1em; letter-spacing: 0.5px;">
|
||||
<button class="btn btn-outline-secondary" type="button"
|
||||
onclick="copyToClipboard()" title="Copy to clipboard">
|
||||
<i class="bi bi-clipboard" id="copyIcon"></i>
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- QR Code (if available) -->
|
||||
{% if qr_base64 %}
|
||||
<div class="mb-4 text-center">
|
||||
<label class="form-label d-block">
|
||||
<i class="bi bi-qr-code me-1"></i> QR Code
|
||||
</label>
|
||||
<img src="data:image/png;base64,{{ qr_base64 }}"
|
||||
alt="Recovery Key QR Code" class="img-fluid border rounded"
|
||||
style="max-width: 200px;" id="qrImage">
|
||||
<div class="mt-2">
|
||||
<small class="text-muted">Scan with your phone's camera app</small>
|
||||
</div>
|
||||
</div>
|
||||
{% endif %}
|
||||
|
||||
<!-- Download Options -->
|
||||
<div class="mb-4">
|
||||
<label class="form-label">
|
||||
<i class="bi bi-download me-1"></i> Download Options
|
||||
</label>
|
||||
<div class="d-flex gap-2 flex-wrap">
|
||||
<button class="btn btn-outline-primary btn-sm" onclick="downloadTextFile()">
|
||||
<i class="bi bi-file-text me-1"></i> Text File
|
||||
</button>
|
||||
{% if qr_base64 %}
|
||||
<button class="btn btn-outline-primary btn-sm" onclick="downloadQRImage()">
|
||||
<i class="bi bi-image me-1"></i> QR Image
|
||||
</button>
|
||||
{% endif %}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<hr>
|
||||
|
||||
<!-- Confirmation Form -->
|
||||
<form method="POST" id="recoveryForm">
|
||||
<input type="hidden" name="recovery_key" value="{{ recovery_key }}">
|
||||
|
||||
<!-- Confirm checkbox -->
|
||||
<div class="form-check mb-3">
|
||||
<input class="form-check-input" type="checkbox" id="confirmSaved"
|
||||
onchange="updateButtons()">
|
||||
<label class="form-check-label" for="confirmSaved">
|
||||
I have saved my recovery key in a secure location
|
||||
</label>
|
||||
</div>
|
||||
|
||||
<div class="d-flex gap-2 justify-content-between">
|
||||
<!-- Skip button (no recovery) -->
|
||||
<button type="submit" name="action" value="skip"
|
||||
class="btn btn-outline-secondary"
|
||||
onclick="return confirm('Are you sure? Without a recovery key, there is NO way to reset your password if you forget it.')">
|
||||
<i class="bi bi-skip-forward me-1"></i> Skip (No Recovery)
|
||||
</button>
|
||||
|
||||
<!-- Save button (with key) -->
|
||||
<button type="submit" name="action" value="save"
|
||||
class="btn btn-primary" id="saveBtn" disabled>
|
||||
<i class="bi bi-check-lg me-1"></i> Continue
|
||||
</button>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- Security Notes -->
|
||||
<div class="card mt-3">
|
||||
<div class="card-header">
|
||||
<i class="bi bi-shield-check me-2"></i>Security Notes
|
||||
</div>
|
||||
<div class="card-body small">
|
||||
<ul class="mb-0">
|
||||
<li>The recovery key is <strong>not stored</strong> - only a hash is saved</li>
|
||||
<li>Keep it separate from your password (different location)</li>
|
||||
<li>Anyone with this key can reset admin passwords</li>
|
||||
<li>If you lose it and forget your password, you must recreate the database</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{% endblock %}
|
||||
|
||||
{% block scripts %}
|
||||
<script>
|
||||
// Copy recovery key to clipboard
|
||||
function copyToClipboard() {
|
||||
const keyInput = document.getElementById('recoveryKey');
|
||||
navigator.clipboard.writeText(keyInput.value).then(() => {
|
||||
const icon = document.getElementById('copyIcon');
|
||||
icon.className = 'bi bi-clipboard-check';
|
||||
setTimeout(() => { icon.className = 'bi bi-clipboard'; }, 2000);
|
||||
});
|
||||
}
|
||||
|
||||
// Download as text file
|
||||
function downloadTextFile() {
|
||||
const key = document.getElementById('recoveryKey').value;
|
||||
const content = `Stegasoo Recovery Key
|
||||
=====================
|
||||
|
||||
${key}
|
||||
|
||||
IMPORTANT:
|
||||
- Keep this file in a secure location
|
||||
- Anyone with this key can reset admin passwords
|
||||
- Do not store with your password
|
||||
|
||||
Generated: ${new Date().toISOString()}
|
||||
`;
|
||||
const blob = new Blob([content], { type: 'text/plain' });
|
||||
const url = URL.createObjectURL(blob);
|
||||
const a = document.createElement('a');
|
||||
a.href = url;
|
||||
a.download = 'stegasoo-recovery-key.txt';
|
||||
a.click();
|
||||
URL.revokeObjectURL(url);
|
||||
}
|
||||
|
||||
// Download QR as image
|
||||
function downloadQRImage() {
|
||||
const img = document.getElementById('qrImage');
|
||||
if (!img) return;
|
||||
|
||||
const a = document.createElement('a');
|
||||
a.href = img.src;
|
||||
a.download = 'stegasoo-recovery-qr.png';
|
||||
a.click();
|
||||
}
|
||||
|
||||
// Enable save button when checkbox is checked
|
||||
function updateButtons() {
|
||||
const checkbox = document.getElementById('confirmSaved');
|
||||
const saveBtn = document.getElementById('saveBtn');
|
||||
saveBtn.disabled = !checkbox.checked;
|
||||
}
|
||||
</script>
|
||||
{% endblock %}
|
||||
Reference in New Issue
Block a user