diff --git a/Dockerfile b/Dockerfile index b0be901f..f768b367 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,7 +9,7 @@ RUN apk --no-cache add fontforge wget && \ wget https://cdn.jsdelivr.net/gh/notofonts/notofonts.github.io/fonts/NotoSansSymbols2/hinted/ttf/NotoSansSymbols2-Regular.ttf && \ wget https://github.com/Maxattax97/gnu-freefont/raw/master/ttf/FreeSans.ttf && \ wget https://github.com/impallari/DancingScript/raw/master/OFL.txt && \ - wget -O /model.onnx "https://github.com/docusealco/fields-detection/releases/download/1.0.0/model_704_int8.onnx" && \ + wget -O /model.onnx "https://github.com/docusealco/fields-detection/releases/download/1.1.0/model_704_int8.onnx" && \ wget -O pdfium-linux.tgz "https://github.com/docusealco/pdfium-binaries/releases/latest/download/pdfium-linux-$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/').tgz" && \ mkdir -p /pdfium-linux && \ tar -xzf pdfium-linux.tgz -C /pdfium-linux @@ -90,7 +90,7 @@ COPY --from=download /model.onnx /app/tmp/model.onnx COPY --from=webpack /app/public/packs ./public/packs RUN ln -s /fonts /app/public/fonts -RUN bundle exec bootsnap precompile --gemfile app/ lib/ +RUN bundle exec bootsnap precompile -j 1 --gemfile app/ lib/ WORKDIR /data/docuseal ENV WORKDIR=/data/docuseal diff --git a/app/controllers/api/attachments_controller.rb b/app/controllers/api/attachments_controller.rb index 9d86b923..f00552cd 100644 --- a/app/controllers/api/attachments_controller.rb +++ b/app/controllers/api/attachments_controller.rb @@ -37,7 +37,7 @@ module Api rescue Submitters::MaliciousFileExtension => e Rollbar.error(e) if defined?(Rollbar) - render json: { error: e.message }, status: :unprocessable_entity + render json: { error: e.message }, status: :unprocessable_content end def build_new_cookie_signatures_json(submitter, attachment) diff --git a/app/controllers/passwords_controller.rb b/app/controllers/passwords_controller.rb index 60de5b12..e166da35 100644 --- a/app/controllers/passwords_controller.rb +++ b/app/controllers/passwords_controller.rb @@ -5,6 +5,8 @@ class PasswordsController < Devise::PasswordsController skip_before_action :require_no_authentication, only: %i[edit update] # rubocop:enable Rails/LexicallyScopedActionFilter + around_action :with_browser_locale + class Current < ActiveSupport::CurrentAttributes attribute :user end diff --git a/app/controllers/start_form_controller.rb b/app/controllers/start_form_controller.rb index 98e5e0c3..ad5d6455 100644 --- a/app/controllers/start_form_controller.rb +++ b/app/controllers/start_form_controller.rb @@ -16,7 +16,9 @@ class StartFormController < ApplicationController COOKIES_DEFAULTS = { httponly: true, secure: Rails.env.production? }.freeze def show - raise ActionController::RoutingError, I18n.t('not_found') if @template.preferences['require_phone_2fa'] + if @template.preferences['require_phone_2fa'] || @template.preferences['require_email_2fa'] + raise ActionController::RoutingError, I18n.t('not_found') + end if @template.shared_link? @submitter = @template.submissions.new(account_id: @template.account_id) diff --git a/app/controllers/submission_events_controller.rb b/app/controllers/submission_events_controller.rb index 14cf5321..28011799 100644 --- a/app/controllers/submission_events_controller.rb +++ b/app/controllers/submission_events_controller.rb @@ -10,6 +10,7 @@ class SubmissionEventsController < ApplicationController 'api_complete_form' => 'check', 'send_reminder_email' => 'mail_forward', 'send_2fa_sms' => '2fa', + 'send_2fa_email' => '2fa', 'send_sms' => 'send', 'phone_verified' => 'phone_check', 'email_verified' => 'email_check', diff --git a/app/controllers/submissions_preview_controller.rb b/app/controllers/submissions_preview_controller.rb index 2ac30745..6163c36b 100644 --- a/app/controllers/submissions_preview_controller.rb +++ b/app/controllers/submissions_preview_controller.rb @@ -53,8 +53,11 @@ class SubmissionsPreviewController < ApplicationController def use_signature?(submission) return false if current_user && can?(:read, submission) - return true if submission.submitters.any? { |e| e.preferences['require_phone_2fa'] } + return true if submission.submitters.any? do |e| + e.preferences['require_phone_2fa'] || e.preferences['require_email_2fa'] + end return true if submission.template&.preferences&.dig('require_phone_2fa') + return true if submission.template&.preferences&.dig('require_email_2fa') !submission_valid_ttl?(submission) end diff --git a/app/controllers/submit_form_controller.rb b/app/controllers/submit_form_controller.rb index 963594fa..f723aa32 100644 --- a/app/controllers/submit_form_controller.rb +++ b/app/controllers/submit_form_controller.rb @@ -17,6 +17,7 @@ class SubmitFormController < ApplicationController submission = @submitter.submission return redirect_to submit_form_completed_path(@submitter.slug) if @submitter.completed_at? + return render :email_2fa if require_email_2fa?(@submitter) @form_configs = Submitters::FormConfigs.call(@submitter, CONFIG_KEYS) @@ -47,6 +48,11 @@ class SubmitFormController < ApplicationController end def update + if require_email_2fa?(@submitter) + return render json: { error: I18n.t('verification_required_refresh_the_page_and_pass_2fa') }, + status: :unprocessable_content + end + if @submitter.completed_at? return render json: { error: I18n.t('form_has_been_completed_already') }, status: :unprocessable_content end @@ -77,6 +83,8 @@ class SubmitFormController < ApplicationController def completed raise ActionController::RoutingError, I18n.t('not_found') if @submitter.account.archived_at? + + redirect_to submit_form_path(params[:submit_form_slug]) if require_email_2fa?(@submitter) end def success; end @@ -109,4 +117,12 @@ class SubmitFormController < ApplicationController ActiveStorage::Attachment.where(record: submission.submitters, name: :attachments) .preload(:blob).index_by(&:uuid) end + + def require_email_2fa?(submitter) + return false if submitter.submission.template&.preferences&.dig('require_email_2fa') != true && + submitter.preferences['require_email_2fa'] != true + return false if cookies.encrypted[:email_2fa_slug] == submitter.slug + + true + end end diff --git a/app/controllers/submit_form_email_2fas_controller.rb b/app/controllers/submit_form_email_2fas_controller.rb new file mode 100644 index 00000000..ec627b5d --- /dev/null +++ b/app/controllers/submit_form_email_2fas_controller.rb @@ -0,0 +1,52 @@ +# frozen_string_literal: true + +class SubmitFormEmail2fasController < ApplicationController + around_action :with_browser_locale + + skip_before_action :authenticate_user! + skip_authorization_check + + before_action :load_submitter + + COOKIES_TTL = 12.hours + COOKIES_DEFAULTS = { httponly: true, secure: Rails.env.production? }.freeze + + def create + RateLimit.call("verify-2fa-code-#{@submitter.id}", limit: 2, ttl: 45.seconds, enabled: true) + + value = [@submitter.email.downcase.strip, @submitter.slug].join(':') + + if EmailVerificationCodes.verify(params[:one_time_code].to_s.gsub(/\D/, ''), value) + SubmissionEvents.create_with_tracking_data(@submitter, 'email_verified', request, { email: @submitter.email }) + + cookies.encrypted[:email_2fa_slug] = + { value: @submitter.slug, expires: COOKIES_TTL.from_now, **COOKIES_DEFAULTS } + + redirect_to submit_form_path(@submitter.slug) + else + redirect_to submit_form_path(@submitter.slug, status: :error), alert: I18n.t(:invalid_code) + end + rescue RateLimit::LimitApproached + redirect_to submit_form_path(@submitter.slug, status: :error), alert: I18n.t(:too_many_attempts) + end + + def update + if @submitter.submission_events.where(event_type: 'send_2fa_email').exists?(created_at: 15.seconds.ago..) + return redirect_to submit_form_path(@submitter.slug, status: :error), alert: I18n.t(:rate_limit_exceeded) + end + + RateLimit.call("send-email-code-#{@submitter.id}", limit: 2, ttl: 45.seconds, enabled: true) + + SendSubmitterVerificationEmailJob.perform_async('submitter_id' => @submitter.id, 'locale' => I18n.locale.to_s) + + redir_params = params[:resend] ? { alert: I18n.t(:code_has_been_resent) } : {} + + redirect_to submit_form_path(@submitter.slug, status: :sent), **redir_params + rescue RateLimit::LimitApproached + redirect_to submit_form_path(@submitter.slug, status: :error), alert: I18n.t(:too_many_attempts) + end + + def load_submitter + @submitter = Submitter.find_by!(slug: params[:submitter_slug]) + end +end diff --git a/app/controllers/templates_preferences_controller.rb b/app/controllers/templates_preferences_controller.rb index 391b6714..49041cfc 100644 --- a/app/controllers/templates_preferences_controller.rb +++ b/app/controllers/templates_preferences_controller.rb @@ -54,7 +54,7 @@ class TemplatesPreferencesController < ApplicationController documents_copy_email_attach_documents documents_copy_email_reply_to completed_notification_email_attach_documents completed_redirect_url validate_unique_submitters - require_all_submitters submitters_order require_phone_2fa + require_all_submitters submitters_order require_phone_2fa require_email_2fa default_expire_at_duration shared_link_2fa default_expire_at request_email_enabled completed_notification_email_subject completed_notification_email_body completed_notification_email_enabled completed_notification_email_attach_audit] + diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 51025dd1..9affdf4c 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -54,7 +54,8 @@ class UsersController < ApplicationController def update return redirect_to settings_users_path, notice: I18n.t('unable_to_update_user') if Docuseal.demo? - attrs = user_params.compact_blank.merge(user_params.slice(:archived_at)) + attrs = user_params.compact_blank + attrs = attrs.merge(user_params.slice(:archived_at)) if current_ability.can?(:create, @user) if params.dig(:user, :account_id).present? account = Account.accessible_by(current_ability).find(params.dig(:user, :account_id)) diff --git a/app/javascript/submission_form/form.vue b/app/javascript/submission_form/form.vue index 7a825141..fbd07e74 100644 --- a/app/javascript/submission_form/form.vue +++ b/app/javascript/submission_form/form.vue @@ -133,6 +133,12 @@ name="_method" type="hidden" > +
-