4 files changed, 58 insertions, 1 deletions

diff --git a/app/controllers/concerns/role_required.rb b/app/controllers/concerns/role_required.rb
index b841b8cc..22ce625e 100644
--- a/app/controllers/concerns/role_required.rb
+++ b/app/controllers/concerns/role_required.rb
@@ -20,4 +20,13 @@ module RoleRequired
       flash[:error] = t("flash.common.#{key}")
       redirect_to admin_path
     end
+
+    # require_admin must precede this in the filter chain, so a non-admin is
+    # denied by role before elevation is ever considered.
+    def require_elevation
+      return if elevated?
+
+      session[:elevation_return_to] = request.fullpath
+      redirect_to new_elevation_path
+    end
 end
diff --git a/app/controllers/elevations_controller.rb b/app/controllers/elevations_controller.rb
new file mode 100644
index 00000000..804b8f95
--- /dev/null
+++ b/app/controllers/elevations_controller.rb
@@ -0,0 +1,44 @@
+# Step-up authentication for janitorial work. Mirrors the two-step login's
+# attempt cap: verify_otp! guards replay but not rate, and an attacker with a
+# stolen cookie would otherwise have unlimited tries at a six-digit code.
+class ElevationsController < ApplicationController
+  include RoleRequired
+
+  layout 'admin'
+
+  before_action :login_required
+  before_action :require_admin
+
+  MAX_ATTEMPTS = 5
+
+  def new
+    redirect_to admin_path if elevated?
+  end
+
+  def create
+    return render(:new) unless current_user.otp_enrolled?
+
+    session[:elevation_attempts] = session[:elevation_attempts].to_i + 1
+    if session[:elevation_attempts] > MAX_ATTEMPTS
+      logout_killing_session!
+      flash[:error] = t("flash.otp.too_many_attempts")
+      return redirect_to(login_path)
+    end
+
+    if current_user.verify_otp!(params[:code])
+      session.delete(:elevation_attempts)
+      elevate!
+      redirect_to safe_return_to(session.delete(:elevation_return_to),
+                                 :default => users_path)
+    else
+      flash.now[:error] = t("flash.otp.code_mismatch")
+      render :new
+    end
+  end
+
+  def destroy
+    drop_elevation!
+    flash[:notice] = t("flash.elevation.dropped")
+    redirect_to admin_path
+  end
+end
diff --git a/app/controllers/otp_challenges_controller.rb b/app/controllers/otp_challenges_controller.rb
index eeaeac20..87586241 100644
--- a/app/controllers/otp_challenges_controller.rb
+++ b/app/controllers/otp_challenges_controller.rb
@@ -28,6 +28,9 @@ class OtpChallengesController < ApplicationController
       reset_session
       self.current_user = user
       session[:logged_in_at] = Time.now.to_i
+      # an admin who logs in and goes straight to user management
+      # is already elevated
+      elevate! if user.is_admin?
       flash[:notice] = t("flash.common.logged_in")
       redirect_to safe_return_to(return_to, :default => admin_path)
     else
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 052b2928..583ebac0 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -7,6 +7,7 @@ class UsersController < ApplicationController
   before_action :login_required
   before_action :find_user,     :only => [:show, :edit, :update, :reset_otp, :deactivate, :reactivate]
   before_action :require_admin, :only => [:index, :new, :create, :reset_otp, :deactivate, :reactivate]
+  before_action :require_elevation, :only => [:new, :create, :reset_otp, :deactivate, :reactivate]
   before_action :verify_status, :except => [:index]
 
   layout 'admin'
@@ -87,7 +88,7 @@ class UsersController < ApplicationController
                                 :roles => [])
       # Checkbox arrays post a leading blank from the hidden field.
       permitted[:roles] = Array(permitted[:roles]).reject(&:blank?) if permitted.key?(:roles)
-      permitted.delete(:roles) unless current_user.is_admin?
+      permitted.delete(:roles) unless current_user.is_admin? && elevated?
       permitted
     end