root/ubuntu-based-kiosk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Lock screen: password or 4-8 digit PIN, optional separate boot code

Browse Source 
The unlock code and the boot lock code can each be a password or a
4-8 digit PIN. A PIN gets an on-screen number pad, so the lock works on
a touch-only kiosk. The boot lock can use the unlock code or its own.
These are the kiosk's own codes, set in Core Settings -> Password
Protection & Lockout or on the Web UI's Lockout page, never the admin
(sudo) password.

The lock screen moves from an inline data: URL to lockscreen.html. The
code is now hashed and compared in the main process, which also slows
down guessing: after every 5 wrong codes in a row, input is refused for
30s, doubling up to 5 minutes. Existing configs behave as before:
missing fields mean a password, and the same code at boot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cjz8a58eB5P9sUweqd3NHm
This commit is contained in:
Claude
2026-10-10 15:26:59 +00:00
parent 600f5174d8
commit f215c64085
10 changed files with 554 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kiosk-app/lockscreen.html
+165
View File
@@ -0,0 +1,165 @@
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>Locked</title>
<style>
* { margin: 0; padding: 0; box-sizing: border-box; }
body {
background: #000;
color: #fff;
font-family: Arial, sans-serif;
display: flex;
justify-content: center;
align-items: center;
height: 100vh;
overflow: hidden;
user-select: none;
}
.box { text-align: center; width: 100%; max-width: 400px; padding: 20px; }
h1 { font-size: 32px; margin-bottom: 30px; }
.hidden { display: none !important; }
input {
width: 100%;
padding: 15px;
font-size: 18px;
border: 2px solid #fff;
background: #000;
color: #fff;
border-radius: 5px;
margin-bottom: 20px;
}
#pin-display {
font-size: 44px;
letter-spacing: 16px;
min-height: 64px;
line-height: 64px;
border-bottom: 2px solid #555;
margin-bottom: 24px;
font-family: monospace;
}
.pad { display: grid; grid-template-columns: repeat(3, 1fr); gap: 14px; }
.pad button {
padding: 22px 0;
font-size: 30px;
font-weight: bold;
background: #222;
color: #fff;
border: 1px solid #444;
border-radius: 50px;
}
.pad button:active { background: #555; }
.pad .ok { background: #fff; color: #000; font-size: 22px; }
.pad .back { font-size: 24px; }
button.unlock {
padding: 15px 30px;
font-size: 18px;
background: #fff;
color: #000;
border: none;
border-radius: 5px;
cursor: pointer;
}
button:disabled { opacity: 0.4; }
.error { color: #f44; margin-top: 18px; min-height: 22px; font-size: 18px; }
</style>
</head>
<body>
<div class="box">
<h1 id="title">Session Locked</h1>
<div id="password-entry" class="hidden">
<input type="password" id="password" autocomplete="off">
<button class="unlock" id="unlock">Unlock</button>
</div>
<div id="pin-entry" class="hidden">
<div id="pin-display"></div>
<div class="pad" id="pad"></div>
</div>
<div class="error" id="error"></div>
</div>
<script>
const {ipcRenderer} = require('electron');
const params = new URLSearchParams(location.search);
const isPin = params.get('type') === 'pin';
const isBoot = params.get('mode') === 'boot';
const $ = id => document.getElementById(id);
let pin = '';
let blockedUntil = 0;
let blockTimer = null;
$('title').textContent = isBoot ? 'Kiosk Locked' : 'Session Locked';
function submit(code) {
if (Date.now() < blockedUntil || !code) return;
ipcRenderer.send('check-lockout-password', code);
}
function setDisabled(on) {
for (const b of document.querySelectorAll('button')) b.disabled = on;
$('password').disabled = on;
}
if (isPin) {
$('pin-entry').classList.remove('hidden');
const keys = ['1', '2', '3', '4', '5', '6', '7', '8', '9', '⌫', '0', 'OK'];
for (const k of keys) {
const b = document.createElement('button');
b.textContent = k;
if (k === 'OK') b.className = 'ok';
if (k === '⌫') b.className = 'back';
b.addEventListener('click', () => press(k));
$('pad').appendChild(b);
}
const show = () => { $('pin-display').textContent = '•'.repeat(pin.length); };
window.press = k => {
if (Date.now() < blockedUntil) return;
if (k === 'OK') { submit(pin); return; }
if (k === '⌫') pin = pin.slice(0, -1);
else if (pin.length < 8) pin += k;
$('error').textContent = '';
show();
};
document.addEventListener('keydown', e => {
if (e.key >= '0' && e.key <= '9') press(e.key);
else if (e.key === 'Backspace') press('⌫');
else if (e.key === 'Enter') press('OK');
});
window.clearEntry = () => { pin = ''; show(); };
show();
} else {
$('password-entry').classList.remove('hidden');
$('password').placeholder = 'Enter password to unlock';
$('password').focus();
$('unlock').addEventListener('click', () => submit($('password').value));
$('password').addEventListener('keydown', e => { if (e.key === 'Enter') submit($('password').value); });
window.clearEntry = () => { $('password').value = ''; $('password').focus(); };
}
ipcRenderer.on('password-incorrect', (event, info) => {
clearEntry();
const wait = (info && info.waitSeconds) || 0;
const what = isPin ? 'PIN' : 'password';
if (!wait) { $('error').textContent = 'Incorrect ' + what; return; }
blockedUntil = Date.now() + wait * 1000;
setDisabled(true);
clearInterval(blockTimer);
const tick = () => {
const left = Math.ceil((blockedUntil - Date.now()) / 1000);
if (left <= 0) {
clearInterval(blockTimer);
setDisabled(false);
$('error').textContent = '';
if (!isPin) $('password').focus();
return;
}
$('error').textContent = 'Too many wrong tries - wait ' + left + 's';
};
tick();
blockTimer = setInterval(tick, 500);
});
</script>
</body>
</html>
kiosk-app/main.js
+40 -84
View File
@@ -66,9 +66,15 @@ let lockoutAtTime="";
let lockoutActiveStart="";
let lockoutActiveEnd="";
let requirePasswordOnBoot=false;
let lockoutCodeType='password'; // 'password' or 'pin' (4-8 digits, keypad)
let bootPassword=''; // separate boot code hash; '' = use lockoutPassword
let bootCodeType='password';
// Password lockout state
let isLockedOut=false;
let lockoutMode='unlock'; // 'boot' while the boot lock screen is up
let lockoutFailures=0;
let lockoutBlockedUntil=0;
let lockoutWindow=null;
let lockoutTimer=null;
let lockoutActivityTime=Date.now();
@@ -103,6 +109,9 @@ function loadConfig(){
lockoutActiveStart=config.lockoutActiveStart||"";
lockoutActiveEnd=config.lockoutActiveEnd||"";
requirePasswordOnBoot=(config.requirePasswordOnBoot===true);
lockoutCodeType=(config.lockoutCodeType==='pin')?'pin':'password';
bootPassword=config.bootPassword||'';
bootCodeType=(config.bootCodeType==='pin')?'pin':'password';
autheliaURL=config.autheliaURL||'';
autheliaUsername=config.autheliaUsername||'';
autheliaEncryptedPassword=config.autheliaEncryptedPassword||'';
@@ -118,6 +127,7 @@ function loadConfig(){
if(lockoutAtTime)console.log('[CONFIG] Lock at time:',lockoutAtTime);
if(lockoutActiveStart&&lockoutActiveEnd)console.log('[CONFIG] Active hours:',lockoutActiveStart,'-',lockoutActiveEnd);
console.log('[CONFIG] Require password on boot:',requirePasswordOnBoot);
console.log('[CONFIG] Unlock code:',lockoutCodeType,'| boot code:',bootPassword?('separate '+bootCodeType):'same as unlock');
console.log('[CONFIG] Sites:',config.tabs?.length||0);
console.log('[CONFIG] ╚═══════════════════════════════╝');
@@ -154,10 +164,11 @@ function markKeyboardActivity(){
}
// Password lockout functions
function showLockoutScreen(){
function showLockoutScreen(mode){
if(isLockedOut||!enablePasswordProtection||!lockoutPassword)return;
isLockedOut=true;
lockoutMode=(mode==='boot')?'boot':'unlock';
console.log('[LOCKOUT] Showing lockout screen');
closeWifiWindow();
@@ -193,81 +204,9 @@ function showLockoutScreen(){
}
});
lockoutWindow.loadURL('data:text/html;charset=utf-8,'+encodeURIComponent(`
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<style>
*{margin:0;padding:0;box-sizing:border-box;}
body{
background:#000;
color:#fff;
font-family:Arial,sans-serif;
display:flex;
justify-content:center;
align-items:center;
height:100vh;
overflow:hidden;
}
.lockout-container{
text-align:center;
max-width:400px;
}
h1{font-size:32px;margin-bottom:30px;}
input{
width:100%;
padding:15px;
font-size:18px;
border:2px solid #fff;
background:#000;
color:#fff;
border-radius:5px;
margin-bottom:20px;
}
button{
padding:15px 30px;
font-size:18px;
background:#fff;
color:#000;
border:none;
border-radius:5px;
cursor:pointer;
}
button:hover{background:#ccc;}
.error{color:#f44;margin-top:15px;display:none;}
</style>
</head>
<body>
<div class="lockout-container">
<h1>Session Locked</h1>
<input type="password" id="password" placeholder="Enter password to unlock" autofocus>
<button onclick="checkPassword()">Unlock</button>
<div class="error" id="error">Incorrect password</div>
</div>
<script>
const crypto=require('crypto');
const{ipcRenderer}=require('electron');
function checkPassword(){
const pass=document.getElementById('password').value;
const hash=crypto.createHash('sha256').update(pass).digest('hex');
ipcRenderer.send('check-lockout-password',hash);
}
document.getElementById('password').addEventListener('keydown',(e)=>{
if(e.key==='Enter')checkPassword();
});
ipcRenderer.on('password-incorrect',()=>{
document.getElementById('error').style.display='block';
document.getElementById('password').value='';
document.getElementById('password').focus();
});
</script>
</body>
</html>
`));
// The boot screen takes the separate boot code when one is set.
const codeType=(lockoutMode==='boot'&&bootPassword)?bootCodeType:lockoutCodeType;
lockoutWindow.loadFile(path.join(__dirname,'lockscreen.html'),{query:{type:codeType,mode:lockoutMode}});
lockoutWindow.on('closed',()=>{
lockoutWindow=null;
@@ -1585,7 +1524,7 @@ async function createWindow(){
if(enablePasswordProtection&&lockoutPassword&&requirePasswordOnBoot&&fs.existsSync(bootFlag)){
console.log('[LOCKOUT] Boot detected, requiring password BEFORE showing sites');
fs.unlinkSync(bootFlag);
showLockoutScreen();
showLockoutScreen('boot');
}else{
attachView(startIndex);
startMasterTimer();
@@ -1609,14 +1548,31 @@ async function createWindow(){
ipcMain.on('close-keyboard',()=>{closeHTMLKeyboard();});
ipcMain.on('keyboard-activity',()=>{markKeyboardActivity();});
ipcMain.on('show-pause-dialog',()=>{showPauseDialog();});
ipcMain.on('check-lockout-password',(event,hash)=>{
if(hash===lockoutPassword){
unlockScreen();
}else{
if(lockoutWindow&&!lockoutWindow.isDestroyed()){
lockoutWindow.webContents.send('password-incorrect');
}
// The lock screen sends the code as typed; compared here as a SHA-256
// hash (how the menu and Web UI store it). After every 5 wrong codes in
// a row the screen refuses input for a while - 30s, doubling up to 5
// minutes - so a 4-digit PIN can't simply be tried through.
ipcMain.on('check-lockout-password',(event,code)=>{
if(!lockoutWindow||lockoutWindow.isDestroyed()||event.sender!==lockoutWindow.webContents)return;
if(Date.now()<lockoutBlockedUntil){
event.sender.send('password-incorrect',{waitSeconds:Math.ceil((lockoutBlockedUntil-Date.now())/1000)});
return;
}
const expected=(lockoutMode==='boot'&&bootPassword)?bootPassword:lockoutPassword;
const hash=crypto.createHash('sha256').update(String(code||'')).digest('hex');
if(hash===expected){
lockoutFailures=0;
unlockScreen();
return;
}
lockoutFailures++;
console.log('[LOCKOUT] Wrong code, attempt',lockoutFailures);
let waitSeconds=0;
if(lockoutFailures%5===0){
waitSeconds=Math.min(300,30*Math.pow(2,lockoutFailures/5-1));
lockoutBlockedUntil=Date.now()+waitSeconds*1000;
}
event.sender.send('password-incorrect',{waitSeconds});
});
ipcMain.on('get-config',(event)=>{