root/ubuntu-based-kiosk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Lock screen: password or 4-8 digit PIN, optional separate boot code

Browse Source 
The unlock code and the boot lock code can each be a password or a
4-8 digit PIN. A PIN gets an on-screen number pad, so the lock works on
a touch-only kiosk. The boot lock can use the unlock code or its own.
These are the kiosk's own codes, set in Core Settings -> Password
Protection & Lockout or on the Web UI's Lockout page, never the admin
(sudo) password.

The lock screen moves from an inline data: URL to lockscreen.html. The
code is now hashed and compared in the main process, which also slows
down guessing: after every 5 wrong codes in a row, input is refused for
30s, doubling up to 5 minutes. Existing configs behave as before:
missing fields mean a password, and the same code at boot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cjz8a58eB5P9sUweqd3NHm
This commit is contained in:
Claude
2026-10-10 15:26:59 +00:00
parent 600f5174d8
commit f215c64085
10 changed files with 554 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
webui/lib/config.js
+19
View File
@@ -44,6 +44,10 @@ const SCALAR_DEFAULTS = {
lockoutTimeout: 0,
lockoutAtTime: '',
requirePasswordOnBoot: false,
// 'password' or 'pin' (4-8 digits, entered on the lock screen's
// number pad) - for the unlock code and the optional separate boot code.
lockoutCodeType: 'password',
bootCodeType: 'password',
};
function readExisting() {
@@ -94,6 +98,8 @@ function loadConfig() {
out[key] = key in existing ? existing[key] : def;
}
out.hasLockoutPassword = typeof existing.lockoutPassword === 'string' && existing.lockoutPassword.length > 0;
// A boot code of its own (empty bootPassword = the unlock code is used at boot).
out.hasBootPassword = typeof existing.bootPassword === 'string' && existing.bootPassword.length > 0;
out.dualSwipe = out.swipeMode === 'dual';
return out;
}
@@ -122,11 +128,24 @@ function saveConfig(patch) {
if (typeof patch.newLockoutPassword === 'string' && patch.newLockoutPassword.length > 0) {
merged.lockoutPassword = hashPassword(patch.newLockoutPassword);
}
// Separate boot code: a new one is hashed in, clearBootPassword goes
// back to "boot uses the unlock code".
if (!('bootPassword' in merged)) merged.bootPassword = '';
if (typeof patch.newBootPassword === 'string' && patch.newBootPassword.length > 0) {
merged.bootPassword = hashPassword(patch.newBootPassword);
}
if (patch.clearBootPassword === true) {
merged.bootPassword = '';
merged.bootCodeType = 'password';
}
if (patch.enablePasswordProtection === false) {
merged.lockoutPassword = '';
merged.lockoutTimeout = 0;
merged.lockoutAtTime = '';
merged.requirePasswordOnBoot = false;
merged.lockoutCodeType = 'password';
merged.bootPassword = '';
merged.bootCodeType = 'password';
}
if (Array.isArray(patch.tabs)) {