Lock screen: password or 4-8 digit PIN, optional separate boot code
The unlock code and the boot lock code can each be a password or a 4-8 digit PIN. A PIN gets an on-screen number pad, so the lock works on a touch-only kiosk. The boot lock can use the unlock code or its own. These are the kiosk's own codes, set in Core Settings -> Password Protection & Lockout or on the Web UI's Lockout page, never the admin (sudo) password. The lock screen moves from an inline data: URL to lockscreen.html. The code is now hashed and compared in the main process, which also slows down guessing: after every 5 wrong codes in a row, input is refused for 30s, doubling up to 5 minutes. Existing configs behave as before: missing fields mean a password, and the same code at boot. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Cjz8a58eB5P9sUweqd3NHm
This commit is contained in:
Claude
+41
-1
@@ -196,10 +196,18 @@ const dailyLockEnabled = document.getElementById('daily-lock-enabled');
|
||||
const lockoutAtTime = document.getElementById('lockout-at-time');
|
||||
const passwordLabel = document.getElementById('password-label');
|
||||
|
||||
const bootLockEnabled = document.getElementById('boot-lock-enabled');
|
||||
const bootCodeMode = document.getElementById('boot-code-mode');
|
||||
const PIN_RE = /^[0-9]{4,8}$/;
|
||||
|
||||
function refreshLockoutFieldVisibility() {
|
||||
lockoutFields.hidden = !lockoutEnabled.checked;
|
||||
document.getElementById('boot-code-fields').hidden = !bootLockEnabled.checked;
|
||||
document.getElementById('boot-separate-fields').hidden = bootCodeMode.value !== 'separate';
|
||||
}
|
||||
lockoutEnabled.addEventListener('change', refreshLockoutFieldVisibility);
|
||||
bootLockEnabled.addEventListener('change', refreshLockoutFieldVisibility);
|
||||
bootCodeMode.addEventListener('change', refreshLockoutFieldVisibility);
|
||||
|
||||
dailyLockEnabled.addEventListener('change', () => {
|
||||
lockoutAtTime.disabled = !dailyLockEnabled.checked;
|
||||
@@ -221,6 +229,23 @@ lockoutForm.addEventListener('submit', async (e) => {
|
||||
showMessage('Set a lockout password before enabling password protection', true);
|
||||
return;
|
||||
}
|
||||
const codeType = fd.get('lockoutCodeType');
|
||||
if (enable && newPassword && codeType === 'pin' && !PIN_RE.test(newPassword)) {
|
||||
showMessage('A PIN is 4-8 digits', true);
|
||||
return;
|
||||
}
|
||||
const bootSeparate = fd.get('requirePasswordOnBoot') === 'on' && fd.get('bootCodeMode') === 'separate';
|
||||
const newBootPassword = fd.get('newBootPassword') || '';
|
||||
if (enable && bootSeparate) {
|
||||
if (newBootPassword !== document.getElementById('boot-password-confirm').value) {
|
||||
showMessage("Boot passwords don't match", true);
|
||||
return;
|
||||
}
|
||||
if (newBootPassword && fd.get('bootCodeType') === 'pin' && !PIN_RE.test(newBootPassword)) {
|
||||
showMessage('A boot PIN is 4-8 digits', true);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
const patch = { enablePasswordProtection: enable };
|
||||
if (enable) {
|
||||
@@ -228,6 +253,14 @@ lockoutForm.addEventListener('submit', async (e) => {
|
||||
patch.lockoutTimeoutMinutes = parseInt(fd.get('lockoutTimeoutMinutes'), 10);
|
||||
patch.lockoutAtTime = dailyLockEnabled.checked ? fd.get('lockoutAtTime') : '';
|
||||
patch.requirePasswordOnBoot = fd.get('requirePasswordOnBoot') === 'on';
|
||||
patch.lockoutCodeType = codeType;
|
||||
if (bootSeparate) {
|
||||
patch.bootCodeMode = 'separate';
|
||||
patch.bootCodeType = fd.get('bootCodeType');
|
||||
if (newBootPassword) patch.newBootPassword = newBootPassword;
|
||||
} else if (patch.requirePasswordOnBoot) {
|
||||
patch.bootCodeMode = 'same';
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
@@ -236,6 +269,8 @@ lockoutForm.addEventListener('submit', async (e) => {
|
||||
populateAll(currentConfig);
|
||||
lockoutForm.querySelector('[name=newLockoutPassword]').value = '';
|
||||
document.getElementById('lockout-password-confirm').value = '';
|
||||
lockoutForm.querySelector('[name=newBootPassword]').value = '';
|
||||
document.getElementById('boot-password-confirm').value = '';
|
||||
} catch (err) {
|
||||
showMessage(err.message, true);
|
||||
}
|
||||
@@ -252,12 +287,17 @@ function populateAll(config) {
|
||||
displayForm.elements.inactivityTimeoutMinutes.value = Math.round(config.inactivityTimeout / 60);
|
||||
|
||||
lockoutEnabled.checked = !!config.enablePasswordProtection;
|
||||
passwordLabel.textContent = config.hasLockoutPassword ? 'New password (leave blank to keep the current one)' : 'Set lockout password';
|
||||
passwordLabel.textContent = config.hasLockoutPassword ? 'New password/PIN (leave blank to keep the current one)' : 'Set unlock password/PIN';
|
||||
lockoutForm.elements.lockoutTimeoutMinutes.value = config.lockoutTimeout;
|
||||
dailyLockEnabled.checked = !!config.lockoutAtTime;
|
||||
lockoutAtTime.disabled = !config.lockoutAtTime;
|
||||
lockoutAtTime.value = config.lockoutAtTime || '';
|
||||
lockoutForm.elements.requirePasswordOnBoot.checked = !!config.requirePasswordOnBoot;
|
||||
lockoutForm.elements.lockoutCodeType.value = config.lockoutCodeType === 'pin' ? 'pin' : 'password';
|
||||
bootCodeMode.value = config.hasBootPassword ? 'separate' : 'same';
|
||||
lockoutForm.elements.bootCodeType.value = config.bootCodeType === 'pin' ? 'pin' : 'password';
|
||||
document.getElementById('boot-password-label').textContent = config.hasBootPassword
|
||||
? 'New boot password/PIN (leave blank to keep the current one)' : 'Set boot password/PIN';
|
||||
refreshLockoutFieldVisibility();
|
||||
}
|
||||
|
||||
|
||||
+36
-3
@@ -115,19 +115,26 @@
|
||||
<section class="page" id="page-lockout">
|
||||
<div class="page-header">
|
||||
<h1>Password Protection & Lockout</h1>
|
||||
<p>Blank the screen after inactivity and require a password to unlock.</p>
|
||||
<p>Blank the screen after inactivity and require a password or PIN to unlock. These are the kiosk's own codes, not the admin (sudo) password.</p>
|
||||
</div>
|
||||
<div class="card">
|
||||
<form id="lockout-form">
|
||||
<label class="checkbox"><input type="checkbox" name="enablePasswordProtection" id="lockout-enabled"> Enable password protection</label>
|
||||
|
||||
<div id="lockout-fields">
|
||||
<label>
|
||||
Unlock with
|
||||
<select name="lockoutCodeType">
|
||||
<option value="password">Password (needs a keyboard)</option>
|
||||
<option value="pin">PIN, 4-8 digits (on-screen number pad)</option>
|
||||
</select>
|
||||
</label>
|
||||
<label>
|
||||
<span id="password-label">Set lockout password</span>
|
||||
<input type="password" name="newLockoutPassword" autocomplete="new-password">
|
||||
</label>
|
||||
<label>
|
||||
Confirm password
|
||||
Confirm password/PIN
|
||||
<input type="password" id="lockout-password-confirm" autocomplete="new-password">
|
||||
</label>
|
||||
|
||||
@@ -142,7 +149,33 @@
|
||||
<input type="time" name="lockoutAtTime" id="lockout-at-time" disabled>
|
||||
</label>
|
||||
|
||||
<label class="checkbox"><input type="checkbox" name="requirePasswordOnBoot"> Require password on system boot</label>
|
||||
<label class="checkbox"><input type="checkbox" name="requirePasswordOnBoot" id="boot-lock-enabled"> Lock the kiosk on system boot</label>
|
||||
<div id="boot-code-fields">
|
||||
<label>
|
||||
Boot code
|
||||
<select name="bootCodeMode" id="boot-code-mode">
|
||||
<option value="same">Same as the unlock code</option>
|
||||
<option value="separate">Its own password/PIN</option>
|
||||
</select>
|
||||
</label>
|
||||
<div id="boot-separate-fields">
|
||||
<label>
|
||||
Boot code type
|
||||
<select name="bootCodeType">
|
||||
<option value="password">Password (needs a keyboard)</option>
|
||||
<option value="pin">PIN, 4-8 digits (on-screen number pad)</option>
|
||||
</select>
|
||||
</label>
|
||||
<label>
|
||||
<span id="boot-password-label">Set boot password/PIN</span>
|
||||
<input type="password" name="newBootPassword" autocomplete="new-password">
|
||||
</label>
|
||||
<label>
|
||||
Confirm boot password/PIN
|
||||
<input type="password" id="boot-password-confirm" autocomplete="new-password">
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="button-row"><button type="submit">Save Password Protection & Lockout</button></div>
|
||||
|
||||
Reference in New Issue
Block a user