MDL-79958 tool_mfa: String updates and added settings description

2024-12-24 15:18:40 +07:00
parent 8d7b8f99bd
commit 24f3d5f5d5
26 changed files with 66 additions and 11 deletions
@@ -26,6 +26,7 @@
 $string['info'] = 'This factor allows for NOT being an administrator to count as a factor. Its intended use is to ensure administators require tighter security, so regular users get the weight for free, while admins must use other factors.';
 $string['pluginname'] = 'Non-administrator';
 $string['privacy:metadata'] = 'The Non-administrator factor plugin does not store any personal data.';
+$string['settings:description'] = 'All users except site administrators receive the points for this factor. This allows you to require additional authentication factors for site administrators.';
 $string['settings:shortdescription'] = 'Require additional authentication factors for administrators.';
 $string['settings:weight_help'] = 'Weight is given to regular users for this factor, so admins must have more factors than a regular user to pass.';
 $string['summarycondition'] = 'is not an admin';
@@ -25,6 +25,9 @@

 defined('MOODLE_INTERNAL') || die();

+$settings->add(new admin_setting_heading('factor_admin/description', '', new lang_string('settings:description', 'factor_admin')));
+$settings->add(new admin_setting_heading('factor_admin/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_admin/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
@@ -26,6 +26,7 @@
 $string['info'] = 'Check the type of authentication used to log in as an MFA factor.';
 $string['pluginname'] = 'Authentication type';
 $string['privacy:metadata'] = 'The Authentication type factor plugin does not store any personal data.';
+$string['settings:description'] = 'Automatically verify users based on their authentication type.';
 $string['settings:goodauth'] = 'Factor authentication types';
 $string['settings:goodauth_help'] = 'Select all authentication types to use as a factor for MFA. Any types not selected will not be treated as a FAIL in MFA.';
 $string['settings:shortdescription'] = 'Allow users to bypass extra authentication steps based on their authentication type.';
@@ -25,6 +25,9 @@

 defined('MOODLE_INTERNAL') || die();

+$settings->add(new admin_setting_heading('factor_auth/description', '', new lang_string('settings:description', 'factor_auth')));
+$settings->add(new admin_setting_heading('factor_auth/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_auth/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
@@ -30,5 +30,7 @@ $string['settings:adminpasses'] = 'Site admins can pass this factor';
 $string['settings:adminpasses_help'] = 'By default admins pass all capability checks, including this one which uses \'factor/capability:cannotpassfactor\', which means they will fail this factor.
    If checked then all site admins will pass this factor if they do not have this capability from another role.
    If unchecked site admins will fail this factor.';
+$string['settings:description'] = '<p>Use the capability \'factor/capability:cannotpassfactor\' to specify which users need multiple-factor authentication.</p>
+<p>You can assign this capability to users in the <a href="roles/manage.php">Define roles</a> page.</p>';
 $string['settings:shortdescription'] = 'Specify which users must use other factors to authenticate. Must be combined with other factors.';
-$string['summarycondition'] = 'does NOT have the factor/capability:cannotpassfactor capability in any role including site administrator.';
+$string['summarycondition'] = 'does NOT have the \'factor/capability:cannotpassfactor\' capability in any role including site administrator.';
@@ -25,6 +25,10 @@

 defined('MOODLE_INTERNAL') || die();

+$settings->add(new admin_setting_heading('factor_capability/description', '',
+    new lang_string('settings:description', 'factor_capability')));
+$settings->add(new admin_setting_heading('factor_capability/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_capability/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
@@ -23,9 +23,11 @@
 * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */

-$string['pluginname'] = 'Cohort';
-$string['privacy:metadata'] = 'The Cohort factor plugin does not store any personal data.';
+$string['pluginname'] = 'Cohorts';
+$string['privacy:metadata'] = 'The Cohorts factor plugin does not store any personal data.';
 $string['settings:cohort'] = 'Non-passing cohorts';
 $string['settings:cohort_help'] = 'Select the cohorts that will not pass this factor. This allows you to force these cohorts to use other factors to authenticate.';
+$string['settings:description'] = '<p>Select the user cohorts that must use additional factors to authenticate. If this factor is not set up, all cohorts will be required to use additional factors by default.</p>
+<p>This factor requires a cohort to be created.</p>';
 $string['settings:shortdescription'] = 'Specify which cohorts of users must use other factors to authenticate. Must be combined with other factors.';
 $string['summarycondition'] = 'does NOT have any of the following cohorts assigned in any context: {$a}';
@@ -26,6 +26,10 @@
 defined('MOODLE_INTERNAL') || die();
 require_once(__DIR__ . '/../../../../../cohort/lib.php');

+$settings->add(new admin_setting_heading('factor_cohort/description', '',
+    new lang_string('settings:description', 'factor_cohort')));
+$settings->add(new admin_setting_heading('factor_cohort/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_cohort/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
@@ -53,6 +53,7 @@ $string['managefactor'] = 'Manage email';
 $string['manageinfo'] = '\'{$a}\' is being used to authenticate. This has been set up by your administrator.';
 $string['pluginname'] = 'Email';
 $string['privacy:metadata'] = 'The Email factor plugin does not store any personal data';
+$string['settings:description'] = 'Users will receive a 6-digit verification code via email, which they must enter to complete the login process.';
 $string['settings:duration'] = 'Validity duration';
 $string['settings:duration_help'] = 'The period of time that the code is valid.';
 $string['settings:shortdescription'] = 'Require users to enter a code received via email during login.';
@@ -25,6 +25,9 @@

 defined('MOODLE_INTERNAL') || die();

+$settings->add(new admin_setting_heading('factor_email/description', '', new lang_string('settings:description', 'factor_email')));
+$settings->add(new admin_setting_heading('factor_email/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_email/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 1);
@@ -31,6 +31,7 @@ $string['redirectsetup'] = 'You must complete setup for Multi-factor authenticat
 $string['revokeexpiredfactors'] = 'Revoke expired grace period factors';
 $string['settings:customwarning'] = 'Warning banner content';
 $string['settings:customwarning_help'] = 'Add content here to replace the grace warning notification with custom HTML contents. Adding {timeremaining} in text will replace it with the current grace duration for the user, and {setuplink} will replace with the URL of the setup page for the user.';
+$string['settings:description'] = 'Allow users to log in without MFA for a specified period of time, giving them time to set up their authentication factors. After the grace period expires, users must use MFA to log in.';
 $string['settings:forcesetup'] = 'Force factor setup';
 $string['settings:forcesetup_help'] = 'Forces a user to the preferences page to set up multi-factor authentication when the grace period expires. If unchecked, users will be unable to authenticate when the grace period expires.';
 $string['settings:graceperiod'] = 'Grace period';
@@ -25,6 +25,9 @@

 defined('MOODLE_INTERNAL') || die();

+$settings->add(new admin_setting_heading('factor_grace/description', '', new lang_string('settings:description', 'factor_grace')));
+$settings->add(new admin_setting_heading('factor_grace/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_grace/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
@@ -28,6 +28,7 @@ $string['allowedipshasmyip'] = 'Your IP (<i>{$a->ip}</i>) is in the list and you
 $string['allowedipshasntmyip'] = 'Your IP (<i>{$a->ip}</i>) is not in the list and you will not pass this factor.';
 $string['pluginname'] = 'IP range';
 $string['privacy:metadata'] = 'The IP range factor plugin does not store any personal data.';
+$string['settings:description'] = 'Enable automatic user verification using IP addresses. This doesn\'t require user setup and can provide a secure, seamless login on trusted networks.';
 $string['settings:safeips'] = 'Safe IP ranges';
 $string['settings:safeips_help'] = 'Enter a list of IP addresses or subnets to be counted as a pass in factor. If empty nobody will pass this factor. {$a->info} {$a->syntax}';
 $string['settings:shortdescription'] = 'Use IP addresses to automatically verify users\' identity.';
@@ -27,6 +27,10 @@ defined('MOODLE_INTERNAL') || die();

 global $OUTPUT;

+$settings->add(new admin_setting_heading('factor_iprange/description', '',
+    new lang_string('settings:description', 'factor_iprange')));
+$settings->add(new admin_setting_heading('factor_iprange/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_iprange/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
@@ -23,9 +23,10 @@
 * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */

-$string['deleteunusablefactors'] = 'Delete unusable Nosetup factors';
+$string['deleteunusablefactors'] = 'Delete unusable Optional MFA factors';
 $string['info'] = 'This factor passes if the user has no other factors set up.';
 $string['pluginname'] = 'No other factors';
 $string['privacy:metadata'] = 'The No other factors plugin does not store any personal data';
+$string['settings:description'] = 'Allow users who haven\'t set up any other authentication factors to bypass MFA until another factor is added.';
 $string['settings:shortdescription'] = 'Allow users to bypass MFA if they have not set up any other authentication factor.';
 $string['summarycondition'] = 'has no other factors set up';
@@ -25,6 +25,10 @@

 defined('MOODLE_INTERNAL') || die();

+$settings->add(new admin_setting_heading('factor_nosetup/description', '',
+    new lang_string('settings:description', 'factor_nosetup')));
+$settings->add(new admin_setting_heading('factor_nosetup/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_nosetup/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
@@ -23,8 +23,9 @@
 * @license     http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */

-$string['pluginname'] = 'Role';
-$string['privacy:metadata'] = 'The Role factor plugin does not store any personal data.';
+$string['pluginname'] = 'Roles';
+$string['privacy:metadata'] = 'The Roles factor plugin does not store any personal data.';
+$string['settings:description'] = 'Select the roles that must use additional factors to authenticate. If this factor is not turned on, all roles will be required to use an additional factor.';
 $string['settings:roles'] = 'Non-passing roles';
 $string['settings:roles_help'] = 'Select the roles that will not pass this factor. This allows you to force these roles to use other factors to authenticate.';
 $string['settings:shortdescription'] = 'Specify which users must use other factors to authenticate, based on their role. Must be combined with other factors.';
@@ -25,6 +25,9 @@

 defined('MOODLE_INTERNAL') || die();

+$settings->add(new admin_setting_heading('factor_role/description', '', new lang_string('settings:description', 'factor_role')));
+$settings->add(new admin_setting_heading('factor_role/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_role/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
@@ -45,16 +45,14 @@ $string['notification:smsgatewaymigration'] = 'SMS settings have moved';
 $string['notification:smsgatewaymigrationinfo'] = 'A new SMS subsystem is now available for managing and configuring all SMS-related functions. Your existing SMS configurations have been migrated to the page <a href="{$a}">SMS gateways</a>.';
 $string['logintitle'] = 'Enter the verification code sent to your mobile';
 $string['phonehelp'] = 'Enter your mobile number (including country code) to receive a verification code.';
-$string['pluginname'] = 'SMS mobile phone';
-$string['privacy:metadata'] = 'The SMS mobile phone factor plugin does not store any personal data.';
+$string['pluginname'] = 'SMS';
+$string['privacy:metadata'] = 'The SMS factor plugin does not store any personal data.';
 $string['revokefactorconfirmation'] = 'Remove \'{$a}\' SMS?';
 $string['settings:duration'] = 'Validity duration';
 $string['settings:duration_help'] = 'The period of time that the code is valid.';
 $string['settings:gateway'] = 'SMS gateway';
 $string['settings:gateway_help'] = 'The SMS provider you wish to send messages via';
-$string['settings:heading'] = 'Users will receive an SMS with 6-digit code during login, which they must enter to complete the login process.
-
-Users will need to register their mobile phone number first.';
+$string['settings:heading'] = 'Users will receive a 6-digit verification code via SMS, which they must enter to complete the login process. Users will need to register their mobile phone number first.';
 $string['settings:setupdesc'] = '<br><br>To use SMS as an authentication factor, you first need to <a href="{$a}">set up an SMS gateway</a>.';
 $string['settings:shortdescription'] = 'Require users to enter a code received via SMS during login.';
 $string['settings:smsgateway'] = 'SMS gateway';
@@ -50,6 +50,7 @@ $settings->add(
        ),
    ),
 );
+$settings->add(new admin_setting_heading('factor_sms/settings', new lang_string('settings', 'moodle'), ''));

 if (count($gatewayrecords) > 0) {
    $gateways = [0 => new lang_string('none')];
@@ -27,6 +27,7 @@ $string['event:token_created'] = 'MFA token created.';
 $string['form:trust'] = 'Trust this device for {$a}.';
 $string['pluginname'] = 'Trust this device';
 $string['privacy:metadata'] = 'The Trust this device factor plugin does not store any personal data.';
+$string['settings:description'] = 'Allow users to bypass extra authentication on devices marked as trusted after the first authentication.';
 $string['settings:expireovernight'] = 'Expire trust overnight';
 $string['settings:expireovernight_help'] = 'This forces tokens to expire overnight, preventing midday interruptions for users. Instead they will be asked to multi-factor authenticate at the start of a day after expiry.';
 $string['settings:expiry'] = 'Trust duration';
@@ -26,6 +26,9 @@

 defined('MOODLE_INTERNAL') || die();

+$settings->add(new admin_setting_heading('factor_token/description', '', new lang_string('settings:description', 'factor_token')));
+$settings->add(new admin_setting_heading('factor_token/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_token/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
@@ -51,6 +51,7 @@ $string['privacy:metadata'] = 'The Authenticator app factor plugin does not stor
 $string['replacefactor'] = 'Replace authenticator app';
 $string['replacefactorconfirmation'] = 'Replace \'{$a}\' authenticator app?';
 $string['revokefactorconfirmation'] = 'Remove \'{$a}\' authenticator app?';
+$string['settings:description'] = 'Users will need an authenticator app installed on their mobile devices to generate a code, which they must enter during login.';
 $string['settings:shortdescription'] = 'Require users to enter a code from an authenticator app on their devices during login.';
 $string['settings:totplink'] = 'Show mobile app setup link';
 $string['settings:totplink_help'] = 'If enabled the user will see a 3rd setup option with a direct otpauth:// link';
@@ -26,6 +26,9 @@

 defined('MOODLE_INTERNAL') || die();

+$settings->add(new admin_setting_heading('factor_totp/description', '', new lang_string('settings:description', 'factor_totp')));
+$settings->add(new admin_setting_heading('factor_totp/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_totp/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
@@ -49,6 +49,8 @@ $string['replacefactorconfirmation'] = 'Replace \'{$a}\' security key?';
 $string['revokefactorconfirmation'] = 'Remove \'{$a}\' security key?';
 $string['settings:authenticatortypes'] = 'Types of authenticator';
 $string['settings:authenticatortypes_help'] = 'Toggle certain types of authenticators';
+$string['settings:description'] = '<p>Users authenticate using a physical security key, such as a USB or NFC token, or a biometric method like a fingerprint. During login, they must physically use their security key to verify their identity.</p>
+<p>Users will need to set up their own security keys first.</p>';
 $string['settings:shortdescription'] = 'Require users to use a security key, like a USB or NFC token, or a biometric method, during login.';
 $string['settings:userverification'] = 'User verification';
 $string['settings:userverification_help'] = 'Serves to ensure the person authenticating is in fact who they say they are. User verification can take various forms, such as password, PIN, fingerprint, etc.';
@@ -25,6 +25,10 @@

 defined('MOODLE_INTERNAL') || die();

+$settings->add(new admin_setting_heading('factor_webauthn/description', '',
+    new lang_string('settings:description', 'factor_webauthn')));
+$settings->add(new admin_setting_heading('factor_webauthn/settings', new lang_string('settings', 'moodle'), ''));
+
 $enabled = new admin_setting_configcheckbox('factor_webauthn/enabled',
    new lang_string('settings:enablefactor', 'tool_mfa'),
    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);