3 files changed, 51 insertions, 3 deletions
diff --git a/templates/web/base/auth/2faform.html b/templates/web/base/auth/2faform.html
new file mode 100644
index 000000000..bd8d60cdb
--- /dev/null
+++ b/templates/web/base/auth/2faform.html
@@ -0,0 +1,26 @@
+[% INCLUDE 'header.html', bodyclass = 'fullwidthpage', title = loc('Confirm account') %]
+
+  <div class="confirmation-header confirmation-header--phone">
+    [% IF incorrect_code %]
+        <h1>[% loc('Sorry, that wasn&rsquo;t the correct code') %]</h1>
+        <p>[% loc('Try again') %]:</p>
+    [% ELSE %]
+        <h1>[% loc("Nearly done! Now check your phone&hellip;") %]</h1>
+        <p>[% loc("Please generate a two-factor code and enter it below:") %]</p>
+    [% END %]
+    <form action="/auth" method="post">
+        <input type="hidden" name="username" value="[% c.get_param('username') | html %]">
+        <input type="hidden" name="password_sign_in" value="[% c.get_param('password_sign_in') | html %]">
+        <input type="hidden" name="r" value="[% c.get_param('r') | html %]">
+        <input type="hidden" name="remember_me" value="[% c.get_param('remember_me') | html %]">
+        <input type="hidden" name="token" value="[% token | html %]">
+
+        <label for="2fa_code">[% loc('Code') %]</label>
+        <div class="form-txt-submit-box">
+            <input class="form-control" type="number" id="2fa_code" name="2fa_code" value="" required>
+            <input type="submit" value="[% loc('Submit') %]" class="btn-primary">
+        </div>
+    </form>
+  </div>
+
+[% INCLUDE 'footer.html' %]
diff --git a/templates/web/base/auth/generate_token.html b/templates/web/base/auth/generate_token.html
index 157335047..f7061be45 100644
--- a/templates/web/base/auth/generate_token.html
+++ b/templates/web/base/auth/generate_token.html
@@ -1,5 +1,5 @@
 [%
-INCLUDE 'header.html', title = loc('Generate token'), bodyclass = 'fullwidthpage'
+INCLUDE 'header.html', title = loc('Security'), bodyclass = 'fullwidthpage'
 %]
 
 [% IF token_generated %]
@@ -15,9 +15,28 @@ INCLUDE 'header.html', title = loc('Generate token'), bodyclass = 'fullwidthpage
     <p><a href="/my">[% loc('Your account') %]</a></p>
   </div>
 
+[% ELSIF toggle_2fa_on %]
+
+  <div class="confirmation-header">
+    <h1>[% loc('Two-factor authentication has been activated') %]</h1>
+
+    <p align="center"><img src="[% qr_code %]"></p>
+    <p align="center">[% secret32.replace('(....)', '$1 ') %]</p>
+
+    <p><a href="/my">[% loc('Your account') %]</a></p>
+  </div>
+
+[% ELSIF toggle_2fa_off %]
+
+  <div class="confirmation-header">
+    <h1>[% loc('Two-factor authentication has been deactivated') %]</h1>
+
+    <p><a href="/my">[% loc('Your account') %]</a></p>
+  </div>
+
 [% ELSE %]
 
-<h1>[% loc('Generate token') %]</h1>
+<h1>[% loc('Security') %]</h1>
 
 <form action="[% c.uri_for_action('/auth/profile/generate_token') %]" method="post" name="generate_token">
     <input type="hidden" name="token" value="[% csrf_token %]">
@@ -31,6 +50,9 @@ INCLUDE 'header.html', title = loc('Generate token'), bodyclass = 'fullwidthpage
 
     <p>
     <input name="generate_token" type="submit" class="btn" value="[% existing_token ? loc('Replace token') : loc('Generate token') %]">
+      [% IF c.user.is_superuser %]
+        <input name="toggle_2fa" type="submit" class="btn" value="[% has_2fa ? loc('Deactivate two-factor authentication') : loc('Activate two-factor authentication') %]">
+      [% END %]
     </p>
 </form>
 
diff --git a/templates/web/base/my/my.html b/templates/web/base/my/my.html
index e10dd96c8..459fa5266 100644
--- a/templates/web/base/my/my.html
+++ b/templates/web/base/my/my.html
@@ -62,7 +62,7 @@ li .my-account-buttons a {
 <p class="my-account-buttons">
   <a href="/auth/change_password">[% loc('Change password') %]</a>
   [% IF c.user AND (c.user.from_body OR c.user.is_superuser) %]
-  <a href="/auth/generate_token">[% loc('Generate token') %]</a>
+  <a href="/auth/generate_token">[% loc('Security') %]</a>
   [% END %]
   <a href="/auth/sign_out">[% loc('Sign out') %]</a>
 </p>