forked from GNUWorldChannel/cservice-web-php7.4
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathv_totp.php
170 lines (165 loc) · 5.38 KB
/
v_totp.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
<?php
require("../../php_includes/cmaster.inc");
/* $Id: login.php,v 1.29 2005/12/13 11:49:32 nighty Exp $ */
if($loadavg5 >= CRIT_LOADAVG) {
header("Location: highload.php");
exit;
}
$totp_pin=$_POST['pin'];
if ($totp_pin!="" && !preg_match(NON_BOGUS_TOTP,trim($totp_pin))) {
echo "<h2>Bogus token PIN</h2><br><a href=\"v_totp.php\">Try again</a>";
die;
}
$dummy='n/a';
SetCookie("totp",$dummy,time()+7200,"/",COOKIE_DOMAIN);
header("Pragma: no-cache");
$current_page='v_totp.php';
$user_id = std_security_chk($auth);
$cTheme = get_theme_info();
if ($user_id > 0 )
{
$web_cookie=explode(":", $auth);
$user_name=$web_cookie[0];
if (!ip_check($user_name,0)) {
echo "<META HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\">\n";
std_theme_styles(1); std_theme_body();
echo "<h1>Error<br>\n";
echo "Too many failed login attempts for this username.</h1><br>\n";
echo "</body>\n";
echo "</html>\n\n";
$ENABLE_COOKIE_TABLE = 1;
pg_safe_exec(CLEAR_COOKIES_QUERY);
pg_safe_exec("delete from webcookies where user_id=" . (int)$user_id);
if (COOKIE_DOMAIN!="") {
SetCookie("auth","",0,"/",COOKIE_DOMAIN);
SetCookie("totp","",0,"/",COOKIE_DOMAIN);
} else {
SetCookie("auth","",0,"/");
SetCookie("totp","",0,"/");
}
$ENABLE_COOKIE_TABLE = 0;
die;
}
$totp_key=has_totp($user_id);
$expire=time()+get_custom_session($user_id);
$totp_web_help="https://cservice.borischin.org/totp";
if(!$totp_key)
{
header("Location main.php?sba=1");
}
else
{
$TimeStamp = Google2FA::get_timestamp();
$secretkey = Google2FA::base32_decode($totp_key);
//$otp = Google2FA::oath_hotp($secretkey, $TimeStamp);
$result = Google2FA::verify_key($totp_key, $totp_pin);
if ($result)
{
$temp_totp_hash=gen_totp_cookie($totp_key);
if (COOKIE_DOMAIN!="")
{
SetCookie("csess",$expire."",$expire, "/",COOKIE_DOMAIN) or die ("Can not set cookie");
SetCookie("totp",$temp_totp_hash,$expire,"/",COOKIE_DOMAIN);
}
else
{
SetCookie("csess", $expire."", $expire, "/") or die ("Can not set cookie");
SetCookie("totp",$temp_totp_hash,$expire,"/");
}
$fmm="UPDATE webcookies SET totp_cookie='".$temp_totp_hash."' WHERE user_id='" . (int)$user_id . "'";
pg_exec($fmm);
$fmm="DELETE from ips where ipnum='" . cl_ip() . "' AND lower(user_name)='" . strtolower($user_name) . "'";
pg_exec($fmm);
$admin=std_admin();
if ($admin>0) { local_seclog("Login"); log_webrelay("authenticated with TOTP at level " . $admin); }
header ("Location: main.php?sba=1");
die;
}
else
{
$msg = "<h3>Invalid code, please try again.</h3>";
ip_check($user_name,1);
// totp_ip_add( cl_ip(), $user_name);
//pg_exec("INSERT INTO ips (ipnum,user_name,expiration,hit_counts,set_on) VALUES ('" . cl_ip() . "','" . $user_name . "',0,1,now()::abstime::int4)");
}
}
echo "<META HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\">\n";
//echo "<META HTTP-EQUIV=\"Expires\" CONTENT=\"0\">\n";
?>
<html>
<head>
<title>CService Login</title>
<?php std_theme_styles(1); ?>
<link rel="stylesheet" type="text/css" href="./totp/css/dialog-custom.css" media="screen" />
<script type="text/javascript" src="./totp/js/jquery-1.7.2.min.js"~></script>
<script type="text/javascript" src="./totp/js/jquery-ui-1.8.20.custom.min.js"></script>
<script type="text/javascript" src="./totp/js/jquery.infieldlabel.min.js"></script>
<script type="text/javascript" src="./totp/js/custom.js"></script>
</head>
<?phpphp
std_theme_body("","document.forms[0].pin.focus();");
echo "<center>\n";
echo "<font size=+2><b>Welcome to CService</b></font>\n";
echo "<br>\n";
echo "<table width=\"400\" bgcolor=#" . $cTheme->main_textcolor . ">\n";
echo "<tr><td>\n";
echo "<table cellpadding=5 bgcolor=#" . $cTheme->table_bgcolor . " width=\"100%\">\n";
echo "<tr><td><center>\n";
echo "<font color=#" . $cTheme->main_textcolor . ">\n";
if (($totp_pin != '') && ($msg !=''))
{
echo $msg;
local_seclog("Failed login (WRONG TOTP for `" . N_get_pure_string($user_name) . "`)");
if (std_admin() > 0) {
log_webrelay("failed TOTP token.");
}
}
?>
<form method="post" action="v_totp.php">
<p>Enter the code generated by your authenticator app.</p>
</center>
<p>
<label class="login" for="pin">6-digit code</label><br />
<input type="text" name="pin" id="pin" placeholder="">
<input type="submit" value="Submit">
</p>
</form>
</td></tr>
<?phpphp
echo "<tr><td valign=top bgcolor=#ff9999 colspan=\"2\">";
echo "<font style=\"font-size: 13px; color: #000000; font-weight: bold;\">";
echo 'If you have issues logging in, please contact #usernames.';
?>
</table>
</td>
</tr>
</table>
</center>
</body>
</html>
<?php
}
else
{
echo "<META HTTP-EQUIV=\"Pragma\" CONTENT=\"no-cache\">\n";
//echo "<META HTTP-EQUIV=\"Expires\" CONTENT=\"0\">\n";
?>
<html>
<head>
<title>CService Login</title>
<?php std_theme_styles(); ?>
</head>
<?phpphp
echo "<center>\n";
echo "<font size=+2><b>Welcome to CService</b></font>\n";
echo "<br>\n";
echo "<table width=\"400\" bgcolor=#" . $cTheme->main_textcolor . ">\n";
echo "<tr><td>\n";
echo "<table cellpadding=5 bgcolor=#" . $cTheme->table_bgcolor . " width=\"100%\">\n";
echo "<tr><td><center>\n";
echo "<font color=#" . $cTheme->main_textcolor . ">\n";
echo "<font size=+2><b>CService Login - TOTP verification</b></font>\n";
echo "<h3>Your username and password were not checked. </h3><br>Click<a href=\"login.php\"> here</a> to login.</td></tr></table></td></tr></table></center></body></html>\n\n";
die;
}
?>