add placeholder authentication via app passwords if service is passed

forbid logins via regular passwords for services
remove AUTH_DISABLE_OTP

api/index.php

@@ -22,8 +22,6 @@
 	ini_set('session.use_cookies', 0);
 	ini_set("session.gc_maxlifetime", 86400);
 
-	define('AUTH_DISABLE_OTP', true);
-
 	if (defined('ENABLE_GZIP_OUTPUT') && ENABLE_GZIP_OUTPUT &&
 			function_exists("ob_gzhandler")) {
 

classes/api.php

@@ -74,10 +74,10 @@ class API extends Handler {
 		}
 
 		if (get_pref("ENABLE_API_ACCESS", $uid)) {
-			if (authenticate_user($login, $password)) {               // try login with normal password
+			if (authenticate_user($login, $password, false,  Auth_Base::AUTH_SERVICE_API)) {               // try login with normal password
 				$this->wrap(self::STATUS_OK, array("session_id" => session_id(),
 					"api_level" => self::API_LEVEL));
-			} else if (authenticate_user($login, $password_base64)) { // else try with base64_decoded password
+			} else if (authenticate_user($login, $password_base64, false, Auth_Base::AUTH_SERVICE_API)) { // else try with base64_decoded password
 				$this->wrap(self::STATUS_OK,	array("session_id" => session_id(),
 					"api_level" => self::API_LEVEL));
 			} else {                                                         // else we are not logged in

classes/auth/base.php

@@ -2,6 +2,8 @@
 class Auth_Base {
 	private $pdo;
 
+	const AUTH_SERVICE_API = '_api';
+
 	function __construct() {
 		$this->pdo = Db::pdo();
 	}
@@ -9,14 +11,14 @@ class Auth_Base {
 	/**
 	 * @SuppressWarnings(unused)
 	 */
-	function check_password($owner_uid, $password) {
+	function check_password($owner_uid, $password, $service = '') {
 		return false;
 	}
 
 	/**
 	 * @SuppressWarnings(unused)
 	 */
-	function authenticate($login, $password) {
+	function authenticate($login, $password, $service = '') {
 		return false;
 	}
 

classes/iauthmodule.php

@@ -1,4 +1,4 @@
 <?php
 interface IAuthModule {
-	function authenticate($login, $password);
+	function authenticate($login, $password); // + optional third parameter: $service
 }

include/functions.php

@@ -509,7 +509,7 @@
 		return "";
 	}
 
-	function authenticate_user($login, $password, $check_only = false) {
+	function authenticate_user($login, $password, $check_only = false, $service = false) {
 
 		if (!SINGLE_USER_MODE) {
 			$user_id = false;
@@ -517,7 +517,7 @@
 
 			foreach (PluginHost::getInstance()->get_hooks(PluginHost::HOOK_AUTH_USER) as $plugin) {
 
-				$user_id = (int) $plugin->authenticate($login, $password);
+				$user_id = (int) $plugin->authenticate($login, $password, $service);
 
 				if ($user_id) {
 					$auth_module = strtolower(get_class($plugin));

plugins/auth_internal/init.php

@@ -1,5 +1,5 @@
-<?php
+	<?php
-class Auth_Internal extends Plugin implements IAuthModule {
+	class Auth_Internal extends Plugin implements IAuthModule {
 
 		private $host;
 
@@ -18,14 +18,13 @@ class Auth_Internal extends Plugin implements IAuthModule {
 			$host->add_hook($host::HOOK_AUTH_USER, $this);
 		}
 
-	function authenticate($login, $password) {
+		function authenticate($login, $password, $service = '') {
 
 			$pwd_hash1 = encrypt_password($password);
 			$pwd_hash2 = encrypt_password($password, $login);
 			$otp = $_REQUEST["otp"];
 
 			if (get_schema_version() > 96) {
-			if (!defined('AUTH_DISABLE_OTP') || !AUTH_DISABLE_OTP) {
 
 				$sth = $this->pdo->prepare("SELECT otp_enabled,salt FROM ttrss_users WHERE
 					login = ?");
@@ -42,6 +41,12 @@ class Auth_Internal extends Plugin implements IAuthModule {
 					$otp_check = $topt->now();
 
 					if ($otp_enabled) {
+
+						// only allow app password checking if OTP is enabled
+						if ($service && get_schema_version() > 138) {
+							return $this->check_app_password($login, $password, $service);
+						}
+
 						if ($otp) {
 							if ($otp != $otp_check) {
 								return false;
@@ -83,6 +88,15 @@ class Auth_Internal extends Plugin implements IAuthModule {
 					}
 				}
 			}
+
+			// check app passwords first but allow regular password as a fallback for the time being
+			// if OTP is not enabled
+
+			if ($service && get_schema_version() > 138) {
+				$user_id = $this->check_app_password($login, $password, $service);
+
+				if ($user_id)
+					return $user_id;
 			}
 
 			if (get_schema_version() > 87) {
@@ -162,7 +176,7 @@ class Auth_Internal extends Plugin implements IAuthModule {
 
 		function check_password($owner_uid, $password) {
 
-		$sth = $this->pdo->prepare("SELECT salt,login FROM ttrss_users WHERE
+			$sth = $this->pdo->prepare("SELECT salt,login,otp_enabled FROM ttrss_users WHERE
 				id = ?");
 			$sth->execute([$owner_uid]);
 
@@ -243,9 +257,12 @@ class Auth_Internal extends Plugin implements IAuthModule {
 			}
 		}
 
+		private function check_app_password($login, $password, $service) {
+			return false;
+		}
+
 		function api_version() {
 			return 2;
 		}
 
-}
+	}
-?>