valvin
/
ttrss
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

require entering current one time code to enable otp

This commit is contained in:
Andrew Dolgov 2013-04-16 21:07:26 +04:00
parent 6f148528dc
commit 9deca86d96
1 changed files with 29 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
classes/pref/prefs.php
View File

@ -399,8 +399,8 @@ class Pref_Prefs extends Handler_Protected {
parameters: dojo.objectToQuery(this.getValues()), parameters: dojo.objectToQuery(this.getValues()),
onComplete: function(transport) { onComplete: function(transport) {
notify(''); notify('');
if (transport.responseText.indexOf('ERROR: ') == 0) { if (transport.responseText.indexOf('ERROR:') == 0) {
notify_error(transport.responseText.replace('ERROR: ', '')); notify_error(transport.responseText.replace('ERROR:', ''));
} else { } else {
window.location.reload(); window.location.reload();
} }
@ -416,11 +416,13 @@ class Pref_Prefs extends Handler_Protected {
print "<td class=\"prefValue\"><input dojoType=\"dijit.form.ValidationTextBox\" type=\"password\" required=\"1\" print "<td class=\"prefValue\"><input dojoType=\"dijit.form.ValidationTextBox\" type=\"password\" required=\"1\"
name=\"password\"></td></tr>"; name=\"password\"></td></tr>";
print "<tr><td colspan=\"2\">"; print "<tr><td width=\"40%\">".__("Enter the generated one time password")."</td>";
print "<input dojoType=\"dijit.form.CheckBox\" required=\"1\" print "<td class=\"prefValue\"><input dojoType=\"dijit.form.ValidationTextBox\" autocomplete=\"off\"
type=\"checkbox\" id=\"enable_otp\" name=\"enable_otp\"/> "; required=\"1\"
print "<label for=\"enable_otp\">".__("I have scanned the code and would like to enable OTP")."</label>"; name=\"otp\"></td></tr>";
print "<tr><td colspan=\"2\">";
print "</td></tr><tr><td colspan=\"2\">"; print "</td></tr><tr><td colspan=\"2\">";
@ -957,22 +959,39 @@ class Pref_Prefs extends Handler_Protected {
} }
function otpenable() { function otpenable() {
$password = db_escape_string($this->link, $_REQUEST["password"]); require_once "lib/otphp/vendor/base32.php";
$enable_otp = $_REQUEST["enable_otp"] == "on"; require_once "lib/otphp/lib/otp.php";
require_once "lib/otphp/lib/totp.php";
$password = $_REQUEST["password"];
$otp = $_REQUEST["otp"];
global $pluginhost; global $pluginhost;
$authenticator = $pluginhost->get_plugin($_SESSION["auth_module"]); $authenticator = $pluginhost->get_plugin($_SESSION["auth_module"]);
if ($authenticator->check_password($_SESSION["uid"], $password)) { if ($authenticator->check_password($_SESSION["uid"], $password)) {
if ($enable_otp) { $result = db_query($this->link, "SELECT salt
FROM ttrss_users
WHERE id = ".$_SESSION["uid"]);
$base32 = new Base32();
$secret = $base32->encode(sha1(db_fetch_result($result, 0, "salt")));
$topt = new \OTPHP\TOTP($secret);
$otp_check = $topt->now();
if ($otp == $otp_check) {
db_query($this->link, "UPDATE ttrss_users SET otp_enabled = true WHERE db_query($this->link, "UPDATE ttrss_users SET otp_enabled = true WHERE
id = " . $_SESSION["uid"]); id = " . $_SESSION["uid"]);
print "OK"; print "OK";
} else {
print "ERROR:".__("Incorrect one time password");
} }
} else { } else {
print "ERROR: ".__("Incorrect password"); print "ERROR:".__("Incorrect password");
} }
} }