diff --git a/modals/user_mfa_modal.php b/modals/user_mfa_modal.php new file mode 100644 index 00000000..a5f9987b --- /dev/null +++ b/modals/user_mfa_modal.php @@ -0,0 +1,50 @@ + + + diff --git a/post/user/profile.php b/post/user/profile.php index 0ff38f49..79fdb22b 100644 --- a/post/user/profile.php +++ b/post/user/profile.php @@ -208,6 +208,76 @@ if (isset($_POST['verify'])) { } +if (isset($_POST['enable_mfa'])) { + + validateCSRFToken($_POST['csrf_token']); + + require_once "plugins/totp/totp.php"; + + $verify_code = intval($_POST['verify_code']); //code to validate, for example received from device + $token = sanitizeInput($_POST['token']); + + if (TokenAuth6238::verify($token, $verify_code)) { + + mysqli_query($mysqli,"UPDATE users SET user_token = '$token' WHERE user_id = $session_user_id"); + + // Delete any existing 2FA tokens - these browsers should be re-validated + mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $session_user_id"); + + // Logging + logAction("User Account", "Edit", "$session_name enabled MFA on their account"); + + $_SESSION['alert_message'] = "Multi-Factor authentication enabled"; + + } else { + $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Verification Code Invalid, Multi-Factor Authenticaion not enabled, Try again!"; + } + + header("Location: user_security.php"); + +} + +if (isset($_GET['disable_mfa'])){ + + // CSRF Check + validateCSRFToken($_GET['csrf_token']); + + mysqli_query($mysqli,"UPDATE users SET user_token = '' WHERE user_id = $session_user_id"); + + // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php + $config_mail_from_name = sanitizeInput($config_mail_from_name); + $config_mail_from_email = sanitizeInput($config_mail_from_email); + $config_app_name = sanitizeInput($config_app_name); + + // Email notification + if (!empty($config_smtp_host)) { + $subject = "$config_app_name account update confirmation for $session_name"; + $body = "Hi $session_name,

Your $config_app_name account has been updated, details below:

2FA was disabled.

If you did not perform this change, contact your $config_app_name administrator immediately.

Thanks,
ITFlow
$session_company_name"; + + $data = [ + [ + 'from' => $config_mail_from_email, + 'from_name' => $config_mail_from_name, + 'recipient' => $session_email, + 'recipient_name' => $session_name, + 'subject' => $subject, + 'body' => $body + ] + ]; + $mail = addToMailQueue($data); + } + + // Logging + logAction("User Account", "Edit", "$session_name disabled MFA on their account"); + + $_SESSION['alert_type'] = "error"; + $_SESSION['alert_message'] = "Multi-Factor authentication disabled"; + + header("Location: " . $_SERVER["HTTP_REFERER"]); + +} + if (isset($_POST['enable_2fa']) || isset($_GET['enable_2fa_force'])) { // CSRF Check diff --git a/user_security.php b/user_security.php index 7c26d3c6..0dd10d84 100644 --- a/user_security.php +++ b/user_security.php @@ -31,65 +31,20 @@ $remember_token_count = mysqli_num_rows($sql_remember_tokens); - - - -
-
-

Mult-Factor Authentication

-
-
-
- +
- + + + + -

You have set up 2FA. Your QR code is below.

- + Disable Multi-Factor Authentication +
-
- "; - - echo "

$session_token

"; - - } - - ?> -
- - - -
- - -
-
-
-
- -
- -
- -
-
-
- -
-