From e247ad4ee4ba12bd460d6e70b7f8e36b729c3764 Mon Sep 17 00:00:00 2001 From: root Date: Sun, 16 Jun 2019 22:33:55 -0400 Subject: [PATCH] Implemented 2FA TOTP with Google Authenticator --- add_user_modal.php | 134 ++++++++++++++++++++-------------- base32static.php | 96 +++++++++++++++++++++++++ check_login.php | 1 + client_contacts.php | 11 ++- clients.php | 16 ++--- functions.php | 15 ++++ login.php | 48 ++++++++++--- pagination.php | 95 ++++++++++++------------ post.php | 27 +++++++ rfc6238.php | 171 ++++++++++++++++++++++++++++++++++++++++++++ settings-user.php | 58 +++++++++++++++ test.php | 16 +++++ top_nav.php | 1 + 13 files changed, 564 insertions(+), 125 deletions(-) create mode 100644 base32static.php create mode 100644 rfc6238.php create mode 100644 settings-user.php diff --git a/add_user_modal.php b/add_user_modal.php index b91e5034..be74f47e 100644 --- a/add_user_modal.php +++ b/add_user_modal.php @@ -8,65 +8,89 @@
-
- -
- -
-
- +
+ + + +
+ +
+ +
+ +
+ +
+
+ +
+ +
- + +
+ +
+
+ +
+ +
+
+ +
+ +
+
+ +
+ +
+
+
+ + +
+
+ +
+ +
+ +
+
+ +
+ +
+
+ +
+
-
- -
-
- -
- -
-
- -
- -
-
- -
- -
-
- -
- -
-
- -
- -
-
-
- - -
diff --git a/base32static.php b/base32static.php new file mode 100644 index 00000000..7813986a --- /dev/null +++ b/base32static.php @@ -0,0 +1,96 @@ +'0', 'B'=>'1', 'C'=>'2', 'D'=>'3', 'E'=>'4', 'F'=>'5', 'G'=>'6', 'H'=>'7', + 'I'=>'8', 'J'=>'9', 'K'=>'10', 'L'=>'11', 'M'=>'12', 'N'=>'13', 'O'=>'14', 'P'=>'15', + 'Q'=>'16', 'R'=>'17', 'S'=>'18', 'T'=>'19', 'U'=>'20', 'V'=>'21', 'W'=>'22', 'X'=>'23', + 'Y'=>'24', 'Z'=>'25', '2'=>'26', '3'=>'27', '4'=>'28', '5'=>'29', '6'=>'30', '7'=>'31' + ); + + /** + * Use padding false when encoding for urls + * + * @return base32 encoded string + * @author Bryan Ruiz + **/ + public static function encode($input, $padding = true) { + if(empty($input)) return ""; + + $input = str_split($input); + $binaryString = ""; + + for($i = 0; $i < count($input); $i++) { + $binaryString .= str_pad(base_convert(ord($input[$i]), 10, 2), 8, '0', STR_PAD_LEFT); + } + + $fiveBitBinaryArray = str_split($binaryString, 5); + $base32 = ""; + $i=0; + + while($i < count($fiveBitBinaryArray)) { + $base32 .= self::$map[base_convert(str_pad($fiveBitBinaryArray[$i], 5,'0'), 2, 10)]; + $i++; + } + + if($padding && ($x = strlen($binaryString) % 40) != 0) { + if($x == 8) $base32 .= str_repeat(self::$map[32], 6); + else if($x == 16) $base32 .= str_repeat(self::$map[32], 4); + else if($x == 24) $base32 .= str_repeat(self::$map[32], 3); + else if($x == 32) $base32 .= self::$map[32]; + } + + return $base32; + } + + public static function decode($input) { + if(empty($input)) return; + + $paddingCharCount = substr_count($input, self::$map[32]); + $allowedValues = array(6,4,3,1,0); + + if(!in_array($paddingCharCount, $allowedValues)) return false; + + for($i=0; $i<4; $i++){ + if($paddingCharCount == $allowedValues[$i] && + substr($input, -($allowedValues[$i])) != str_repeat(self::$map[32], $allowedValues[$i])) return false; + } + + $input = str_replace('=','', $input); + $input = str_split($input); + $binaryString = ""; + + for($i=0; $i < count($input); $i = $i+8) { + $x = ""; + + if(!in_array($input[$i], self::$map)) return false; + + for($j=0; $j < 8; $j++) { + $x .= str_pad(base_convert(@self::$flippedMap[@$input[$i + $j]], 10, 2), 5, '0', STR_PAD_LEFT); + } + + $eightBits = str_split($x, 8); + + for($z = 0; $z < count($eightBits); $z++) { + $binaryString .= ( ($y = chr(base_convert($eightBits[$z], 2, 10))) || ord($y) == 48 ) ? $y:""; + } + } + + return $binaryString; + } +} \ No newline at end of file diff --git a/check_login.php b/check_login.php index 981ae31e..02bbe753 100644 --- a/check_login.php +++ b/check_login.php @@ -20,6 +20,7 @@ $session_name = $row['name']; $session_avatar = $row['avatar']; $session_client_id = $row['client_id']; + $session_token = $row['token']; //Detects if using an apple device and uses apple maps instead of google $iPod = stripos($_SERVER['HTTP_USER_AGENT'],"iPod"); diff --git a/client_contacts.php b/client_contacts.php index 0debe121..3a2efc85 100644 --- a/client_contacts.php +++ b/client_contacts.php @@ -6,11 +6,11 @@ $url_query_strings_sb = http_build_query(array_merge($_GET,array('sb' => $sb, 'o if(isset($_GET['p'])){ $p = intval($_GET['p']); - $record_from = (($p)-1)*10; - $record_to = 10; + $record_from = (($p)-1)*6; + $record_to = 6; }else{ $record_from = 0; - $record_to = 10; + $record_to = 6; $p = 1; } @@ -39,12 +39,9 @@ if(isset($_GET['o'])){ $disp = "DESC"; } - -$sql = mysqli_query($mysqli,"SELECT SQL_CALC_FOUND_ROWS * FROM contacts WHERE client_id = $client_id AND (contact_name LIKE '%$q%') ORDER BY $sb $o LIMIT $record_from, $record_to"); +$sql = mysqli_query($mysqli,"SELECT SQL_CALC_FOUND_ROWS * FROM contacts WHERE client_id = $client_id AND (contact_name LIKE '%$q%') ORDER BY $sb $o LIMIT $record_from, $record_to"); $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()")); -$total_found_rows = $num_rows[0]; -$total_pages = ceil($total_found_rows / 10); ?> diff --git a/clients.php b/clients.php index f05751fd..79a83225 100644 --- a/clients.php +++ b/clients.php @@ -42,8 +42,6 @@ if(isset($_GET['o'])){ $sql = mysqli_query($mysqli,"SELECT SQL_CALC_FOUND_ROWS * FROM clients WHERE client_name LIKE '%$q%' OR client_email LIKE '%$q%' ORDER BY $sb $o LIMIT $record_from, $record_to"); $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()")); -$total_found_rows = $num_rows[0]; -$total_pages = ceil($total_found_rows / 10); ?> @@ -51,7 +49,7 @@ $total_pages = ceil($total_found_rows / 10);
Clients
- +
@@ -68,12 +66,12 @@ $total_pages = ceil($total_found_rows / 10); - - - - - - + + + + + + diff --git a/functions.php b/functions.php index a82c8ede..a58cfae3 100644 --- a/functions.php +++ b/functions.php @@ -16,6 +16,21 @@ function keygen() return $key; } +function key32gen() +{ + $chars .= "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; + $chars .= "234567"; + while (1) { + $key = ''; + srand((double) microtime() * 1000000); + for ($i = 0; $i < 32; $i++) { + $key .= substr($chars, (rand() % (strlen($chars))), 1); + } + break; + } + return $key; +} + function initials($str) { $ret = ''; foreach (explode(' ', $str) as $word) diff --git a/login.php b/login.php index 2d3b7618..d74b861b 100644 --- a/login.php +++ b/login.php @@ -8,22 +8,48 @@ if(isset($_POST['login'])){ $email = mysqli_real_escape_string($mysqli,$_POST['email']); $password = md5(mysqli_real_escape_string($mysqli,$_POST['password'])); + $current_code = $_POST['current_code']; $sql = mysqli_query($mysqli,"SELECT * FROM users WHERE email = '$email' AND password = '$password'"); if(mysqli_num_rows($sql) == 1){ $row = mysqli_fetch_array($sql); - $_SESSION['logged'] = TRUE; - $_SESSION['user_id'] = $row['user_id']; - $_SESSION['name'] = $row['name']; - $_SESSION['client_id'] = $row['client_id']; - $client_id = $row['client_id']; + $token = $row['token']; + + if(empty($token)){ + $_SESSION['logged'] = TRUE; + $_SESSION['user_id'] = $row['user_id']; + $_SESSION['name'] = $row['name']; + $_SESSION['client_id'] = $row['client_id']; + $client_id = $row['client_id']; + - if($client_id > 0){ - header("Location: client.php?client_id=$client_id"); + if($client_id > 0){ + header("Location: client.php?client_id=$client_id"); + }else{ + header("Location: $config_start_page"); + } + }else{ - header("Location: $config_start_page"); + require_once("rfc6238.php"); + + if(TokenAuth6238::verify($token,$current_code)){ + $_SESSION['logged'] = TRUE; + $_SESSION['user_id'] = $row['user_id']; + $_SESSION['name'] = $row['name']; + $_SESSION['client_id'] = $row['client_id']; + $client_id = $row['client_id']; + header("Location: $config_start_page"); + }else{ + $response = " +
+ Invalid Code. + +
+ "; + } } + }else{ $response = "
@@ -79,6 +105,12 @@ if(isset($_POST['login'])){
+
+
+ + +
+
diff --git a/pagination.php b/pagination.php index 3aa491dd..bd808d14 100644 --- a/pagination.php +++ b/pagination.php @@ -1,59 +1,62 @@ - 10) { ?> -
    +
      - 100)){ - $pages_split = 100; - } - if(($total_pages <= 10000) AND ($total_pages > 1000)){ - $pages_split = 1000; - } - if($p > 1){ - $prev_class = ""; - }else{ - $prev_class = "disabled"; - } - if($p <> $total_pages) { - $next_class = ""; - }else{ - $next_class = "disabled"; - } - $url_query_strings = http_build_query(array_merge($_GET,array('p' => $i))); - $prev_page = $p - 1; - $next_page = $p + 1; - - if($p > 1){ - echo "
    • Prev
      • "; - } - - while($i < $total_pages){ - $i++; - if(($i == 1) OR (($p <= 3) AND ($i <= 6)) OR (($i > $total_pages - 6) AND ($p > $total_pages - 3 )) OR (is_int($i / $pages_split)) OR (($p > 3) AND ($i >= $p - 2) AND ($i <= $p + 3)) OR ($i == $total_pages)){ - if($p == $i ) { - $page_class = "active"; - }else{ - $page_class = ""; - } - echo "
    • $i
      • "; + 100)){ + $pages_split = 100; + } + if(($total_pages <= 10000) AND ($total_pages > 1000)){ + $pages_split = 1000; + } + if($p > 1){ + $prev_class = ""; + }else{ + $prev_class = "disabled"; + } + if($p <> $total_pages) { + $next_class = ""; + }else{ + $next_class = "disabled"; + } + $url_query_strings = http_build_query(array_merge($_GET,array('p' => $i))); + $prev_page = $p - 1; + $next_page = $p + 1; + + if($p > 1){ + echo "
    • Prev
      • "; + } + + while($i < $total_pages){ + $i++; + if(($i == 1) OR (($p <= 3) AND ($i <= 6)) OR (($i > $total_pages - 6) AND ($p > $total_pages - 3 )) OR (is_int($i / $pages_split)) OR (($p > 3) AND ($i >= $p - 2) AND ($i <= $p + 3)) OR ($i == $total_pages)){ + if($p == $i ) { + $page_class = "active"; + }else{ + $page_class = ""; + } + echo "
    • $i
      • "; + } } - } - if($p <> $total_pages){ - echo "
    • Next
      • "; - } + if($p <> $total_pages){ + echo "
    • Next
      • "; + } -?> + ?> -
    +
SecretKey: $secretkey
"; + + $key = base32static::decode($secretkey); + print "Key(base 32 decode): $key
"; + + $unixtimestamp = time()/30; + print "UnixTimeStamp (time()/30): $unixtimestamp
"; + for($i=-($rangein30s); $i<=$rangein30s; $i++) { + $checktime = (int)($unixtimestamp+$i); + print "Calculating oath_hotp from (int)(unixtimestamp +- 30sec offset): $checktime basing on secret key
"; + + $thiskey = self::oath_hotp($key, $checktime, true); + print "======================================================
"; + print "CheckTime: $checktime oath_hotp:".$thiskey."
"; + $result = $result." # ".self::oath_truncate($thiskey,6,true); + } + + return $result; + } + + public static function getBarCodeUrl($username, $domain, $secretkey, $issuer) { + $url = "http://chart.apis.google.com/chart"; + $url = $url."?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/"; + $url = $url.$username . "@" . $domain . "%3Fsecret%3D" . $secretkey . '%26issuer%3D' . rawurlencode($issuer); + + return $url; + } + public static function generateRandomClue($length = 16) { + $b32 = "234567QWERTYUIOPASDFGHJKLZXCVBNM"; + $s = ""; + for ($i = 0; $i < $length; $i++) + $s .= $b32[rand(0,31)]; + return $s; + } + + private static function hotp_tobytestream($key) { + $result = array(); + $last = strlen($key); + for ($i = 0; $i < $last; $i = $i + 2) { + $x = $key[$i] + $key[$i + 1]; + $x = strtoupper($x); + $x = hexdec($x); + $result = $result.chr($x); + } + + return $result; + } + private static function oath_hotp ($key, $counter, $debug=false) { + $result = ""; + $orgcounter = $counter; + $cur_counter = array(0,0,0,0,0,0,0,0); + + if ($debug) { + print "Packing counter $counter (".dechex($counter).")into binary string - pay attention to hex representation of key and binary representation
"; + } + + for($i=7;$i>=0;$i--) { // C for unsigned char, * for repeating to the end of the input data + $cur_counter[$i] = pack ('C*', $counter); + + if ($debug) { + print $cur_counter[$i]."(".dechex(ord($cur_counter[$i])).")"." from $counter
"; + } + + $counter = $counter >> 8; + } + + if ($debug) { + foreach ($cur_counter as $char) { + print ord($char) . " "; + } + + print "
"; + } + + $binary = implode($cur_counter); + // Pad to 8 characters + str_pad($binary, 8, chr(0), STR_PAD_LEFT); + + if ($debug) { + print "Prior to HMAC calculation pad with zero on the left until 8 characters.
"; + print "Calculate sha1 HMAC(Hash-based Message Authentication Code http://en.wikipedia.org/wiki/HMAC).
"; + print "hash_hmac ('sha1', $binary, $key)
"; + } + $result = hash_hmac ('sha1', $binary, $key); + + if ($debug) { + print "Result: $result
"; + } + return $result; + } + private static function oath_truncate($hash, $length = 6, $debug=false) { + $result=""; + + // Convert to dec + if($debug) { + print "converting hex hash into characters
"; + } + + $hashcharacters = str_split($hash,2); + + if($debug) { + print_r($hashcharacters); + print "
and convert to decimals:
"; + } + for ($j=0; $j"; + print "offset:".$offset; + } + + $result = ( + (($hmac_result[$offset+0] & 0x7f) << 24 ) | + (($hmac_result[$offset+1] & 0xff) << 16 ) | + (($hmac_result[$offset+2] & 0xff) << 8 ) | + ($hmac_result[$offset+3] & 0xff) + ) % pow(10,$length); + return $result; + } + + } \ No newline at end of file diff --git a/settings-user.php b/settings-user.php new file mode 100644 index 00000000..e92241ce --- /dev/null +++ b/settings-user.php @@ -0,0 +1,58 @@ + + +
+
+
User Settings
+
+
+
+ +
+ value="1" id="customSwitch1"> + +
+ + ',TokenAuth6238::getBarCodeUrl('','',$secretkey,'PittPC-CRM')); + + ?> + + +
+ + + + +
+ +
+
+ +
+
+ +
+ +
+
+
+ + + + + +
+
+ + \ No newline at end of file diff --git a/test.php b/test.php index abdd62a0..c18a37c4 100644 --- a/test.php +++ b/test.php @@ -22,6 +22,22 @@

User Agent:

This is a great starting point for new custom pages.

+',TokenAuth6238::getBarCodeUrl('','',$secretkey,'My%20App')); + print TokenAuth6238::getTokenCodeDebug($secretkey,0); + + +?> +

diff --git a/top_nav.php b/top_nav.php index 86ec46d8..5180703a 100644 --- a/top_nav.php +++ b/top_nav.php @@ -41,6 +41,7 @@
" class="img-fluid rounded-circle">
+ Settings
Logout
Name ">Type EmailPhoneBalanceActionName ">Type EmailPhoneBalanceAction