classes/auth/internal.php

   1 <?php
   2 class Auth_Internal extends Auth_Base {
   3
   4         function authenticate($login, $password) {
   5
   6                 $pwd_hash1 = encrypt_password($password);
   7                 $pwd_hash2 = encrypt_password($password, $login);
   8                 $login = db_escape_string($login);
   9                 $otp = db_escape_string($_REQUEST["otp"]);
  10
  11                 if (get_schema_version($this->link) > 96) {
  12                         if (!defined('AUTH_DISABLE_OTP') || !AUTH_DISABLE_OTP) {
  13                                 $result = db_query($this->link, "SELECT otp_enabled,salt FROM ttrss_users WHERE
  14                                         login = '$login'");
  15
  16                                 if (db_num_rows($result) > 0) {
  17                                         require_once "lib/otphp/vendor/base32.php";
  18                                         require_once "lib/otphp/lib/otp.php";
  19                                         require_once "lib/otphp/lib/totp.php";
  20
  21                                         $base32 = new Base32();
  22
  23                                         $otp_enabled = sql_bool_to_bool(db_fetch_result($result, 0, "otp_enabled"));
  24                                         $secret = $base32->encode(sha1(db_fetch_result($result, 0, "salt")));
  25
  26                                         $topt = new \OTPHP\TOTP($secret);
  27                                         $otp_check = $topt->now();
  28
  29                                         if ($otp_enabled) {
  30                                                 if ($otp) {
  31                                                         if ($otp != $otp_check) {
  32                                                                 return false;
  33                                                         }
  34                                                 } else {
  35                                                         ?><html>
  36                                                                 <head><title>Tiny Tiny RSS</title></head>
  37                                                         <body>
  38                                                         <form method="POST">
  39                                                                 <input type="hidden" name="login_action" value="do_login">
  40                                                                 <input type="hidden" name="login" value="<?php echo htmlspecialchars($login) ?>">
  41                                                                 <input type="hidden" name="password" value="<?php echo htmlspecialchars($password) ?>">
  42
  43                                                                 <label><?php echo __("Please enter your one time password:") ?></label>
  44                                                                 <input type="password" size="6" name="otp"/>
  45                                                                 <input type="submit" value="Continue"/>
  46                                                         </form>
  47                                                         <script type="text/javascript">
  48                                                                 document.forms[0].otp.focus();
  49                                                         </script>
  50                                                         <?php
  51                                                         exit;
  52                                                 }
  53                                         }
  54                                 }
  55                         }
  56                 }
  57
  58                 if (get_schema_version($this->link) > 87) {
  59
  60                         $result = db_query($this->link, "SELECT salt FROM ttrss_users WHERE
  61                                 login = '$login'");
  62
  63                         if (db_num_rows($result) != 1) {
  64                                 return false;
  65                         }
  66
  67                         $salt = db_fetch_result($result, 0, "salt");
  68
  69                         if ($salt == "") {
  70
  71                                 $query = "SELECT id
  72                     FROM ttrss_users WHERE
  73                                         login = '$login' AND (pwd_hash = '$pwd_hash1' OR
  74                                         pwd_hash = '$pwd_hash2')";
  75
  76                                 // verify and upgrade password to new salt base
  77
  78                                 $result = db_query($this->link, $query);
  79
  80                                 if (db_num_rows($result) == 1) {
  81                                         // upgrade password to MODE2
  82
  83                                         $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
  84                                         $pwd_hash = encrypt_password($password, $salt, true);
  85
  86                                         db_query($this->link, "UPDATE ttrss_users SET
  87                                                 pwd_hash = '$pwd_hash', salt = '$salt' WHERE login = '$login'");
  88
  89                                         $query = "SELECT id
  90                             FROM ttrss_users WHERE
  91                                                 login = '$login' AND pwd_hash = '$pwd_hash'";
  92
  93                                 } else {
  94                                         return false;
  95                                 }
  96
  97                         } else {
  98
  99                                 $pwd_hash = encrypt_password($password, $salt, true);
 100
 101                                 $query = "SELECT id
 102                          FROM ttrss_users WHERE
 103                                         login = '$login' AND pwd_hash = '$pwd_hash'";
 104
 105                         }
 106
 107                 } else {
 108                         $query = "SELECT id
 109                  FROM ttrss_users WHERE
 110                                 login = '$login' AND (pwd_hash = '$pwd_hash1' OR
 111                                         pwd_hash = '$pwd_hash2')";
 112                 }
 113
 114                 $result = db_query($this->link, $query);
 115
 116                 if (db_num_rows($result) == 1) {
 117                         return db_fetch_result($result, 0, "id");
 118                 }
 119
 120                 return false;
 121         }
 122
 123         function check_password($owner_uid, $password) {
 124                 $owner_uid = db_escape_string($owner_uid);
 125
 126                 $result = db_query($this->link, "SELECT salt,login FROM ttrss_users WHERE
 127                         id = '$owner_uid'");
 128
 129                 $salt = db_fetch_result($result, 0, "salt");
 130                 $login = db_fetch_result($result, 0, "login");
 131
 132                 if (!$salt) {
 133                         $password_hash1 = encrypt_password($password);
 134                         $password_hash2 = encrypt_password($password, $login);
 135
 136                         $query = "SELECT id FROM ttrss_users WHERE
 137                                 id = '$owner_uid' AND (pwd_hash = '$password_hash1' OR
 138                                 pwd_hash = '$password_hash2')";
 139
 140                 } else {
 141                         $password_hash = encrypt_password($password, $salt, true);
 142
 143                         $query = "SELECT id FROM ttrss_users WHERE
 144                                 id = '$owner_uid' AND pwd_hash = '$password_hash'";
 145                 }
 146
 147                 $result = db_query($this->link, $query);
 148
 149                 return db_num_rows($result) != 0;
 150         }
 151
 152         function change_password($owner_uid, $old_password, $new_password) {
 153                 $owner_uid = db_escape_string($owner_uid);
 154
 155                 if ($this->check_password($owner_uid, $old_password)) {
 156
 157                         $new_salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
 158                         $new_password_hash = encrypt_password($new_password, $new_salt, true);
 159
 160                         db_query($this->link, "UPDATE ttrss_users SET
 161                                 pwd_hash = '$new_password_hash', salt = '$new_salt', otp_enabled = false
 162                                         WHERE id = '$owner_uid'");
 163
 164                         $_SESSION["pwd_hash"] = $new_password_hash;
 165
 166                         return __("Password has been changed.");
 167                 } else {
 168                         return "ERROR: ".__('Old password is incorrect.');
 169                 }
 170         }
 171 }
 172 ?>