classes/auth/internal.php

   1 <?php
   2 class Auth_Internal extends Auth_Base {
   3
   4         function authenticate($login, $password) {
   5
   6                 $pwd_hash1 = encrypt_password($password);
   7                 $pwd_hash2 = encrypt_password($password, $login);
   8                 $login = db_escape_string($login);
   9                 $otp = db_escape_string($_REQUEST["otp"]);
  10
  11                 if (get_schema_version($this->link) > 96) {
  12                         $result = db_query($this->link, "SELECT otp_enabled,salt FROM ttrss_users WHERE
  13                                 login = '$login'");
  14
  15                         require_once "lib/otphp/vendor/base32.php";
  16                         require_once "lib/otphp/lib/otp.php";
  17                         require_once "lib/otphp/lib/totp.php";
  18
  19                         $base32 = new Base32();
  20
  21                         $otp_enabled = sql_bool_to_bool(db_fetch_result($result, 0, "otp_enabled"));
  22                         $secret = $base32->encode(sha1(db_fetch_result($result, 0, "salt")));
  23
  24                         $topt = new \OTPHP\TOTP($secret);
  25                         $otp_check = $topt->now();
  26
  27                         if ($otp_enabled) {
  28                                 if ($otp) {
  29                                         if ($otp != $otp_check) {
  30                                                 return false;
  31                                         }
  32                                 } else {
  33                                         ?><html>
  34                                                 <head><title>Tiny Tiny RSS</title></head>
  35                                         <body>
  36                                         <form method="POST">
  37                                                 <input type="hidden" name="login_action" value="do_login">
  38                                                 <input type="hidden" name="login" value="<?php echo htmlspecialchars($login) ?>">
  39                                                 <input type="hidden" name="password" value="<?php echo htmlspecialchars($password) ?>">
  40
  41                                                 <label><?php echo __("Please enter your one time password:") ?></label>
  42                                                 <input type="password" size="6" name="otp"/>
  43                                                 <input type="submit" value="Continue"/>
  44                                         </form>
  45                                         </form>
  46                                         <?php
  47                                         exit;
  48                                 }
  49                         }
  50                 }
  51
  52                 if (get_schema_version($this->link) > 87) {
  53
  54                         $result = db_query($this->link, "SELECT salt FROM ttrss_users WHERE
  55                                 login = '$login'");
  56
  57                         if (db_num_rows($result) != 1) {
  58                                 return false;
  59                         }
  60
  61                         $salt = db_fetch_result($result, 0, "salt");
  62
  63                         if ($salt == "") {
  64
  65                                 $query = "SELECT id
  66                     FROM ttrss_users WHERE
  67                                         login = '$login' AND (pwd_hash = '$pwd_hash1' OR
  68                                         pwd_hash = '$pwd_hash2')";
  69
  70                                 // verify and upgrade password to new salt base
  71
  72                                 $result = db_query($this->link, $query);
  73
  74                                 if (db_num_rows($result) == 1) {
  75                                         // upgrade password to MODE2
  76
  77                                         $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
  78                                         $pwd_hash = encrypt_password($password, $salt, true);
  79
  80                                         db_query($this->link, "UPDATE ttrss_users SET
  81                                                 pwd_hash = '$pwd_hash', salt = '$salt' WHERE login = '$login'");
  82
  83                                         $query = "SELECT id
  84                             FROM ttrss_users WHERE
  85                                                 login = '$login' AND pwd_hash = '$pwd_hash'";
  86
  87                                 } else {
  88                                         return false;
  89                                 }
  90
  91                         } else {
  92
  93                                 $pwd_hash = encrypt_password($password, $salt, true);
  94
  95                                 $query = "SELECT id
  96                          FROM ttrss_users WHERE
  97                                         login = '$login' AND pwd_hash = '$pwd_hash'";
  98
  99                         }
 100
 101                 } else {
 102                         $query = "SELECT id
 103                  FROM ttrss_users WHERE
 104                                 login = '$login' AND (pwd_hash = '$pwd_hash1' OR
 105                                         pwd_hash = '$pwd_hash2')";
 106                 }
 107
 108                 $result = db_query($this->link, $query);
 109
 110                 if (db_num_rows($result) == 1) {
 111                         return db_fetch_result($result, 0, "id");
 112                 }
 113
 114                 return false;
 115         }
 116
 117         function change_password($owner_uid, $old_password, $new_password) {
 118                 $owner_uid = db_escape_string($owner_uid);
 119
 120                 $result = db_query($this->link, "SELECT salt,login FROM ttrss_users WHERE
 121                         id = '$owner_uid'");
 122
 123                 $salt = db_fetch_result($result, 0, "salt");
 124                 $login = db_fetch_result($result, 0, "login");
 125
 126                 if (!$salt) {
 127                         $old_password_hash1 = encrypt_password($old_password);
 128                         $old_password_hash2 = encrypt_password($old_password, $login);
 129
 130                         $query = "SELECT id FROM ttrss_users WHERE
 131                                 id = '$owner_uid' AND (pwd_hash = '$old_password_hash1' OR
 132                                 pwd_hash = '$old_password_hash2')";
 133
 134                 } else {
 135                         $old_password_hash = encrypt_password($old_password, $salt, true);
 136
 137                         $query = "SELECT id FROM ttrss_users WHERE
 138                                 id = '$owner_uid' AND pwd_hash = '$old_password_hash'";
 139                 }
 140
 141                 $result = db_query($this->link, $query);
 142
 143                 if (db_num_rows($result) == 1) {
 144
 145                         $new_salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
 146                         $new_password_hash = encrypt_password($new_password, $new_salt, true);
 147
 148                         db_query($this->link, "UPDATE ttrss_users SET
 149                                 pwd_hash = '$new_password_hash', salt = '$new_salt', otp_enabled = false
 150                                         WHERE id = '$owner_uid'");
 151
 152                         $_SESSION["pwd_hash"] = $new_password_hash;
 153
 154                         return __("Password has been changed.");
 155                 } else {
 156                         return "ERROR: ".__('Old password is incorrect.');
 157                 }
 158         }
 159 }
 160 ?>