]>
git.wh0rd.org - tt-rss.git/blob - plugins/auth_internal/init.php
2 class Auth_Internal
extends Plugin
implements IAuthModule
{
8 "Authenticates against internal tt-rss database",
13 /* @var PluginHost $host */
14 function init($host) {
16 $this->pdo
= Db
::pdo();
18 $host->add_hook($host::HOOK_AUTH_USER
, $this);
21 function authenticate($login, $password) {
23 $pwd_hash1 = encrypt_password($password);
24 $pwd_hash2 = encrypt_password($password, $login);
25 $otp = $_REQUEST["otp"];
27 if (get_schema_version() > 96) {
28 if (!defined('AUTH_DISABLE_OTP') ||
!AUTH_DISABLE_OTP
) {
30 $sth = $this->pdo
->prepare("SELECT otp_enabled,salt FROM ttrss_users WHERE
32 $sth->execute([$login]);
34 if ($row = $sth->fetch()) {
36 $base32 = new \OTPHP\
Base32();
38 $otp_enabled = $row['otp_enabled'];
39 $secret = $base32->encode(sha1($row['salt']));
41 $topt = new \OTPHP\
TOTP($secret);
42 $otp_check = $topt->now();
46 if ($otp != $otp_check) {
50 $return = urlencode($_REQUEST["return"]);
53 <title
>Tiny Tiny RSS
</title
>
54 <meta http
-equiv
="Content-Type" content
="text/html; charset=UTF-8" />
56 <?php
echo stylesheet_tag("css/default.css") ?
>
57 <body
class="ttrss_utility otp"><div
class="content">
58 <form action
="public.php?return=<?php echo $return ?>"
59 method
="POST" class="otpform">
60 <input type
="hidden" name
="op" value
="login">
61 <input type
="hidden" name
="login" value
="<?php echo htmlspecialchars($login) ?>">
62 <input type
="hidden" name
="password" value
="<?php echo htmlspecialchars($password) ?>">
63 <input type
="hidden" name
="bw_limit" value
="<?php echo htmlspecialchars($_POST["bw_limit
"]) ?>">
64 <input type
="hidden" name
="remember_me" value
="<?php echo htmlspecialchars($_POST["remember_me
"]) ?>">
65 <input type
="hidden" name
="profile" value
="<?php echo htmlspecialchars($_POST["profile
"]) ?>">
67 <label
><?php
echo __("Please enter your one time password:") ?
></label
>
68 <input autocomplete
="off" size
="6" name
="otp" value
=""/>
69 <input type
="submit" value
="Continue"/>
71 <script type
="text/javascript">
72 document
.forms
[0].otp
.focus();
82 if (get_schema_version() > 87) {
84 $sth = $this->pdo
->prepare("SELECT salt FROM ttrss_users WHERE login = ?");
85 $sth->execute([$login]);
87 if ($row = $sth->fetch()) {
92 $sth = $this->pdo
->prepare("SELECT id FROM ttrss_users WHERE
93 login = ? AND (pwd_hash = ? OR pwd_hash = ?)");
95 $sth->execute([$login, $pwd_hash1, $pwd_hash2]);
97 // verify and upgrade password to new salt base
99 if ($row = $sth->fetch()) {
100 // upgrade password to MODE2
102 $user_id = $row['id'];
104 $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
105 $pwd_hash = encrypt_password($password, $salt, true);
107 $sth = $this->pdo
->prepare("UPDATE ttrss_users SET
108 pwd_hash = ?, salt = ? WHERE login = ?");
110 $sth->execute([$pwd_hash, $salt, $login]);
119 $pwd_hash = encrypt_password($password, $salt, true);
121 $sth = $this->pdo
->prepare("SELECT id
122 FROM ttrss_users WHERE
123 login = ? AND pwd_hash = ?");
124 $sth->execute([$login, $pwd_hash]);
126 if ($row = $sth->fetch()) {
132 $sth = $this->pdo
->prepare("SELECT id
133 FROM ttrss_users WHERE
134 login = ? AND (pwd_hash = ? OR pwd_hash = ?)");
136 $sth->execute([$login, $pwd_hash1, $pwd_hash2]);
138 if ($row = $sth->fetch()) {
143 $sth = $this->pdo
->prepare("SELECT id
144 FROM ttrss_users WHERE
145 login = ? AND (pwd_hash = ? OR pwd_hash = ?)");
147 $sth->execute([$login, $pwd_hash1, $pwd_hash2]);
149 if ($row = $sth->fetch()) {
157 function check_password($owner_uid, $password) {
159 $sth = $this->pdo
->prepare("SELECT salt,login FROM ttrss_users WHERE
161 $sth->execute([$owner_uid]);
163 if ($row = $sth->fetch()) {
165 $salt = $row['salt'];
166 $login = $row['login'];
169 $password_hash1 = encrypt_password($password);
170 $password_hash2 = encrypt_password($password, $login);
172 $sth = $this->pdo
->prepare("SELECT id FROM ttrss_users WHERE
173 id = ? AND (pwd_hash = ? OR pwd_hash = ?)");
175 $sth->execute([$owner_uid, $password_hash1, $password_hash2]);
177 return $sth->fetch();
180 $password_hash = encrypt_password($password, $salt, true);
182 $sth = $this->pdo
->prepare("SELECT id FROM ttrss_users WHERE
183 id = ? AND pwd_hash = ?");
185 $sth->execute([$owner_uid, $password_hash]);
187 return $sth->fetch();
194 function change_password($owner_uid, $old_password, $new_password) {
196 if ($this->check_password($owner_uid, $old_password)) {
198 $new_salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
199 $new_password_hash = encrypt_password($new_password, $new_salt, true);
201 $sth = $this->pdo
->prepare("UPDATE ttrss_users SET
202 pwd_hash = ?, salt = ?, otp_enabled = false
204 $sth->execute([$new_password_hash, $new_salt, $owner_uid]);
206 $_SESSION["pwd_hash"] = $new_password_hash;
208 return __("Password has been changed.");
210 return "ERROR: ".__('Old password is incorrect.');
214 function api_version() {