implement one time passwords using TOTP

[tt-rss.git] / classes / auth / internal.php
diff --git a/classes/auth/internal.php b/classes/auth/internal.php

index 8890d445588cc15e80d7676f941ffaeeef1000a4..a4e8b471c33c6e7334be6cdfc7aa0c2904da24ec 100644 (file)
--- a/classes/auth/internal.php
+++ b/classes/auth/internal.php
@@ -6,6 +6,48 @@ class Auth_Internal extends Auth_Base {
                 $pwd_hash1 = encrypt_password($password);
                 $pwd_hash2 = encrypt_password($password, $login);
                 $login = db_escape_string($login);
+               $otp = db_escape_string($_REQUEST["otp"]);
+
+               if (get_schema_version($this->link) > 96) {
+                       $result = db_query($this->link, "SELECT otp_enabled,salt FROM ttrss_users WHERE
+                               login = '$login'");
+
+                       require_once "lib/otphp/vendor/base32.php";
+                       require_once "lib/otphp/lib/otp.php";
+                       require_once "lib/otphp/lib/totp.php";
+
+                       $base32 = new Base32();
+
+                       $otp_enabled = sql_bool_to_bool(db_fetch_result($result, 0, "otp_enabled"));
+                       $secret = $base32->encode(sha1(db_fetch_result($result, 0, "salt")));
+
+                       $topt = new \OTPHP\TOTP($secret);
+                       $otp_check = $topt->now();
+
+                       if ($otp_enabled) {
+                               if ($otp) {
+                                       if ($otp != $otp_check) {
+                                               return false;
+                                       }
+                               } else {
+                                       ?><html>
+                                               <head><title>Tiny Tiny RSS</title></head>
+                                       <body>
+                                       <form method="POST">
+                                               <input type="hidden" name="login_action" value="do_login">
+                                               <input type="hidden" name="login" value="<?php echo htmlspecialchars($login) ?>">
+                                               <input type="hidden" name="password" value="<?php echo htmlspecialchars($password) ?>">
+
+                                               <label><?php echo __("Please enter your one time password:") ?></label>
+                                               <input type="password" size="6" name="otp"/>
+                                               <input type="submit" value="Continue"/>
+                                       </form>
+                                       </form>
+                                       <?php
+                                       exit;
+                               }
+                       }
+               }
  
                 if (get_schema_version($this->link) > 87) {
  
@@ -104,7 +146,7 @@ class Auth_Internal extends Auth_Base {
                         $new_password_hash = encrypt_password($new_password, $new_salt, true);
  
                         db_query($this->link, "UPDATE ttrss_users SET
-                               pwd_hash = '$new_password_hash', salt = '$new_salt'
+                               pwd_hash = '$new_password_hash', salt = '$new_salt', otp_enabled = false
                                         WHERE id = '$owner_uid'");
  
                         $_SESSION["pwd_hash"] = $new_password_hash;