]>
git.wh0rd.org - tt-rss.git/blob - plugins/auth_internal/init.php
2 class Auth_Internal
extends Plugin
implements IAuthModule
{
8 "Authenticates against internal tt-rss database",
13 /* @var PluginHost $host */
14 function init($host) {
16 $this->pdo
= Db
::pdo();
18 $host->add_hook($host::HOOK_AUTH_USER
, $this);
21 function authenticate($login, $password) {
23 $pwd_hash1 = encrypt_password($password);
24 $pwd_hash2 = encrypt_password($password, $login);
25 $otp = $_REQUEST["otp"];
27 if (get_schema_version() > 96) {
28 if (!defined('AUTH_DISABLE_OTP') ||
!AUTH_DISABLE_OTP
) {
30 $sth = $this->pdo
->prepare("SELECT otp_enabled,salt FROM ttrss_users WHERE
32 $sth->execute([$login]);
34 if ($row = $sth->fetch()) {
36 require_once "lib/otphp/vendor/base32.php";
37 require_once "lib/otphp/lib/otp.php";
38 require_once "lib/otphp/lib/totp.php";
40 $base32 = new Base32();
42 $otp_enabled = $row['otp_enabled'];
43 $secret = $base32->encode(sha1($row['salt']));
45 $topt = new \OTPHP\
TOTP($secret);
46 $otp_check = $topt->now();
50 if ($otp != $otp_check) {
54 $return = urlencode($_REQUEST["return"]);
56 <head
><title
>Tiny Tiny RSS
</title
></head
>
57 <?php
echo stylesheet_tag("css/utility.css") ?
>
58 <body
class="otp"><div
class="content">
59 <form action
="public.php?return=<?php echo $return ?>"
60 method
="POST" class="otpform">
61 <input type
="hidden" name
="op" value
="login">
62 <input type
="hidden" name
="login" value
="<?php echo htmlspecialchars($login) ?>">
63 <input type
="hidden" name
="password" value
="<?php echo htmlspecialchars($password) ?>">
64 <input type
="hidden" name
="bw_limit" value
="<?php echo htmlspecialchars($_POST["bw_limit
"]) ?>">
65 <input type
="hidden" name
="remember_me" value
="<?php echo htmlspecialchars($_POST["remember_me
"]) ?>">
66 <input type
="hidden" name
="profile" value
="<?php echo htmlspecialchars($_POST["profile
"]) ?>">
68 <label
><?php
echo __("Please enter your one time password:") ?
></label
>
69 <input autocomplete
="off" size
="6" name
="otp" value
=""/>
70 <input type
="submit" value
="Continue"/>
72 <script type
="text/javascript">
73 document
.forms
[0].otp
.focus();
83 if (get_schema_version() > 87) {
85 $sth = $this->pdo
->prepare("SELECT salt FROM ttrss_users WHERE login = ?");
86 $sth->execute([$login]);
88 if ($row = $sth->fetch()) {
93 $sth = $this->pdo
->prepare("SELECT id FROM ttrss_users WHERE
94 login = ? AND (pwd_hash = ? OR pwd_hash = ?)");
96 $sth->execute([$login, $pwd_hash1, $pwd_hash2]);
98 // verify and upgrade password to new salt base
100 if ($row = $sth->fetch()) {
101 // upgrade password to MODE2
103 $user_id = $row['id'];
105 $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
106 $pwd_hash = encrypt_password($password, $salt, true);
108 $sth = $this->pdo
->prepare("UPDATE ttrss_users SET
109 pwd_hash = ?, salt = ? WHERE login = ?");
111 $sth->execute([$pwd_hash, $salt, $login]);
120 $pwd_hash = encrypt_password($password, $salt, true);
122 $sth = $this->pdo
->prepare("SELECT id
123 FROM ttrss_users WHERE
124 login = ? AND pwd_hash = ?");
125 $sth->execute([$login, $pwd_hash]);
127 if ($row = $sth->fetch()) {
133 $sth = $this->pdo
->prepare("SELECT id
134 FROM ttrss_users WHERE
135 login = ? AND (pwd_hash = ? OR pwd_hash = ?)");
137 $sth->execute([$login, $pwd_hash1, $pwd_hash2]);
139 if ($row = $sth->fetch()) {
144 $sth = $this->pdo
->prepare("SELECT id
145 FROM ttrss_users WHERE
146 login = ? AND (pwd_hash = ? OR pwd_hash = ?)");
148 $sth->execute([$login, $pwd_hash1, $pwd_hash2]);
150 if ($row = $sth->fetch()) {
158 function check_password($owner_uid, $password) {
160 $sth = $this->pdo
->prepare("SELECT salt,login FROM ttrss_users WHERE
162 $sth->execute([$owner_uid]);
164 if ($row = $sth->fetch()) {
166 $salt = $row['salt'];
167 $login = $row['login'];
170 $password_hash1 = encrypt_password($password);
171 $password_hash2 = encrypt_password($password, $login);
173 $sth = $this->pdo
->prepare("SELECT id FROM ttrss_users WHERE
174 id = ? AND (pwd_hash = ? OR pwd_hash = ?)");
176 $sth->execute([$owner_uid, $password_hash1, $password_hash2]);
178 return $sth->fetch();
181 $password_hash = encrypt_password($password, $salt, true);
183 $sth = $this->pdo
->prepare("SELECT id FROM ttrss_users WHERE
184 id = ? AND pwd_hash = ?");
186 $sth->execute([$owner_uid, $password_hash]);
188 return $sth->fetch();
195 function change_password($owner_uid, $old_password, $new_password) {
197 if ($this->check_password($owner_uid, $old_password)) {
199 $new_salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
200 $new_password_hash = encrypt_password($new_password, $new_salt, true);
202 $sth = $this->pdo
->prepare("UPDATE ttrss_users SET
203 pwd_hash = ?, salt = ?, otp_enabled = false
205 $sth->execute([$new_password_hash, $new_salt, $owner_uid]);
207 $_SESSION["pwd_hash"] = $new_password_hash;
209 return __("Password has been changed.");
211 return "ERROR: ".__('Old password is incorrect.');
215 function api_version() {