public/mailcow-dockerized
1
0
Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2025-12-13 09:56:01 +00:00
Code Issues Releases Wiki Activity

[Web] Separate FIDO2 logins

Browse Source
This commit is contained in:
FreddleSpl0it
2025-03-07 13:12:48 +01:00
parent 6f9c8deab7
commit bc21e7fe50
6 changed files with 107 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
data/web/json_api.php
View File

@@ -334,81 +334,6 @@ if (isset($_GET['query'])) {
exit();
}
break;
case "process":
// only allow POST requests to process API endpoints
if ($_SERVER['REQUEST_METHOD'] != 'POST') {
http_response_code(405);
echo json_encode(array(
'type' => 'error',
'msg' => 'only POST method is allowed'
));
exit();
}
switch ($category) {
case "fido2-args":
header('Content-Type: application/json');
$post = trim(file_get_contents('php://input'));
if ($post) {
$post = json_decode($post);
}
$clientDataJSON = base64_decode($post->clientDataJSON);
$authenticatorData = base64_decode($post->authenticatorData);
$signature = base64_decode($post->signature);
$id = base64_decode($post->id);
$challenge = $_SESSION['challenge'];
$process_fido2 = fido2(array("action" => "get_by_b64cid", "cid" => $post->id));
if ($process_fido2['pub_key'] === false) {
$return = new stdClass();
$return->success = false;
echo json_encode($return);
exit;
}
try {
$WebAuthn->processGet($clientDataJSON, $authenticatorData, $signature, $process_fido2['pub_key'], $challenge, null, $GLOBALS['FIDO2_UV_FLAG_LOGIN'], $GLOBALS['FIDO2_USER_PRESENT_FLAG']);
}
catch (Throwable $ex) {
unset($process_fido2);
$return = new stdClass();
$return->success = false;
echo json_encode($return);
exit;
}
$return = new stdClass();
$return->success = true;
$stmt = $pdo->prepare("SELECT `superadmin` FROM `admin` WHERE `username` = :username");
$stmt->execute(array(':username' => $process_fido2['username']));
$obj_props = $stmt->fetch(PDO::FETCH_ASSOC);
if ($obj_props['superadmin'] === 1) {
$_SESSION["mailcow_cc_role"] = "admin";
}
elseif ($obj_props['superadmin'] === 0) {
$_SESSION["mailcow_cc_role"] = "domainadmin";
}
else {
$stmt = $pdo->prepare("SELECT `username` FROM `mailbox` WHERE `username` = :username");
$stmt->execute(array(':username' => $process_fido2['username']));
$row = $stmt->fetch(PDO::FETCH_ASSOC);
if ($row['username'] == $process_fido2['username']) {
$_SESSION["mailcow_cc_role"] = "user";
}
}
if (empty($_SESSION["mailcow_cc_role"])) {
session_unset();
session_destroy();
exit;
}
$_SESSION["mailcow_cc_username"] = $process_fido2['username'];
$_SESSION["fido2_cid"] = $process_fido2['cid'];
unset($_SESSION["challenge"]);
$_SESSION['return'][] = array(
'type' => 'success',
'log' => array("fido2_login"),
'msg' => array('logged_in_as', $process_fido2['username'])
);
echo json_encode($return);
break;
}
break;
case "get":
function process_get_return($data, $object = true) {
if ($object === true) {