public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-13 23:15:55 +00:00
Code Issues Releases Wiki Activity

require entering current one time code to enable otp

Browse Source
This commit is contained in:
Andrew Dolgov
2013-04-16 21:07:26 +04:00
parent 6f148528dc
commit 9deca86d96
1 changed files with 29 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
classes/pref/prefs.php
View File

@@ -416,11 +416,13 @@ class Pref_Prefs extends Handler_Protected {
print "<td class=\"prefValue\"><input dojoType=\"dijit.form.ValidationTextBox\" type=\"password\" required=\"1\" print "<td class=\"prefValue\"><input dojoType=\"dijit.form.ValidationTextBox\" type=\"password\" required=\"1\"
name=\"password\"></td></tr>"; name=\"password\"></td></tr>";
print "<tr><td colspan=\"2\">"; print "<tr><td width=\"40%\">".__("Enter the generated one time password")."</td>";
print "<input dojoType=\"dijit.form.CheckBox\" required=\"1\" print "<td class=\"prefValue\"><input dojoType=\"dijit.form.ValidationTextBox\" autocomplete=\"off\"
type=\"checkbox\" id=\"enable_otp\" name=\"enable_otp\"/> "; required=\"1\"
print "<label for=\"enable_otp\">".__("I have scanned the code and would like to enable OTP")."</label>"; name=\"otp\"></td></tr>";
print "<tr><td colspan=\"2\">";
print "</td></tr><tr><td colspan=\"2\">"; print "</td></tr><tr><td colspan=\"2\">";
@@ -957,19 +959,36 @@ class Pref_Prefs extends Handler_Protected {
} }
function otpenable() { function otpenable() {
$password = db_escape_string($this->link, $_REQUEST["password"]); require_once "lib/otphp/vendor/base32.php";
$enable_otp = $_REQUEST["enable_otp"] == "on"; require_once "lib/otphp/lib/otp.php";
require_once "lib/otphp/lib/totp.php";
$password = $_REQUEST["password"];
$otp = $_REQUEST["otp"];
global $pluginhost; global $pluginhost;
$authenticator = $pluginhost->get_plugin($_SESSION["auth_module"]); $authenticator = $pluginhost->get_plugin($_SESSION["auth_module"]);
if ($authenticator->check_password($_SESSION["uid"], $password)) { if ($authenticator->check_password($_SESSION["uid"], $password)) {
if ($enable_otp) { $result = db_query($this->link, "SELECT salt
FROM ttrss_users
WHERE id = ".$_SESSION["uid"]);
$base32 = new Base32();
$secret = $base32->encode(sha1(db_fetch_result($result, 0, "salt")));
$topt = new \OTPHP\TOTP($secret);
$otp_check = $topt->now();
if ($otp == $otp_check) {
db_query($this->link, "UPDATE ttrss_users SET otp_enabled = true WHERE db_query($this->link, "UPDATE ttrss_users SET otp_enabled = true WHERE
id = " . $_SESSION["uid"]); id = " . $_SESSION["uid"]);
print "OK"; print "OK";
} else {
print "ERROR:".__("Incorrect one time password");
} }
} else { } else {
print "ERROR:".__("Incorrect password"); print "ERROR:".__("Incorrect password");