'; $ret .= ''; if ($form_tags) { $ret .= ''; } return $ret; } /** * Authenticate with two factor * Will set $twofactorform if the token hasn't been requested yet (page will redirect to the logon page) * * @return bool returns false if the form is not needed * @throws AuthenticationException */ public static function showForm() { global $twofactorform; $twofactor = get_user_pref('twofactor'); // no need to show the form, user doesn't have a token if (empty($twofactor)) { $_SESSION['twofactor'] = true; return false; } // lockout the user if there are too many failures if ($twofactor['fails'] >= 3) { if (!Config::get('twofactor_lock')) { throw new AuthenticationException('Too many two-factor failures, please contact administrator.'); } elseif ((time() - $twofactor['last']) < Config::get('twofactor_lock')) { $msg = "Too many two-factor failures, please wait " . Config::get('twofactor_lock') . " seconds"; throw new AuthenticationException($msg); } } // set $twofactorform to show the form in logon.inc.php $twofactorform = true; return true; } /** * Check a 2fa token this will be stored in $_POST['twofactor'] by the form * If valid, $_SESSION['twofactor'] = true will be set and this will return true * * @param string $token The 2fa token, stored in $_POST['twofactor'] by the form * @return bool If the token was valid * @throws AuthenticationException Thrown if the token was invalid */ public static function authenticate($token) { if (!$token) { throw new AuthenticationException("No Two-Factor Token entered."); } $twofactor = get_user_pref('twofactor'); if (empty($twofactor)) { throw new AuthenticationException('No Two-Factor settings, how did you get here?'); } if (($server_c = self::verifyHOTP($twofactor['key'], $_POST['twofactor'], $twofactor['counter'])) === false) { $twofactor['fails']++; $twofactor['last'] = time(); set_user_pref('twofactor', $twofactor); throw new AuthenticationException("Wrong Two-Factor Token."); } if ($twofactor['counter'] !== false) { if ($server_c !== true && $server_c !== $twofactor['counter']) { $twofactor['counter'] = $server_c + 1; } else { $twofactor['counter']++; } } $twofactor['fails'] = 0; set_user_pref('twofactor', $twofactor); $_SESSION['twofactor'] = true; return true; } /** * Verify HOTP token honouring window * * @param string $key Secret Key * @param int $otp OTP supplied by user * @param int|boolean $counter Counter, if false timestamp is used * @return boolean|int */ public static function verifyHOTP($key, $otp, $counter = false) { if (self::oathHOTP($key, $counter) == $otp) { return true; } else { if ($counter === false) { //TimeBased HOTP requires lookbehind and lookahead. $counter = floor(microtime(true) / self::KEY_INTERVAL); $initcount = $counter - ((self::OTP_WINDOW + 1) * self::KEY_INTERVAL); $endcount = $counter + (self::OTP_WINDOW * self::KEY_INTERVAL); $totp = true; } else { //Counter based HOTP only has lookahead, not lookbehind. $initcount = $counter - 1; $endcount = $counter + self::OTP_WINDOW; $totp = false; } while (++$initcount <= $endcount) { if (self::oathHOTP($key, $initcount) == $otp) { if (!$totp) { return $initcount; } else { return true; } } } } return false; } /** * Generate HOTP (RFC 4226) * @param string $key Secret Key * @param int|boolean $counter Optional Counter, Defaults to Timestamp * @return int */ private static function oathHOTP($key, $counter = false) { if ($counter === false) { $counter = floor(microtime(true) / self::KEY_INTERVAL); } $length = strlen($key); $x = -1; $y = $z = 0; $kbin = ""; while (++$x < $length) { $y <<= 5; $y += self::$base32[$key[$x]]; $z += 5; if ($z >= 8) { $z -= 8; $kbin .= chr(($y & (0xFF << $z)) >> $z); } } $hash = hash_hmac('sha1', pack('N*', 0) . pack('N*', $counter), $kbin, true); $offset = ord($hash[19]) & 0xf; $truncated = (((ord($hash[$offset + 0]) & 0x7f) << 24) | ((ord($hash[$offset + 1]) & 0xff) << 16) | ((ord($hash[$offset + 2]) & 0xff) << 8) | (ord($hash[$offset + 3]) & 0xff)) % pow(10, self::OTP_SIZE); return str_pad($truncated, self::OTP_SIZE, '0', STR_PAD_LEFT); } }