webinterface.git

modules/googleauth/include/googleauth.php   1) <?php
modules/googleauth/include/googleauth.php   2) /*
modules/googleauth/include/googleauth.php   3) This file belongs to the Webinterface of schokokeks.org Hosting
modules/googleauth/include/googleauth.php   4) 

modules/webmailtotp/include/totp.php        5) Written 2008-2018 by schokokeks.org Hosting, namely

modules/googleauth/include/googleauth.php   6)   Bernd Wurst <bernd@schokokeks.org>
modules/googleauth/include/googleauth.php   7)   Hanno Böck <hanno@schokokeks.org>
modules/googleauth/include/googleauth.php   8) 
modules/googleauth/include/googleauth.php   9) To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.
modules/googleauth/include/googleauth.php  10) 

modules/webmailtotp/include/totp.php       11) You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see

modules/googleauth/include/googleauth.php  12) http://creativecommons.org/publicdomain/zero/1.0/
modules/googleauth/include/googleauth.php  13) 
modules/googleauth/include/googleauth.php  14) Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.
modules/googleauth/include/googleauth.php  15) */
modules/googleauth/include/googleauth.php  16) 

modules/webmailtotp/include/totp.php       17) function account_has_totp($username)

modules/googleauth/include/googleauth.php  18) {

modules/webmailtotp/include/totp.php       19)     $result = db_query("SELECT id FROM mail.webmail_totp WHERE email=?", array($username));
modules/webmailtotp/include/totp.php       20)     if ($result->rowCount() > 0) {
modules/webmailtotp/include/totp.php       21)         $tmp = $result->fetch();
modules/webmailtotp/include/totp.php       22)         $id = $tmp['id'];
modules/webmailtotp/include/totp.php       23)         return $id;
modules/webmailtotp/include/totp.php       24)     } else {
modules/webmailtotp/include/totp.php       25)         return false;
modules/webmailtotp/include/totp.php       26)     }

modules/googleauth/include/googleauth.php  27) }
modules/googleauth/include/googleauth.php  28) 
modules/googleauth/include/googleauth.php  29) 
modules/googleauth/include/googleauth.php  30) 

modules/webmailtotp/include/totp.php       31) function validate_password($username, $password)

modules/googleauth/include/googleauth.php  32) {

modules/webmailtotp/include/totp.php       33)     $args[":username"] = $username;
modules/webmailtotp/include/totp.php       34)     $result = db_query("SELECT account, cryptpass FROM mail.courier_mailaccounts WHERE account=:username UNION SELECT account, cryptpass FROM mail.courier_virtual_accounts WHERE account=:username", $args);
modules/webmailtotp/include/totp.php       35)     if ($result->rowCount() != 1) {
modules/webmailtotp/include/totp.php       36)         // Kein Account mit dem Namen oder Name nicht eindeutig
modules/webmailtotp/include/totp.php       37)         return false;
modules/webmailtotp/include/totp.php       38)     }
modules/webmailtotp/include/totp.php       39)     $account = $result->fetch();
modules/webmailtotp/include/totp.php       40)     return (crypt($password, $account['cryptpass']) == $account['cryptpass']);

modules/googleauth/include/googleauth.php  41) }
modules/googleauth/include/googleauth.php  42) 
modules/googleauth/include/googleauth.php  43) 
modules/googleauth/include/googleauth.php  44) function store_webmail_password($username, $oldpw, $newpw)
modules/googleauth/include/googleauth.php  45) {

modules/webmailtotp/include/totp.php       46)     $secret = $newpw;
modules/webmailtotp/include/totp.php       47)     if (strlen($oldpw) > strlen($newpw)) {
modules/webmailtotp/include/totp.php       48)         $secret = str_pad($newpw, strlen($oldpw), $newpw);
modules/webmailtotp/include/totp.php       49)     }
modules/webmailtotp/include/totp.php       50)     if (strlen($oldpw) < strlen($newpw)) {
modules/webmailtotp/include/totp.php       51)         $newpw = substr($newpw, 0, strlen($oldpw));
modules/webmailtotp/include/totp.php       52)     }
modules/webmailtotp/include/totp.php       53)     if (strlen($oldpw) != strlen($secret)) {
modules/webmailtotp/include/totp.php       54)         system_failure('Interner Fehler: Passwörter sind nicht gleich lang');
modules/webmailtotp/include/totp.php       55)     }
modules/webmailtotp/include/totp.php       56)     $code = '';
modules/webmailtotp/include/totp.php       57)     for ($i = 0 ; $i != strlen($oldpw) ; $i++) {
modules/webmailtotp/include/totp.php       58)         $code .= chr(ord($oldpw[$i]) ^ ord($secret[$i]));
modules/webmailtotp/include/totp.php       59)     }
modules/webmailtotp/include/totp.php       60)     DEBUG(array($oldpw, $newpw));
modules/webmailtotp/include/totp.php       61)     $args = array(":uid" => $_SESSION['userinfo']['uid'],

modules/webmailtotp/include/totp.php       62)                 ":username" => $username,
modules/webmailtotp/include/totp.php       63)                 ":code" => base64_encode($code));

modules/googleauth/include/googleauth.php  64) 

modules/webmailtotp/include/totp.php       65)     db_query("REPLACE INTO mail.webmail_totp (useraccount, email, webmailpass) VALUES (:uid, :username, :code)", $args);

modules/googleauth/include/googleauth.php  66) }
modules/googleauth/include/googleauth.php  67) 
modules/googleauth/include/googleauth.php  68) 

modules/webmailtotp/include/totp.php       69) function decode_webmail_password($crypted, $webmailpw)

modules/googleauth/include/googleauth.php  70) {

modules/webmailtotp/include/totp.php       71)     $crypted = base64_decode($crypted);
modules/webmailtotp/include/totp.php       72)     $secret = $webmailpw;
modules/webmailtotp/include/totp.php       73)     if (strlen($crypted) > strlen($webmailpw)) {
modules/webmailtotp/include/totp.php       74)         $secret = str_pad($webmailpw, strlen($crypted), $webmailpw);
modules/webmailtotp/include/totp.php       75)     }
modules/webmailtotp/include/totp.php       76)     if (strlen($crypted) < strlen($webmailpw)) {
modules/webmailtotp/include/totp.php       77)         $webmailpw = substr($webmailpw, 0, strlen($crypted));
modules/webmailtotp/include/totp.php       78)     }
modules/webmailtotp/include/totp.php       79)     $clear = '';
modules/webmailtotp/include/totp.php       80)     for ($i = 0 ; $i != strlen($crypted) ; $i++) {
modules/webmailtotp/include/totp.php       81)         $clear .= chr(ord($crypted[$i]) ^ ord($secret[$i]));
modules/webmailtotp/include/totp.php       82)     }
modules/webmailtotp/include/totp.php       83)     DEBUG('decrypted: '.$clear);
modules/webmailtotp/include/totp.php       84)     return $clear;

modules/googleauth/include/googleauth.php  85) }
modules/googleauth/include/googleauth.php  86) 
modules/googleauth/include/googleauth.php  87) 

modules/webmailtotp/include/totp.php       88) function get_imap_password($username, $webmailpass)
modules/webmailtotp/include/totp.php       89) {
modules/webmailtotp/include/totp.php       90)     $result = db_query("SELECT webmailpass FROM mail.webmail_totp WHERE email=?", array($username));
modules/webmailtotp/include/totp.php       91)     $tmp = $result->fetch();

modules/googleauth/include/googleauth.php  92)   

modules/webmailtotp/include/totp.php       93)     $crypted = $tmp['webmailpass'];

modules/googleauth/include/googleauth.php  94)     

modules/webmailtotp/include/totp.php       95)     $clear = decode_webmail_password($crypted, $webmailpass);
modules/webmailtotp/include/totp.php       96)     return $clear;

modules/googleauth/include/googleauth.php  97) }

modules/googleauth/include/googleauth.php  98) 

modules/googleauth/include/googleauth.php  99) 
modules/googleauth/include/googleauth.php 100) function check_webmail_password($username, $webmailpass)
modules/googleauth/include/googleauth.php 101) {

modules/webmailtotp/include/totp.php      102)     $clear = get_imap_password($username, $webmailpass);
modules/webmailtotp/include/totp.php      103)     return validate_password($username, $clear);

modules/googleauth/include/googleauth.php 104) }
modules/googleauth/include/googleauth.php 105) 
modules/googleauth/include/googleauth.php 106) 
modules/googleauth/include/googleauth.php 107) function generate_secret($username)
modules/googleauth/include/googleauth.php 108) {

modules/webmailtotp/include/totp.php      109)     require_once('external/googleauthenticator/GoogleAuthenticator.php');
modules/webmailtotp/include/totp.php      110)     $ga = new PHPGangsta_GoogleAuthenticator();

modules/googleauth/include/googleauth.php 111)   

modules/webmailtotp/include/totp.php      112)     $secret = $ga->createSecret();
modules/webmailtotp/include/totp.php      113)     DEBUG('GA-Secret: '.$secret);
modules/webmailtotp/include/totp.php      114)     DEBUG('QrCode: '.$ga->getQRCodeGoogleUrl('Blog', $secret));
modules/webmailtotp/include/totp.php      115)     $args = array(":secret" => $secret, ":username" => $username);
modules/webmailtotp/include/totp.php      116)     db_query("UPDATE mail.webmail_totp SET totp_secret=:secret WHERE email=:username", $args);
modules/webmailtotp/include/totp.php      117)     return $secret;

modules/googleauth/include/googleauth.php 118) }
modules/googleauth/include/googleauth.php 119) 

modules/webmailtotp/include/totp.php      120) function check_locked($username)

modules/googleauth/include/googleauth.php 121) {

modules/webmailtotp/include/totp.php      122)     $result = db_query("SELECT 1 FROM mail.webmail_totp WHERE unlock_timestamp IS NOT NULL and unlock_timestamp > NOW() AND email=?", array($username));
modules/webmailtotp/include/totp.php      123)     return ($result->rowCount() > 0);

modules/googleauth/include/googleauth.php 124) }
modules/googleauth/include/googleauth.php 125) 

modules/webmailtotp/include/totp.php      126) function check_totp($username, $code)
modules/webmailtotp/include/totp.php      127) {
modules/webmailtotp/include/totp.php      128)     if (check_blacklist($username, $code)) {
modules/webmailtotp/include/totp.php      129)         DEBUG('Replay-Attack');
modules/webmailtotp/include/totp.php      130)         return false;
modules/webmailtotp/include/totp.php      131)     }

modules/googleauth/include/googleauth.php 132) 

modules/webmailtotp/include/totp.php      133)     $result = db_query("SELECT totp_secret, failures FROM mail.webmail_totp WHERE email=? AND (unlock_timestamp IS NULL OR unlock_timestamp <= NOW())", array($username));
modules/webmailtotp/include/totp.php      134)     $tmp = $result->fetch();
modules/webmailtotp/include/totp.php      135)     $secret = $tmp['totp_secret'];

modules/googleauth/include/googleauth.php 136) 

modules/webmailtotp/include/totp.php      137)     require_once('external/googleauthenticator/GoogleAuthenticator.php');
modules/webmailtotp/include/totp.php      138)     $ga = new PHPGangsta_GoogleAuthenticator();

modules/googleauth/include/googleauth.php 139)   

modules/webmailtotp/include/totp.php      140)     $checkResult = $ga->verifyCode($secret, $code, 2);    // 2 = 2*30sec clock tolerance
modules/webmailtotp/include/totp.php      141)     if ($checkResult) {
modules/webmailtotp/include/totp.php      142)         db_query("UPDATE mail.webmail_totp SET failures = 0, unlock_timestamp=NULL WHERE email=?", array($username));
modules/webmailtotp/include/totp.php      143)         blacklist_token($username, $code);
modules/webmailtotp/include/totp.php      144)         DEBUG('OK');

modules/googleauth/include/googleauth.php 145)     } else {

modules/webmailtotp/include/totp.php      146)         if ($tmp['failures'] > 0 && $tmp['failures'] % 5 == 0) {
modules/webmailtotp/include/totp.php      147)             db_query("UPDATE mail.webmail_totp SET failures = failures+1, unlock_timestamp = NOW() + INTERVAL 5 MINUTE WHERE email=?", array($username));
modules/webmailtotp/include/totp.php      148)         } else {
modules/webmailtotp/include/totp.php      149)             db_query("UPDATE mail.webmail_totp SET failures = failures+1 WHERE email=?", array($username));
modules/webmailtotp/include/totp.php      150)         }

modules/googleauth/include/googleauth.php 151)     

modules/webmailtotp/include/totp.php      152)         DEBUG('FAILED');
modules/webmailtotp/include/totp.php      153)     }
modules/webmailtotp/include/totp.php      154)     return $checkResult;

modules/googleauth/include/googleauth.php 155) }
modules/googleauth/include/googleauth.php 156) 

modules/webmailtotp/include/totp.php      157) function generate_qrcode_image($secret)
modules/webmailtotp/include/totp.php      158) {
modules/webmailtotp/include/totp.php      159)     $url = 'otpauth://totp/Webmail?secret='.$secret;

modules/googleauth/include/googleauth.php 160)   

modules/webmailtotp/include/totp.php      161)     $descriptorspec = array(

modules/googleauth/include/googleauth.php 162)     0 => array("pipe", "r"),  // STDIN ist eine Pipe, von der das Child liest
modules/googleauth/include/googleauth.php 163)     1 => array("pipe", "w"),  // STDOUT ist eine Pipe, in die das Child schreibt

modules/webmailtotp/include/totp.php      164)     2 => array("pipe", "w")

modules/googleauth/include/googleauth.php 165)   );
modules/googleauth/include/googleauth.php 166) 

modules/webmailtotp/include/totp.php      167)     $process = proc_open('qrencode -t PNG -s 5 -o -', $descriptorspec, $pipes);

modules/googleauth/include/googleauth.php 168) 

modules/webmailtotp/include/totp.php      169)     if (is_resource($process)) {
modules/webmailtotp/include/totp.php      170)         // $pipes sieht nun so aus:
modules/webmailtotp/include/totp.php      171)         // 0 => Schreibhandle, das auf das Child STDIN verbunden ist
modules/webmailtotp/include/totp.php      172)         // 1 => Lesehandle, das auf das Child STDOUT verbunden ist

modules/googleauth/include/googleauth.php 173) 

modules/webmailtotp/include/totp.php      174)         fwrite($pipes[0], $url);
modules/webmailtotp/include/totp.php      175)         fclose($pipes[0]);

modules/googleauth/include/googleauth.php 176) 

modules/webmailtotp/include/totp.php      177)         $pngdata = stream_get_contents($pipes[1]);
modules/webmailtotp/include/totp.php      178)         fclose($pipes[1]);

modules/googleauth/include/googleauth.php 179) 

modules/webmailtotp/include/totp.php      180)         // Es ist wichtig, dass Sie alle Pipes schließen bevor Sie
modules/webmailtotp/include/totp.php      181)         // proc_close aufrufen, um Deadlocks zu vermeiden
modules/webmailtotp/include/totp.php      182)         $return_value = proc_close($process);

modules/googleauth/include/googleauth.php 183)   

modules/webmailtotp/include/totp.php      184)         return $pngdata;
modules/webmailtotp/include/totp.php      185)     } else {
modules/webmailtotp/include/totp.php      186)         warning('Es ist ein interner Fehler im Webinterface aufgetreten, aufgrund dessen kein QR-Code erstellt werden kann. Sollte dieser Fehler mehrfach auftreten, kontaktieren Sie bitte die Administratoren.');
modules/webmailtotp/include/totp.php      187)     }

modules/googleauth/include/googleauth.php 188) }
modules/googleauth/include/googleauth.php 189) 

modules/webmailtotp/include/totp.php      190) function accountname($id)

modules/googleauth/include/googleauth.php 191) {

modules/webmailtotp/include/totp.php      192)     $args = array(":id" => $id,

modules/webmailtotp/include/totp.php      193)                 ":uid" => $_SESSION['userinfo']['uid']);

modules/webmailtotp/include/totp.php      194)     $result = db_query("SELECT email FROM mail.webmail_totp WHERE id=:id AND useraccount=:uid", $args);
modules/webmailtotp/include/totp.php      195)     if ($tmp = $result->fetch()) {
modules/webmailtotp/include/totp.php      196)         return $tmp['email'];
modules/webmailtotp/include/totp.php      197)     }

modules/googleauth/include/googleauth.php 198) }
modules/googleauth/include/googleauth.php 199) 
modules/googleauth/include/googleauth.php 200) 

modules/webmailtotp/include/totp.php      201) function delete_totp($id)

modules/googleauth/include/googleauth.php 202) {

modules/webmailtotp/include/totp.php      203)     $args = array(":id" => $id,

modules/webmailtotp/include/totp.php      204)                 ":uid" => $_SESSION['userinfo']['uid']);

modules/googleauth/include/googleauth.php 205)   

modules/webmailtotp/include/totp.php      206)     db_query("DELETE FROM mail.webmail_totp WHERE id=:id AND useraccount=:uid", $args);

modules/googleauth/include/googleauth.php 207) }
modules/googleauth/include/googleauth.php 208) 

modules/googleauth/include/googleauth.php 209) 
modules/googleauth/include/googleauth.php 210) function blacklist_token($email, $token)
modules/googleauth/include/googleauth.php 211) {

modules/webmailtotp/include/totp.php      212)     $args = array(":email" => $email, ":token" => $token);
modules/webmailtotp/include/totp.php      213)     db_query("INSERT INTO mail.webmail_totp_blacklist (timestamp, email, token) VALUES (NOW(), :email, :token)", $args);

modules/googleauth/include/googleauth.php 214) }
modules/googleauth/include/googleauth.php 215) 
modules/googleauth/include/googleauth.php 216) function check_blacklist($email, $token)
modules/googleauth/include/googleauth.php 217) {

modules/webmailtotp/include/totp.php      218)     $args = array(":email" => $email, ":token" => $token);
modules/webmailtotp/include/totp.php      219)     db_query("DELETE FROM mail.webmail_totp_blacklist WHERE timestamp < NOW() - INTERVAL 10 MINUTE");
modules/webmailtotp/include/totp.php      220)     $result = db_query("SELECT id FROM mail.webmail_totp_blacklist WHERE email=:email AND token=:token", $args);
modules/webmailtotp/include/totp.php      221)     return ($result->rowCount() > 0);