webinterface.git

modules/googleauth/include/googleauth.php   1) <?php
modules/googleauth/include/googleauth.php   2) /*
modules/googleauth/include/googleauth.php   3) This file belongs to the Webinterface of schokokeks.org Hosting
modules/googleauth/include/googleauth.php   4) 

modules/webmailtotp/include/totp.php        5) Written by schokokeks.org Hosting, namely

modules/googleauth/include/googleauth.php   6)   Bernd Wurst <bernd@schokokeks.org>
modules/googleauth/include/googleauth.php   7)   Hanno Böck <hanno@schokokeks.org>
modules/googleauth/include/googleauth.php   8) 

modules/webmailtotp/include/totp.php        9) This code is published under a 0BSD license.

modules/googleauth/include/googleauth.php  10) 
modules/googleauth/include/googleauth.php  11) Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.
modules/googleauth/include/googleauth.php  12) */
modules/googleauth/include/googleauth.php  13) 

modules/webmailtotp/include/totp.php       14) require_once('vendor/autoload.php');
modules/webmailtotp/include/totp.php       15) 

modules/webmailtotp/include/totp.php       16) function account_has_totp($username)

modules/googleauth/include/googleauth.php  17) {

modules/webmailtotp/include/totp.php       18)     $result = db_query("SELECT id FROM mail.webmail_totp WHERE email=?", [$username]);

modules/webmailtotp/include/totp.php       19)     if ($result->rowCount() > 0) {
modules/webmailtotp/include/totp.php       20)         $tmp = $result->fetch();
modules/webmailtotp/include/totp.php       21)         $id = $tmp['id'];
modules/webmailtotp/include/totp.php       22)         return $id;
modules/webmailtotp/include/totp.php       23)     } else {
modules/webmailtotp/include/totp.php       24)         return false;
modules/webmailtotp/include/totp.php       25)     }

modules/googleauth/include/googleauth.php  26) }
modules/googleauth/include/googleauth.php  27) 
modules/googleauth/include/googleauth.php  28) 
modules/googleauth/include/googleauth.php  29) 

modules/webmailtotp/include/totp.php       30) function validate_password($username, $password)

modules/googleauth/include/googleauth.php  31) {

modules/webmailtotp/include/totp.php       32)     $args[":username"] = $username;
modules/webmailtotp/include/totp.php       33)     $result = db_query("SELECT account, cryptpass FROM mail.courier_mailaccounts WHERE account=:username UNION SELECT account, cryptpass FROM mail.courier_virtual_accounts WHERE account=:username", $args);
modules/webmailtotp/include/totp.php       34)     if ($result->rowCount() != 1) {
modules/webmailtotp/include/totp.php       35)         // Kein Account mit dem Namen oder Name nicht eindeutig
modules/webmailtotp/include/totp.php       36)         return false;
modules/webmailtotp/include/totp.php       37)     }
modules/webmailtotp/include/totp.php       38)     $account = $result->fetch();

modules/webmailtotp/include/totp.php       39)     return password_verify($password, $account['cryptpass']);

modules/googleauth/include/googleauth.php  40) }
modules/googleauth/include/googleauth.php  41) 
modules/googleauth/include/googleauth.php  42) 
modules/googleauth/include/googleauth.php  43) function store_webmail_password($username, $oldpw, $newpw)
modules/googleauth/include/googleauth.php  44) {

modules/webmailtotp/include/totp.php       45)     $qual = strong_password($newpw);
modules/webmailtotp/include/totp.php       46)     if ($qual !== true) {

modules/webmailtotp/include/totp.php       47)         system_failure('Fehler beim Webmail-Passwort: ' . $qual);

modules/webmailtotp/include/totp.php       48)     }

modules/webmailtotp/include/totp.php       49)     $secret = $newpw;
modules/webmailtotp/include/totp.php       50)     if (strlen($oldpw) > strlen($newpw)) {
modules/webmailtotp/include/totp.php       51)         $secret = str_pad($newpw, strlen($oldpw), $newpw);
modules/webmailtotp/include/totp.php       52)     }
modules/webmailtotp/include/totp.php       53)     if (strlen($oldpw) < strlen($newpw)) {

modules/webmailtotp/include/totp.php       54)         $secret = substr($newpw, 0, strlen($oldpw));

modules/webmailtotp/include/totp.php       55)     }
modules/webmailtotp/include/totp.php       56)     if (strlen($oldpw) != strlen($secret)) {
modules/webmailtotp/include/totp.php       57)         system_failure('Interner Fehler: Passwörter sind nicht gleich lang');
modules/webmailtotp/include/totp.php       58)     }
modules/webmailtotp/include/totp.php       59)     $code = '';
modules/webmailtotp/include/totp.php       60)     for ($i = 0 ; $i != strlen($oldpw) ; $i++) {
modules/webmailtotp/include/totp.php       61)         $code .= chr(ord($oldpw[$i]) ^ ord($secret[$i]));
modules/webmailtotp/include/totp.php       62)     }

modules/webmailtotp/include/totp.php       63)     DEBUG([$oldpw, $newpw]);
modules/webmailtotp/include/totp.php       64)     $args = [":uid" => $_SESSION['userinfo']['uid'],

modules/webmailtotp/include/totp.php       65)                 ":username" => $username,

modules/webmailtotp/include/totp.php       66)                 ":code" => base64_encode($code), ];

modules/googleauth/include/googleauth.php  67) 

modules/webmailtotp/include/totp.php       68)     db_query("REPLACE INTO mail.webmail_totp (useraccount, email, webmailpass) VALUES (:uid, :username, :code)", $args);

modules/googleauth/include/googleauth.php  69) }
modules/googleauth/include/googleauth.php  70) 
modules/googleauth/include/googleauth.php  71) 

modules/webmailtotp/include/totp.php       72) function decode_webmail_password($crypted, $webmailpw)

modules/googleauth/include/googleauth.php  73) {

modules/webmailtotp/include/totp.php       74)     $crypted = base64_decode($crypted);
modules/webmailtotp/include/totp.php       75)     $secret = $webmailpw;
modules/webmailtotp/include/totp.php       76)     if (strlen($crypted) > strlen($webmailpw)) {
modules/webmailtotp/include/totp.php       77)         $secret = str_pad($webmailpw, strlen($crypted), $webmailpw);
modules/webmailtotp/include/totp.php       78)     }
modules/webmailtotp/include/totp.php       79)     if (strlen($crypted) < strlen($webmailpw)) {
modules/webmailtotp/include/totp.php       80)         $webmailpw = substr($webmailpw, 0, strlen($crypted));
modules/webmailtotp/include/totp.php       81)     }
modules/webmailtotp/include/totp.php       82)     $clear = '';
modules/webmailtotp/include/totp.php       83)     for ($i = 0 ; $i != strlen($crypted) ; $i++) {
modules/webmailtotp/include/totp.php       84)         $clear .= chr(ord($crypted[$i]) ^ ord($secret[$i]));
modules/webmailtotp/include/totp.php       85)     }

modules/webmailtotp/include/totp.php       86)     DEBUG('decrypted: ' . $clear);

modules/webmailtotp/include/totp.php       87)     return $clear;

modules/googleauth/include/googleauth.php  88) }
modules/googleauth/include/googleauth.php  89) 
modules/googleauth/include/googleauth.php  90) 

modules/webmailtotp/include/totp.php       91) function get_imap_password($username, $webmailpass)
modules/webmailtotp/include/totp.php       92) {

modules/webmailtotp/include/totp.php       93)     $result = db_query("SELECT webmailpass FROM mail.webmail_totp WHERE email=?", [$username]);

modules/webmailtotp/include/totp.php       94)     $tmp = $result->fetch();

modules/webmailtotp/include/totp.php       95) 

modules/webmailtotp/include/totp.php       96)     $crypted = $tmp['webmailpass'];

modules/webmailtotp/include/totp.php       97) 

modules/webmailtotp/include/totp.php       98)     $clear = decode_webmail_password($crypted, $webmailpass);
modules/webmailtotp/include/totp.php       99)     return $clear;

modules/googleauth/include/googleauth.php 100) }

modules/googleauth/include/googleauth.php 101) 

modules/googleauth/include/googleauth.php 102) 
modules/googleauth/include/googleauth.php 103) function check_webmail_password($username, $webmailpass)
modules/googleauth/include/googleauth.php 104) {

modules/webmailtotp/include/totp.php      105)     $clear = get_imap_password($username, $webmailpass);
modules/webmailtotp/include/totp.php      106)     return validate_password($username, $clear);

modules/googleauth/include/googleauth.php 107) }
modules/googleauth/include/googleauth.php 108) 
modules/googleauth/include/googleauth.php 109) 
modules/googleauth/include/googleauth.php 110) function generate_secret($username)
modules/googleauth/include/googleauth.php 111) {

modules/webmailtotp/include/totp.php      112)     $ga = new PHPGangsta_GoogleAuthenticator();

modules/webmailtotp/include/totp.php      113) 

modules/webmailtotp/include/totp.php      114)     $secret = $ga->createSecret();

modules/webmailtotp/include/totp.php      115)     DEBUG('GA-Secret: ' . $secret);
modules/webmailtotp/include/totp.php      116)     DEBUG('QrCode: ' . $ga->getQRCodeGoogleUrl('Blog', $secret));

modules/webmailtotp/include/totp.php      117)     $args = [":secret" => $secret, ":username" => $username];

modules/webmailtotp/include/totp.php      118)     db_query("UPDATE mail.webmail_totp SET totp_secret=:secret WHERE email=:username", $args);
modules/webmailtotp/include/totp.php      119)     return $secret;

modules/googleauth/include/googleauth.php 120) }
modules/googleauth/include/googleauth.php 121) 

modules/webmailtotp/include/totp.php      122) function check_locked($username)

modules/googleauth/include/googleauth.php 123) {

modules/webmailtotp/include/totp.php      124)     $result = db_query("SELECT 1 FROM mail.webmail_totp WHERE unlock_timestamp IS NOT NULL and unlock_timestamp > NOW() AND email=?", [$username]);

modules/webmailtotp/include/totp.php      125)     return ($result->rowCount() > 0);

modules/googleauth/include/googleauth.php 126) }
modules/googleauth/include/googleauth.php 127) 

modules/webmailtotp/include/totp.php      128) function check_totp($username, $code)
modules/webmailtotp/include/totp.php      129) {
modules/webmailtotp/include/totp.php      130)     if (check_blacklist($username, $code)) {
modules/webmailtotp/include/totp.php      131)         DEBUG('Replay-Attack');
modules/webmailtotp/include/totp.php      132)         return false;
modules/webmailtotp/include/totp.php      133)     }

modules/googleauth/include/googleauth.php 134) 

modules/webmailtotp/include/totp.php      135)     $result = db_query("SELECT totp_secret, failures FROM mail.webmail_totp WHERE email=? AND (unlock_timestamp IS NULL OR unlock_timestamp <= NOW())", [$username]);

modules/webmailtotp/include/totp.php      136)     $tmp = $result->fetch();
modules/webmailtotp/include/totp.php      137)     $secret = $tmp['totp_secret'];

modules/googleauth/include/googleauth.php 138) 

modules/webmailtotp/include/totp.php      139)     $ga = new PHPGangsta_GoogleAuthenticator();

modules/webmailtotp/include/totp.php      140) 

modules/webmailtotp/include/totp.php      141)     $checkResult = $ga->verifyCode($secret, $code, 2);    // 2 = 2*30sec clock tolerance
modules/webmailtotp/include/totp.php      142)     if ($checkResult) {

modules/webmailtotp/include/totp.php      143)         db_query("UPDATE mail.webmail_totp SET failures = 0, unlock_timestamp=NULL WHERE email=?", [$username]);

modules/webmailtotp/include/totp.php      144)         blacklist_token($username, $code);
modules/webmailtotp/include/totp.php      145)         DEBUG('OK');

modules/googleauth/include/googleauth.php 146)     } else {

modules/webmailtotp/include/totp.php      147)         if ($tmp['failures'] > 0 && $tmp['failures'] % 5 == 0) {

modules/webmailtotp/include/totp.php      148)             db_query("UPDATE mail.webmail_totp SET failures = failures+1, unlock_timestamp = NOW() + INTERVAL 5 MINUTE WHERE email=?", [$username]);

modules/webmailtotp/include/totp.php      149)         } else {

modules/webmailtotp/include/totp.php      150)             db_query("UPDATE mail.webmail_totp SET failures = failures+1 WHERE email=?", [$username]);

modules/webmailtotp/include/totp.php      151)         }

modules/webmailtotp/include/totp.php      152) 

modules/webmailtotp/include/totp.php      153)         DEBUG('FAILED');
modules/webmailtotp/include/totp.php      154)     }
modules/webmailtotp/include/totp.php      155)     return $checkResult;

modules/googleauth/include/googleauth.php 156) }
modules/googleauth/include/googleauth.php 157) 

modules/webmailtotp/include/totp.php      158) function generate_qrcode_image($secret)
modules/webmailtotp/include/totp.php      159) {

modules/webmailtotp/include/totp.php      160)     $url = 'otpauth://totp/Webmail?secret=' . $secret;

modules/webmailtotp/include/totp.php      161) 

modules/webmailtotp/include/totp.php      162)     $descriptorspec = [
modules/webmailtotp/include/totp.php      163)     0 => ["pipe", "r"],  // STDIN ist eine Pipe, von der das Child liest
modules/webmailtotp/include/totp.php      164)     1 => ["pipe", "w"],  // STDOUT ist eine Pipe, in die das Child schreibt
modules/webmailtotp/include/totp.php      165)     2 => ["pipe", "w"],
modules/webmailtotp/include/totp.php      166)   ];

modules/googleauth/include/googleauth.php 167) 

modules/webmailtotp/include/totp.php      168)     $process = proc_open('qrencode -t PNG -s 5 -o -', $descriptorspec, $pipes);

modules/googleauth/include/googleauth.php 169) 

modules/webmailtotp/include/totp.php      170)     if (is_resource($process)) {
modules/webmailtotp/include/totp.php      171)         // $pipes sieht nun so aus:
modules/webmailtotp/include/totp.php      172)         // 0 => Schreibhandle, das auf das Child STDIN verbunden ist
modules/webmailtotp/include/totp.php      173)         // 1 => Lesehandle, das auf das Child STDOUT verbunden ist

modules/googleauth/include/googleauth.php 174) 

modules/webmailtotp/include/totp.php      175)         fwrite($pipes[0], $url);
modules/webmailtotp/include/totp.php      176)         fclose($pipes[0]);

modules/googleauth/include/googleauth.php 177) 

modules/webmailtotp/include/totp.php      178)         $pngdata = stream_get_contents($pipes[1]);
modules/webmailtotp/include/totp.php      179)         fclose($pipes[1]);

modules/googleauth/include/googleauth.php 180) 

modules/webmailtotp/include/totp.php      181)         // Es ist wichtig, dass Sie alle Pipes schließen bevor Sie
modules/webmailtotp/include/totp.php      182)         // proc_close aufrufen, um Deadlocks zu vermeiden
modules/webmailtotp/include/totp.php      183)         $return_value = proc_close($process);

modules/webmailtotp/include/totp.php      184) 

modules/webmailtotp/include/totp.php      185)         return $pngdata;
modules/webmailtotp/include/totp.php      186)     } else {
modules/webmailtotp/include/totp.php      187)         warning('Es ist ein interner Fehler im Webinterface aufgetreten, aufgrund dessen kein QR-Code erstellt werden kann. Sollte dieser Fehler mehrfach auftreten, kontaktieren Sie bitte die Administratoren.');
modules/webmailtotp/include/totp.php      188)     }

modules/googleauth/include/googleauth.php 189) }
modules/googleauth/include/googleauth.php 190) 

modules/webmailtotp/include/totp.php      191) function accountname($id)

modules/googleauth/include/googleauth.php 192) {

modules/webmailtotp/include/totp.php      193)     $args = [":id" => $id,
modules/webmailtotp/include/totp.php      194)                 ":uid" => $_SESSION['userinfo']['uid'], ];

modules/webmailtotp/include/totp.php      195)     $result = db_query("SELECT email FROM mail.webmail_totp WHERE id=:id AND useraccount=:uid", $args);
modules/webmailtotp/include/totp.php      196)     if ($tmp = $result->fetch()) {
modules/webmailtotp/include/totp.php      197)         return $tmp['email'];
modules/webmailtotp/include/totp.php      198)     }

modules/googleauth/include/googleauth.php 199) }
modules/googleauth/include/googleauth.php 200) 
modules/googleauth/include/googleauth.php 201) 

modules/webmailtotp/include/totp.php      202) function delete_totp($id)

modules/googleauth/include/googleauth.php 203) {

modules/webmailtotp/include/totp.php      204)     $args = [":id" => $id,
modules/webmailtotp/include/totp.php      205)                 ":uid" => $_SESSION['userinfo']['uid'], ];

modules/webmailtotp/include/totp.php      206) 

modules/webmailtotp/include/totp.php      207)     db_query("DELETE FROM mail.webmail_totp WHERE id=:id AND useraccount=:uid", $args);

modules/googleauth/include/googleauth.php 208) }
modules/googleauth/include/googleauth.php 209) 

modules/googleauth/include/googleauth.php 210) 
modules/googleauth/include/googleauth.php 211) function blacklist_token($email, $token)
modules/googleauth/include/googleauth.php 212) {

modules/webmailtotp/include/totp.php      213)     $args = [":email" => $email, ":token" => $token];

modules/webmailtotp/include/totp.php      214)     db_query("INSERT INTO mail.webmail_totp_blacklist (timestamp, email, token) VALUES (NOW(), :email, :token)", $args);

modules/googleauth/include/googleauth.php 215) }
modules/googleauth/include/googleauth.php 216) 
modules/googleauth/include/googleauth.php 217) function check_blacklist($email, $token)
modules/googleauth/include/googleauth.php 218) {

modules/webmailtotp/include/totp.php      219)     $args = [":email" => $email, ":token" => $token];

modules/webmailtotp/include/totp.php      220)     db_query("DELETE FROM mail.webmail_totp_blacklist WHERE timestamp < NOW() - INTERVAL 10 MINUTE");
modules/webmailtotp/include/totp.php      221)     $result = db_query("SELECT id FROM mail.webmail_totp_blacklist WHERE email=:email AND token=:token", $args);
modules/webmailtotp/include/totp.php      222)     return ($result->rowCount() > 0);