webinterface.git

modules/googleauth/include/googleauth.php   1) <?php
modules/googleauth/include/googleauth.php   2) /*
modules/googleauth/include/googleauth.php   3) This file belongs to the Webinterface of schokokeks.org Hosting
modules/googleauth/include/googleauth.php   4) 

modules/webmailtotp/include/totp.php        5) Written 2008-2014 by schokokeks.org Hosting, namely

modules/googleauth/include/googleauth.php   6)   Bernd Wurst <bernd@schokokeks.org>
modules/googleauth/include/googleauth.php   7)   Hanno Böck <hanno@schokokeks.org>
modules/googleauth/include/googleauth.php   8) 
modules/googleauth/include/googleauth.php   9) To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.
modules/googleauth/include/googleauth.php  10) 
modules/googleauth/include/googleauth.php  11) You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 
modules/googleauth/include/googleauth.php  12) http://creativecommons.org/publicdomain/zero/1.0/
modules/googleauth/include/googleauth.php  13) 
modules/googleauth/include/googleauth.php  14) Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.
modules/googleauth/include/googleauth.php  15) */
modules/googleauth/include/googleauth.php  16) 

modules/webmailtotp/include/totp.php       17) function account_has_totp($username)

modules/googleauth/include/googleauth.php  18) {

modules/webmailtotp/include/totp.php       19)   $result = db_query("SELECT id FROM mail.webmail_totp WHERE email=?", array($username));

modules/webmailtotp/include/totp.php       20)   if ($result->rowCount() > 0) {
modules/webmailtotp/include/totp.php       21)     $tmp = $result->fetch();

modules/googleauth/include/googleauth.php  22)     $id = $tmp['id'];
modules/googleauth/include/googleauth.php  23)     return $id;
modules/googleauth/include/googleauth.php  24)   } else {
modules/googleauth/include/googleauth.php  25)     return false;
modules/googleauth/include/googleauth.php  26)   }
modules/googleauth/include/googleauth.php  27) }
modules/googleauth/include/googleauth.php  28) 
modules/googleauth/include/googleauth.php  29) 
modules/googleauth/include/googleauth.php  30) 
modules/googleauth/include/googleauth.php  31) function validate_password($username, $password) 
modules/googleauth/include/googleauth.php  32) {

modules/webmailtotp/include/totp.php       33)   $args[":username"] = $username;
modules/webmailtotp/include/totp.php       34)   $result = db_query("SELECT account, cryptpass FROM mail.courier_mailaccounts WHERE account=:username UNION SELECT account, cryptpass FROM mail.courier_virtual_accounts WHERE account=:username", $args);

modules/webmailtotp/include/totp.php       35)   if ($result->rowCount() != 1) {

modules/googleauth/include/googleauth.php  36)     // Kein Account mit dem Namen oder Name nicht eindeutig
modules/googleauth/include/googleauth.php  37)     return false;
modules/googleauth/include/googleauth.php  38)   }

modules/webmailtotp/include/totp.php       39)   $account = $result->fetch();

modules/googleauth/include/googleauth.php  40)   return (crypt($password, $account['cryptpass']) == $account['cryptpass']);
modules/googleauth/include/googleauth.php  41) }
modules/googleauth/include/googleauth.php  42) 
modules/googleauth/include/googleauth.php  43) 
modules/googleauth/include/googleauth.php  44) function store_webmail_password($username, $oldpw, $newpw)
modules/googleauth/include/googleauth.php  45) {
modules/googleauth/include/googleauth.php  46)   $secret = $newpw;
modules/googleauth/include/googleauth.php  47)   if (strlen($oldpw) > strlen($newpw)) {
modules/googleauth/include/googleauth.php  48)     $secret = str_pad($newpw, strlen($oldpw), $newpw);
modules/googleauth/include/googleauth.php  49)   }
modules/googleauth/include/googleauth.php  50)   if (strlen($oldpw) < strlen($newpw)) {
modules/googleauth/include/googleauth.php  51)     $newpw = substr($newpw, 0, strlen($oldpw));
modules/googleauth/include/googleauth.php  52)   }
modules/googleauth/include/googleauth.php  53)   if (strlen($oldpw) != strlen($secret)) {
modules/googleauth/include/googleauth.php  54)     system_failure('Interner Fehler: Passwörter sind nicht gleich lang');
modules/googleauth/include/googleauth.php  55)   }
modules/googleauth/include/googleauth.php  56)   $code = '';
modules/googleauth/include/googleauth.php  57)   for ($i = 0 ; $i != strlen($oldpw) ; $i++) {
modules/googleauth/include/googleauth.php  58)     $code .= chr( ord($oldpw[$i]) ^ ord($secret[$i]) );
modules/googleauth/include/googleauth.php  59)   }

modules/webmailtotp/include/totp.php       60)   DEBUG(array($oldpw, $newpw));
modules/webmailtotp/include/totp.php       61)   $args = array(":uid" => $_SESSION['userinfo']['uid'],
modules/webmailtotp/include/totp.php       62)                 ":username" => $username,
modules/webmailtotp/include/totp.php       63)                 ":code" => base64_encode($code));

modules/googleauth/include/googleauth.php  64) 

modules/webmailtotp/include/totp.php       65)   db_query("REPLACE INTO mail.webmail_totp (useraccount, email, webmailpass) VALUES (:uid, :username, :code)", $args);

modules/googleauth/include/googleauth.php  66) }
modules/googleauth/include/googleauth.php  67) 
modules/googleauth/include/googleauth.php  68) 
modules/googleauth/include/googleauth.php  69) function decode_webmail_password($crypted, $webmailpw)   
modules/googleauth/include/googleauth.php  70) {
modules/googleauth/include/googleauth.php  71)   $crypted = base64_decode($crypted);
modules/googleauth/include/googleauth.php  72)   $secret = $webmailpw;
modules/googleauth/include/googleauth.php  73)   if (strlen($crypted) > strlen($webmailpw)) {
modules/googleauth/include/googleauth.php  74)     $secret = str_pad($webmailpw, strlen($crypted), $webmailpw);
modules/googleauth/include/googleauth.php  75)   }
modules/googleauth/include/googleauth.php  76)   if (strlen($crypted) < strlen($webmailpw)) {
modules/googleauth/include/googleauth.php  77)     $webmailpw = substr($webmailpw, 0, strlen($crypted));
modules/googleauth/include/googleauth.php  78)   }
modules/googleauth/include/googleauth.php  79)   $clear = '';
modules/googleauth/include/googleauth.php  80)   for ($i = 0 ; $i != strlen($crypted) ; $i++) {
modules/googleauth/include/googleauth.php  81)     $clear .= chr( ord($crypted[$i]) ^ ord($secret[$i]) );
modules/googleauth/include/googleauth.php  82)   }
modules/googleauth/include/googleauth.php  83)   DEBUG('decrypted: '.$clear);
modules/googleauth/include/googleauth.php  84)   return $clear;
modules/googleauth/include/googleauth.php  85) }
modules/googleauth/include/googleauth.php  86) 
modules/googleauth/include/googleauth.php  87) 

modules/googleauth/include/googleauth.php  88) function get_imap_password($username, $webmailpass) {

modules/webmailtotp/include/totp.php       89)   $result = db_query("SELECT webmailpass FROM mail.webmail_totp WHERE email=?", array($username));

modules/webmailtotp/include/totp.php       90)   $tmp = $result->fetch();

modules/googleauth/include/googleauth.php  91)   
modules/googleauth/include/googleauth.php  92)   $crypted = $tmp['webmailpass'];
modules/googleauth/include/googleauth.php  93)     
modules/googleauth/include/googleauth.php  94)   $clear = decode_webmail_password($crypted, $webmailpass);

modules/googleauth/include/googleauth.php  95)   return $clear;
modules/googleauth/include/googleauth.php  96) }

modules/googleauth/include/googleauth.php  97) 

modules/googleauth/include/googleauth.php  98) 
modules/googleauth/include/googleauth.php  99) function check_webmail_password($username, $webmailpass)
modules/googleauth/include/googleauth.php 100) {
modules/googleauth/include/googleauth.php 101)   $clear = get_imap_password($username, $webmailpass);

modules/googleauth/include/googleauth.php 102)   return validate_password($username, $clear);
modules/googleauth/include/googleauth.php 103) }
modules/googleauth/include/googleauth.php 104) 
modules/googleauth/include/googleauth.php 105) 
modules/googleauth/include/googleauth.php 106) function generate_secret($username)
modules/googleauth/include/googleauth.php 107) {
modules/googleauth/include/googleauth.php 108)   require_once('external/googleauthenticator/GoogleAuthenticator.php');
modules/googleauth/include/googleauth.php 109)   $ga = new PHPGangsta_GoogleAuthenticator();
modules/googleauth/include/googleauth.php 110)   
modules/googleauth/include/googleauth.php 111)   $secret = $ga->createSecret();
modules/googleauth/include/googleauth.php 112)   DEBUG('GA-Secret: '.$secret);
modules/googleauth/include/googleauth.php 113)   DEBUG('QrCode: '.$ga->getQRCodeGoogleUrl('Blog', $secret));

modules/webmailtotp/include/totp.php      114)   $args = array(":secret" => $secret, ":username" => $username);
modules/webmailtotp/include/totp.php      115)   db_query("UPDATE mail.webmail_totp SET totp_secret=:secret WHERE email=:username", $args);

modules/googleauth/include/googleauth.php 116)   return $secret;
modules/googleauth/include/googleauth.php 117) }
modules/googleauth/include/googleauth.php 118) 

modules/googleauth/include/googleauth.php 119) function check_locked($username) 
modules/googleauth/include/googleauth.php 120) {

modules/webmailtotp/include/totp.php      121)   $result = db_query("SELECT 1 FROM mail.webmail_totp WHERE unlock_timestamp IS NOT NULL and unlock_timestamp > NOW() AND email=?", array($username));

modules/webmailtotp/include/totp.php      122)   return ($result->rowCount() > 0);

modules/googleauth/include/googleauth.php 123) }
modules/googleauth/include/googleauth.php 124) 

modules/webmailtotp/include/totp.php      125) function check_totp($username, $code) {

modules/googleauth/include/googleauth.php 126)   if (check_blacklist($username, $code)) {
modules/googleauth/include/googleauth.php 127)     DEBUG('Replay-Attack');
modules/googleauth/include/googleauth.php 128)     return false;
modules/googleauth/include/googleauth.php 129)   }
modules/googleauth/include/googleauth.php 130) 

modules/webmailtotp/include/totp.php      131)   $result = db_query("SELECT totp_secret, failures FROM mail.webmail_totp WHERE email=? AND (unlock_timestamp IS NULL OR unlock_timestamp <= NOW())", array($username));

modules/webmailtotp/include/totp.php      132)   $tmp = $result->fetch();

modules/webmailtotp/include/totp.php      133)   $secret = $tmp['totp_secret'];

modules/googleauth/include/googleauth.php 134) 
modules/googleauth/include/googleauth.php 135)   require_once('external/googleauthenticator/GoogleAuthenticator.php');
modules/googleauth/include/googleauth.php 136)   $ga = new PHPGangsta_GoogleAuthenticator();
modules/googleauth/include/googleauth.php 137)   
modules/googleauth/include/googleauth.php 138)   $checkResult = $ga->verifyCode($secret, $code, 2);    // 2 = 2*30sec clock tolerance
modules/googleauth/include/googleauth.php 139)   if ($checkResult) {

modules/webmailtotp/include/totp.php      140)     db_query("UPDATE mail.webmail_totp SET failures = 0, unlock_timestamp=NULL WHERE email=?", array($username));

modules/googleauth/include/googleauth.php 141)     blacklist_token($username, $code);

modules/googleauth/include/googleauth.php 142)     DEBUG('OK');
modules/googleauth/include/googleauth.php 143)   } else {

modules/googleauth/include/googleauth.php 144)     if ($tmp['failures'] > 0 && $tmp['failures'] % 5 == 0) {

modules/webmailtotp/include/totp.php      145)       db_query("UPDATE mail.webmail_totp SET failures = failures+1, unlock_timestamp = NOW() + INTERVAL 5 MINUTE WHERE email=?", array($username));

modules/googleauth/include/googleauth.php 146)     } else {

modules/webmailtotp/include/totp.php      147)       db_query("UPDATE mail.webmail_totp SET failures = failures+1 WHERE email=?", array($username));

modules/googleauth/include/googleauth.php 148)     }
modules/googleauth/include/googleauth.php 149)     

modules/googleauth/include/googleauth.php 150)     DEBUG('FAILED');
modules/googleauth/include/googleauth.php 151)   }
modules/googleauth/include/googleauth.php 152)   return $checkResult;
modules/googleauth/include/googleauth.php 153) 
modules/googleauth/include/googleauth.php 154) }
modules/googleauth/include/googleauth.php 155) 
modules/googleauth/include/googleauth.php 156) function generate_qrcode_image($secret) {
modules/googleauth/include/googleauth.php 157)   $url = 'otpauth://totp/Webmail?secret='.$secret;
modules/googleauth/include/googleauth.php 158)   
modules/googleauth/include/googleauth.php 159)   $descriptorspec = array(
modules/googleauth/include/googleauth.php 160)     0 => array("pipe", "r"),  // STDIN ist eine Pipe, von der das Child liest
modules/googleauth/include/googleauth.php 161)     1 => array("pipe", "w"),  // STDOUT ist eine Pipe, in die das Child schreibt
modules/googleauth/include/googleauth.php 162)     2 => array("pipe", "w") 
modules/googleauth/include/googleauth.php 163)   );
modules/googleauth/include/googleauth.php 164) 
modules/googleauth/include/googleauth.php 165)   $process = proc_open('qrencode -t PNG -s 5 -o -', $descriptorspec, $pipes);
modules/googleauth/include/googleauth.php 166) 
modules/googleauth/include/googleauth.php 167)   if (is_resource($process)) {
modules/googleauth/include/googleauth.php 168)     // $pipes sieht nun so aus:
modules/googleauth/include/googleauth.php 169)     // 0 => Schreibhandle, das auf das Child STDIN verbunden ist
modules/googleauth/include/googleauth.php 170)     // 1 => Lesehandle, das auf das Child STDOUT verbunden ist
modules/googleauth/include/googleauth.php 171) 
modules/googleauth/include/googleauth.php 172)     fwrite($pipes[0], $url);
modules/googleauth/include/googleauth.php 173)     fclose($pipes[0]);
modules/googleauth/include/googleauth.php 174) 
modules/googleauth/include/googleauth.php 175)     $pngdata = stream_get_contents($pipes[1]);
modules/googleauth/include/googleauth.php 176)     fclose($pipes[1]);
modules/googleauth/include/googleauth.php 177) 
modules/googleauth/include/googleauth.php 178)     // Es ist wichtig, dass Sie alle Pipes schließen bevor Sie
modules/googleauth/include/googleauth.php 179)     // proc_close aufrufen, um Deadlocks zu vermeiden
modules/googleauth/include/googleauth.php 180)     $return_value = proc_close($process);
modules/googleauth/include/googleauth.php 181)   
modules/googleauth/include/googleauth.php 182)     return $pngdata;

modules/googleauth/include/googleauth.php 183)   } else {
modules/googleauth/include/googleauth.php 184)     warning('Es ist ein interner Fehler im Webinterface aufgetreten, aufgrund dessen kein QR-Code erstellt werden kann. Sollte dieser Fehler mehrfach auftreten, kontaktieren Sie bitte die Administratoren.');

modules/googleauth/include/googleauth.php 185)   }
modules/googleauth/include/googleauth.php 186)   
modules/googleauth/include/googleauth.php 187)   
modules/googleauth/include/googleauth.php 188) }
modules/googleauth/include/googleauth.php 189) 

modules/googleauth/include/googleauth.php 190) function accountname($id) 
modules/googleauth/include/googleauth.php 191) {

modules/webmailtotp/include/totp.php      192)   $args = array(":id" => $id,
modules/webmailtotp/include/totp.php      193)                 ":uid" => $_SESSION['userinfo']['uid']);
modules/webmailtotp/include/totp.php      194)   $result = db_query("SELECT email FROM mail.webmail_totp WHERE id=:id AND useraccount=:uid", $args);

modules/webmailtotp/include/totp.php      195)   if ($tmp = $result->fetch()) {

modules/googleauth/include/googleauth.php 196)     return $tmp['email'];
modules/googleauth/include/googleauth.php 197)   }
modules/googleauth/include/googleauth.php 198) }
modules/googleauth/include/googleauth.php 199) 
modules/googleauth/include/googleauth.php 200) 

modules/webmailtotp/include/totp.php      201) function delete_totp($id) 

modules/googleauth/include/googleauth.php 202) {

modules/webmailtotp/include/totp.php      203)   $args = array(":id" => $id,
modules/webmailtotp/include/totp.php      204)                 ":uid" => $_SESSION['userinfo']['uid']);

modules/googleauth/include/googleauth.php 205)   

modules/webmailtotp/include/totp.php      206)   db_query("DELETE FROM mail.webmail_totp WHERE id=:id AND useraccount=:uid", $args);

modules/googleauth/include/googleauth.php 207) }
modules/googleauth/include/googleauth.php 208) 

modules/googleauth/include/googleauth.php 209) 
modules/googleauth/include/googleauth.php 210) function blacklist_token($email, $token)
modules/googleauth/include/googleauth.php 211) {

modules/webmailtotp/include/totp.php      212)   $args = array(":email" => $email, ":token" => $token);
modules/webmailtotp/include/totp.php      213)   db_query("INSERT INTO mail.webmail_totp_blacklist (timestamp, email, token) VALUES (NOW(), :email, :token)", $args);

modules/googleauth/include/googleauth.php 214) }
modules/googleauth/include/googleauth.php 215) 
modules/googleauth/include/googleauth.php 216) function check_blacklist($email, $token)
modules/googleauth/include/googleauth.php 217) {

modules/webmailtotp/include/totp.php      218)   $args = array(":email" => $email, ":token" => $token);

modules/webmailtotp/include/totp.php      219)   db_query("DELETE FROM mail.webmail_totp_blacklist WHERE timestamp < NOW() - INTERVAL 10 MINUTE");

modules/webmailtotp/include/totp.php      220)   $result = db_query("SELECT id FROM mail.webmail_totp_blacklist WHERE email=:email AND token=:token", $args);

modules/webmailtotp/include/totp.php      221)   return ($result->rowCount() > 0);