webinterface.git

modules/googleauth/include/googleauth.php   1) <?php
modules/googleauth/include/googleauth.php   2) /*
modules/googleauth/include/googleauth.php   3) This file belongs to the Webinterface of schokokeks.org Hosting
modules/googleauth/include/googleauth.php   4) 

modules/webmailtotp/include/totp.php        5) Written 2008-2018 by schokokeks.org Hosting, namely

modules/googleauth/include/googleauth.php   6)   Bernd Wurst <bernd@schokokeks.org>
modules/googleauth/include/googleauth.php   7)   Hanno Böck <hanno@schokokeks.org>
modules/googleauth/include/googleauth.php   8) 
modules/googleauth/include/googleauth.php   9) To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.
modules/googleauth/include/googleauth.php  10) 

modules/webmailtotp/include/totp.php       11) You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see

modules/googleauth/include/googleauth.php  12) http://creativecommons.org/publicdomain/zero/1.0/
modules/googleauth/include/googleauth.php  13) 
modules/googleauth/include/googleauth.php  14) Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.
modules/googleauth/include/googleauth.php  15) */
modules/googleauth/include/googleauth.php  16) 

modules/webmailtotp/include/totp.php       17) require_once('vendor/autoload.php');
modules/webmailtotp/include/totp.php       18) 

modules/webmailtotp/include/totp.php       19) function account_has_totp($username)

modules/googleauth/include/googleauth.php  20) {

modules/webmailtotp/include/totp.php       21)     $result = db_query("SELECT id FROM mail.webmail_totp WHERE email=?", array($username));
modules/webmailtotp/include/totp.php       22)     if ($result->rowCount() > 0) {
modules/webmailtotp/include/totp.php       23)         $tmp = $result->fetch();
modules/webmailtotp/include/totp.php       24)         $id = $tmp['id'];
modules/webmailtotp/include/totp.php       25)         return $id;
modules/webmailtotp/include/totp.php       26)     } else {
modules/webmailtotp/include/totp.php       27)         return false;
modules/webmailtotp/include/totp.php       28)     }

modules/googleauth/include/googleauth.php  29) }
modules/googleauth/include/googleauth.php  30) 
modules/googleauth/include/googleauth.php  31) 
modules/googleauth/include/googleauth.php  32) 

modules/webmailtotp/include/totp.php       33) function validate_password($username, $password)

modules/googleauth/include/googleauth.php  34) {

modules/webmailtotp/include/totp.php       35)     $args[":username"] = $username;
modules/webmailtotp/include/totp.php       36)     $result = db_query("SELECT account, cryptpass FROM mail.courier_mailaccounts WHERE account=:username UNION SELECT account, cryptpass FROM mail.courier_virtual_accounts WHERE account=:username", $args);
modules/webmailtotp/include/totp.php       37)     if ($result->rowCount() != 1) {
modules/webmailtotp/include/totp.php       38)         // Kein Account mit dem Namen oder Name nicht eindeutig
modules/webmailtotp/include/totp.php       39)         return false;
modules/webmailtotp/include/totp.php       40)     }
modules/webmailtotp/include/totp.php       41)     $account = $result->fetch();
modules/webmailtotp/include/totp.php       42)     return (crypt($password, $account['cryptpass']) == $account['cryptpass']);

modules/googleauth/include/googleauth.php  43) }
modules/googleauth/include/googleauth.php  44) 
modules/googleauth/include/googleauth.php  45) 
modules/googleauth/include/googleauth.php  46) function store_webmail_password($username, $oldpw, $newpw)
modules/googleauth/include/googleauth.php  47) {

modules/webmailtotp/include/totp.php       48)     $secret = $newpw;
modules/webmailtotp/include/totp.php       49)     if (strlen($oldpw) > strlen($newpw)) {
modules/webmailtotp/include/totp.php       50)         $secret = str_pad($newpw, strlen($oldpw), $newpw);
modules/webmailtotp/include/totp.php       51)     }
modules/webmailtotp/include/totp.php       52)     if (strlen($oldpw) < strlen($newpw)) {
modules/webmailtotp/include/totp.php       53)         $newpw = substr($newpw, 0, strlen($oldpw));
modules/webmailtotp/include/totp.php       54)     }
modules/webmailtotp/include/totp.php       55)     if (strlen($oldpw) != strlen($secret)) {
modules/webmailtotp/include/totp.php       56)         system_failure('Interner Fehler: Passwörter sind nicht gleich lang');
modules/webmailtotp/include/totp.php       57)     }
modules/webmailtotp/include/totp.php       58)     $code = '';
modules/webmailtotp/include/totp.php       59)     for ($i = 0 ; $i != strlen($oldpw) ; $i++) {
modules/webmailtotp/include/totp.php       60)         $code .= chr(ord($oldpw[$i]) ^ ord($secret[$i]));
modules/webmailtotp/include/totp.php       61)     }
modules/webmailtotp/include/totp.php       62)     DEBUG(array($oldpw, $newpw));
modules/webmailtotp/include/totp.php       63)     $args = array(":uid" => $_SESSION['userinfo']['uid'],

modules/webmailtotp/include/totp.php       64)                 ":username" => $username,
modules/webmailtotp/include/totp.php       65)                 ":code" => base64_encode($code));

modules/googleauth/include/googleauth.php  66) 

modules/webmailtotp/include/totp.php       67)     db_query("REPLACE INTO mail.webmail_totp (useraccount, email, webmailpass) VALUES (:uid, :username, :code)", $args);

modules/googleauth/include/googleauth.php  68) }
modules/googleauth/include/googleauth.php  69) 
modules/googleauth/include/googleauth.php  70) 

modules/webmailtotp/include/totp.php       71) function decode_webmail_password($crypted, $webmailpw)

modules/googleauth/include/googleauth.php  72) {

modules/webmailtotp/include/totp.php       73)     $crypted = base64_decode($crypted);
modules/webmailtotp/include/totp.php       74)     $secret = $webmailpw;
modules/webmailtotp/include/totp.php       75)     if (strlen($crypted) > strlen($webmailpw)) {
modules/webmailtotp/include/totp.php       76)         $secret = str_pad($webmailpw, strlen($crypted), $webmailpw);
modules/webmailtotp/include/totp.php       77)     }
modules/webmailtotp/include/totp.php       78)     if (strlen($crypted) < strlen($webmailpw)) {
modules/webmailtotp/include/totp.php       79)         $webmailpw = substr($webmailpw, 0, strlen($crypted));
modules/webmailtotp/include/totp.php       80)     }
modules/webmailtotp/include/totp.php       81)     $clear = '';
modules/webmailtotp/include/totp.php       82)     for ($i = 0 ; $i != strlen($crypted) ; $i++) {
modules/webmailtotp/include/totp.php       83)         $clear .= chr(ord($crypted[$i]) ^ ord($secret[$i]));
modules/webmailtotp/include/totp.php       84)     }
modules/webmailtotp/include/totp.php       85)     DEBUG('decrypted: '.$clear);
modules/webmailtotp/include/totp.php       86)     return $clear;

modules/googleauth/include/googleauth.php  87) }
modules/googleauth/include/googleauth.php  88) 
modules/googleauth/include/googleauth.php  89) 

modules/webmailtotp/include/totp.php       90) function get_imap_password($username, $webmailpass)
modules/webmailtotp/include/totp.php       91) {
modules/webmailtotp/include/totp.php       92)     $result = db_query("SELECT webmailpass FROM mail.webmail_totp WHERE email=?", array($username));
modules/webmailtotp/include/totp.php       93)     $tmp = $result->fetch();

modules/webmailtotp/include/totp.php       94) 

modules/webmailtotp/include/totp.php       95)     $crypted = $tmp['webmailpass'];

modules/webmailtotp/include/totp.php       96) 

modules/webmailtotp/include/totp.php       97)     $clear = decode_webmail_password($crypted, $webmailpass);
modules/webmailtotp/include/totp.php       98)     return $clear;

modules/googleauth/include/googleauth.php  99) }

modules/googleauth/include/googleauth.php 100) 

modules/googleauth/include/googleauth.php 101) 
modules/googleauth/include/googleauth.php 102) function check_webmail_password($username, $webmailpass)
modules/googleauth/include/googleauth.php 103) {

modules/webmailtotp/include/totp.php      104)     $clear = get_imap_password($username, $webmailpass);
modules/webmailtotp/include/totp.php      105)     return validate_password($username, $clear);

modules/googleauth/include/googleauth.php 106) }
modules/googleauth/include/googleauth.php 107) 
modules/googleauth/include/googleauth.php 108) 
modules/googleauth/include/googleauth.php 109) function generate_secret($username)
modules/googleauth/include/googleauth.php 110) {

modules/webmailtotp/include/totp.php      111)     $ga = new PHPGangsta_GoogleAuthenticator();

modules/webmailtotp/include/totp.php      112) 

modules/webmailtotp/include/totp.php      113)     $secret = $ga->createSecret();
modules/webmailtotp/include/totp.php      114)     DEBUG('GA-Secret: '.$secret);
modules/webmailtotp/include/totp.php      115)     DEBUG('QrCode: '.$ga->getQRCodeGoogleUrl('Blog', $secret));
modules/webmailtotp/include/totp.php      116)     $args = array(":secret" => $secret, ":username" => $username);
modules/webmailtotp/include/totp.php      117)     db_query("UPDATE mail.webmail_totp SET totp_secret=:secret WHERE email=:username", $args);
modules/webmailtotp/include/totp.php      118)     return $secret;

modules/googleauth/include/googleauth.php 119) }
modules/googleauth/include/googleauth.php 120) 

modules/webmailtotp/include/totp.php      121) function check_locked($username)

modules/googleauth/include/googleauth.php 122) {

modules/webmailtotp/include/totp.php      123)     $result = db_query("SELECT 1 FROM mail.webmail_totp WHERE unlock_timestamp IS NOT NULL and unlock_timestamp > NOW() AND email=?", array($username));
modules/webmailtotp/include/totp.php      124)     return ($result->rowCount() > 0);

modules/googleauth/include/googleauth.php 125) }
modules/googleauth/include/googleauth.php 126) 

modules/webmailtotp/include/totp.php      127) function check_totp($username, $code)
modules/webmailtotp/include/totp.php      128) {
modules/webmailtotp/include/totp.php      129)     if (check_blacklist($username, $code)) {
modules/webmailtotp/include/totp.php      130)         DEBUG('Replay-Attack');
modules/webmailtotp/include/totp.php      131)         return false;
modules/webmailtotp/include/totp.php      132)     }

modules/googleauth/include/googleauth.php 133) 

modules/webmailtotp/include/totp.php      134)     $result = db_query("SELECT totp_secret, failures FROM mail.webmail_totp WHERE email=? AND (unlock_timestamp IS NULL OR unlock_timestamp <= NOW())", array($username));
modules/webmailtotp/include/totp.php      135)     $tmp = $result->fetch();
modules/webmailtotp/include/totp.php      136)     $secret = $tmp['totp_secret'];

modules/googleauth/include/googleauth.php 137) 

modules/webmailtotp/include/totp.php      138)     $ga = new PHPGangsta_GoogleAuthenticator();

modules/webmailtotp/include/totp.php      139) 

modules/webmailtotp/include/totp.php      140)     $checkResult = $ga->verifyCode($secret, $code, 2);    // 2 = 2*30sec clock tolerance
modules/webmailtotp/include/totp.php      141)     if ($checkResult) {
modules/webmailtotp/include/totp.php      142)         db_query("UPDATE mail.webmail_totp SET failures = 0, unlock_timestamp=NULL WHERE email=?", array($username));
modules/webmailtotp/include/totp.php      143)         blacklist_token($username, $code);
modules/webmailtotp/include/totp.php      144)         DEBUG('OK');

modules/googleauth/include/googleauth.php 145)     } else {

modules/webmailtotp/include/totp.php      146)         if ($tmp['failures'] > 0 && $tmp['failures'] % 5 == 0) {
modules/webmailtotp/include/totp.php      147)             db_query("UPDATE mail.webmail_totp SET failures = failures+1, unlock_timestamp = NOW() + INTERVAL 5 MINUTE WHERE email=?", array($username));
modules/webmailtotp/include/totp.php      148)         } else {
modules/webmailtotp/include/totp.php      149)             db_query("UPDATE mail.webmail_totp SET failures = failures+1 WHERE email=?", array($username));
modules/webmailtotp/include/totp.php      150)         }

modules/webmailtotp/include/totp.php      151) 

modules/webmailtotp/include/totp.php      152)         DEBUG('FAILED');
modules/webmailtotp/include/totp.php      153)     }
modules/webmailtotp/include/totp.php      154)     return $checkResult;

modules/googleauth/include/googleauth.php 155) }
modules/googleauth/include/googleauth.php 156) 

modules/webmailtotp/include/totp.php      157) function generate_qrcode_image($secret)
modules/webmailtotp/include/totp.php      158) {
modules/webmailtotp/include/totp.php      159)     $url = 'otpauth://totp/Webmail?secret='.$secret;

modules/webmailtotp/include/totp.php      160) 

modules/webmailtotp/include/totp.php      161)     $descriptorspec = array(

modules/googleauth/include/googleauth.php 162)     0 => array("pipe", "r"),  // STDIN ist eine Pipe, von der das Child liest
modules/googleauth/include/googleauth.php 163)     1 => array("pipe", "w"),  // STDOUT ist eine Pipe, in die das Child schreibt

modules/webmailtotp/include/totp.php      164)     2 => array("pipe", "w")

modules/googleauth/include/googleauth.php 165)   );
modules/googleauth/include/googleauth.php 166) 

modules/webmailtotp/include/totp.php      167)     $process = proc_open('qrencode -t PNG -s 5 -o -', $descriptorspec, $pipes);

modules/googleauth/include/googleauth.php 168) 

modules/webmailtotp/include/totp.php      169)     if (is_resource($process)) {
modules/webmailtotp/include/totp.php      170)         // $pipes sieht nun so aus:
modules/webmailtotp/include/totp.php      171)         // 0 => Schreibhandle, das auf das Child STDIN verbunden ist
modules/webmailtotp/include/totp.php      172)         // 1 => Lesehandle, das auf das Child STDOUT verbunden ist

modules/googleauth/include/googleauth.php 173) 

modules/webmailtotp/include/totp.php      174)         fwrite($pipes[0], $url);
modules/webmailtotp/include/totp.php      175)         fclose($pipes[0]);

modules/googleauth/include/googleauth.php 176) 

modules/webmailtotp/include/totp.php      177)         $pngdata = stream_get_contents($pipes[1]);
modules/webmailtotp/include/totp.php      178)         fclose($pipes[1]);

modules/googleauth/include/googleauth.php 179) 

modules/webmailtotp/include/totp.php      180)         // Es ist wichtig, dass Sie alle Pipes schließen bevor Sie
modules/webmailtotp/include/totp.php      181)         // proc_close aufrufen, um Deadlocks zu vermeiden
modules/webmailtotp/include/totp.php      182)         $return_value = proc_close($process);

modules/webmailtotp/include/totp.php      183) 

modules/webmailtotp/include/totp.php      184)         return $pngdata;
modules/webmailtotp/include/totp.php      185)     } else {
modules/webmailtotp/include/totp.php      186)         warning('Es ist ein interner Fehler im Webinterface aufgetreten, aufgrund dessen kein QR-Code erstellt werden kann. Sollte dieser Fehler mehrfach auftreten, kontaktieren Sie bitte die Administratoren.');
modules/webmailtotp/include/totp.php      187)     }

modules/googleauth/include/googleauth.php 188) }
modules/googleauth/include/googleauth.php 189) 

modules/webmailtotp/include/totp.php      190) function accountname($id)

modules/googleauth/include/googleauth.php 191) {

modules/webmailtotp/include/totp.php      192)     $args = array(":id" => $id,

modules/webmailtotp/include/totp.php      193)                 ":uid" => $_SESSION['userinfo']['uid']);

modules/webmailtotp/include/totp.php      194)     $result = db_query("SELECT email FROM mail.webmail_totp WHERE id=:id AND useraccount=:uid", $args);
modules/webmailtotp/include/totp.php      195)     if ($tmp = $result->fetch()) {
modules/webmailtotp/include/totp.php      196)         return $tmp['email'];
modules/webmailtotp/include/totp.php      197)     }

modules/googleauth/include/googleauth.php 198) }
modules/googleauth/include/googleauth.php 199) 
modules/googleauth/include/googleauth.php 200) 

modules/webmailtotp/include/totp.php      201) function delete_totp($id)

modules/googleauth/include/googleauth.php 202) {

modules/webmailtotp/include/totp.php      203)     $args = array(":id" => $id,

modules/webmailtotp/include/totp.php      204)                 ":uid" => $_SESSION['userinfo']['uid']);

modules/webmailtotp/include/totp.php      205) 

modules/webmailtotp/include/totp.php      206)     db_query("DELETE FROM mail.webmail_totp WHERE id=:id AND useraccount=:uid", $args);

modules/googleauth/include/googleauth.php 207) }
modules/googleauth/include/googleauth.php 208) 

modules/googleauth/include/googleauth.php 209) 
modules/googleauth/include/googleauth.php 210) function blacklist_token($email, $token)
modules/googleauth/include/googleauth.php 211) {

modules/webmailtotp/include/totp.php      212)     $args = array(":email" => $email, ":token" => $token);
modules/webmailtotp/include/totp.php      213)     db_query("INSERT INTO mail.webmail_totp_blacklist (timestamp, email, token) VALUES (NOW(), :email, :token)", $args);

modules/googleauth/include/googleauth.php 214) }
modules/googleauth/include/googleauth.php 215) 
modules/googleauth/include/googleauth.php 216) function check_blacklist($email, $token)
modules/googleauth/include/googleauth.php 217) {

modules/webmailtotp/include/totp.php      218)     $args = array(":email" => $email, ":token" => $token);
modules/webmailtotp/include/totp.php      219)     db_query("DELETE FROM mail.webmail_totp_blacklist WHERE timestamp < NOW() - INTERVAL 10 MINUTE");
modules/webmailtotp/include/totp.php      220)     $result = db_query("SELECT id FROM mail.webmail_totp_blacklist WHERE email=:email AND token=:token", $args);
modules/webmailtotp/include/totp.php      221)     return ($result->rowCount() > 0);