webinterface.git

modules/googleauth/include/googleauth.php   1) <?php
modules/googleauth/include/googleauth.php   2) /*
modules/googleauth/include/googleauth.php   3) This file belongs to the Webinterface of schokokeks.org Hosting
modules/googleauth/include/googleauth.php   4) 

modules/webmailtotp/include/totp.php        5) Written 2008-2018 by schokokeks.org Hosting, namely

modules/googleauth/include/googleauth.php   6)   Bernd Wurst <bernd@schokokeks.org>
modules/googleauth/include/googleauth.php   7)   Hanno Böck <hanno@schokokeks.org>
modules/googleauth/include/googleauth.php   8) 
modules/googleauth/include/googleauth.php   9) To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.
modules/googleauth/include/googleauth.php  10) 

modules/webmailtotp/include/totp.php       11) You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see

modules/googleauth/include/googleauth.php  12) http://creativecommons.org/publicdomain/zero/1.0/
modules/googleauth/include/googleauth.php  13) 
modules/googleauth/include/googleauth.php  14) Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.
modules/googleauth/include/googleauth.php  15) */
modules/googleauth/include/googleauth.php  16) 

modules/webmailtotp/include/totp.php       17) require_once('vendor/autoload.php');
modules/webmailtotp/include/totp.php       18) 

modules/webmailtotp/include/totp.php       19) function account_has_totp($username)

modules/googleauth/include/googleauth.php  20) {

modules/webmailtotp/include/totp.php       21)     $result = db_query("SELECT id FROM mail.webmail_totp WHERE email=?", [$username]);

modules/webmailtotp/include/totp.php       22)     if ($result->rowCount() > 0) {
modules/webmailtotp/include/totp.php       23)         $tmp = $result->fetch();
modules/webmailtotp/include/totp.php       24)         $id = $tmp['id'];
modules/webmailtotp/include/totp.php       25)         return $id;
modules/webmailtotp/include/totp.php       26)     } else {
modules/webmailtotp/include/totp.php       27)         return false;
modules/webmailtotp/include/totp.php       28)     }

modules/googleauth/include/googleauth.php  29) }
modules/googleauth/include/googleauth.php  30) 
modules/googleauth/include/googleauth.php  31) 
modules/googleauth/include/googleauth.php  32) 

modules/webmailtotp/include/totp.php       33) function validate_password($username, $password)

modules/googleauth/include/googleauth.php  34) {

modules/webmailtotp/include/totp.php       35)     $args[":username"] = $username;
modules/webmailtotp/include/totp.php       36)     $result = db_query("SELECT account, cryptpass FROM mail.courier_mailaccounts WHERE account=:username UNION SELECT account, cryptpass FROM mail.courier_virtual_accounts WHERE account=:username", $args);
modules/webmailtotp/include/totp.php       37)     if ($result->rowCount() != 1) {
modules/webmailtotp/include/totp.php       38)         // Kein Account mit dem Namen oder Name nicht eindeutig
modules/webmailtotp/include/totp.php       39)         return false;
modules/webmailtotp/include/totp.php       40)     }
modules/webmailtotp/include/totp.php       41)     $account = $result->fetch();
modules/webmailtotp/include/totp.php       42)     return (crypt($password, $account['cryptpass']) == $account['cryptpass']);

modules/googleauth/include/googleauth.php  43) }
modules/googleauth/include/googleauth.php  44) 
modules/googleauth/include/googleauth.php  45) 
modules/googleauth/include/googleauth.php  46) function store_webmail_password($username, $oldpw, $newpw)
modules/googleauth/include/googleauth.php  47) {

modules/webmailtotp/include/totp.php       48)     $qual = strong_password($newpw);
modules/webmailtotp/include/totp.php       49)     if ($qual !== true) {
modules/webmailtotp/include/totp.php       50)         system_failure('Fehler beim Webmail-Passwort: '.$qual);
modules/webmailtotp/include/totp.php       51)     }

modules/webmailtotp/include/totp.php       52)     $secret = $newpw;
modules/webmailtotp/include/totp.php       53)     if (strlen($oldpw) > strlen($newpw)) {
modules/webmailtotp/include/totp.php       54)         $secret = str_pad($newpw, strlen($oldpw), $newpw);
modules/webmailtotp/include/totp.php       55)     }
modules/webmailtotp/include/totp.php       56)     if (strlen($oldpw) < strlen($newpw)) {
modules/webmailtotp/include/totp.php       57)         $newpw = substr($newpw, 0, strlen($oldpw));
modules/webmailtotp/include/totp.php       58)     }
modules/webmailtotp/include/totp.php       59)     if (strlen($oldpw) != strlen($secret)) {
modules/webmailtotp/include/totp.php       60)         system_failure('Interner Fehler: Passwörter sind nicht gleich lang');
modules/webmailtotp/include/totp.php       61)     }
modules/webmailtotp/include/totp.php       62)     $code = '';
modules/webmailtotp/include/totp.php       63)     for ($i = 0 ; $i != strlen($oldpw) ; $i++) {
modules/webmailtotp/include/totp.php       64)         $code .= chr(ord($oldpw[$i]) ^ ord($secret[$i]));
modules/webmailtotp/include/totp.php       65)     }

modules/webmailtotp/include/totp.php       66)     DEBUG([$oldpw, $newpw]);
modules/webmailtotp/include/totp.php       67)     $args = [":uid" => $_SESSION['userinfo']['uid'],

modules/webmailtotp/include/totp.php       68)                 ":username" => $username,

modules/webmailtotp/include/totp.php       69)                 ":code" => base64_encode($code), ];

modules/googleauth/include/googleauth.php  70) 

modules/webmailtotp/include/totp.php       71)     db_query("REPLACE INTO mail.webmail_totp (useraccount, email, webmailpass) VALUES (:uid, :username, :code)", $args);

modules/googleauth/include/googleauth.php  72) }
modules/googleauth/include/googleauth.php  73) 
modules/googleauth/include/googleauth.php  74) 

modules/webmailtotp/include/totp.php       75) function decode_webmail_password($crypted, $webmailpw)

modules/googleauth/include/googleauth.php  76) {

modules/webmailtotp/include/totp.php       77)     $crypted = base64_decode($crypted);
modules/webmailtotp/include/totp.php       78)     $secret = $webmailpw;
modules/webmailtotp/include/totp.php       79)     if (strlen($crypted) > strlen($webmailpw)) {
modules/webmailtotp/include/totp.php       80)         $secret = str_pad($webmailpw, strlen($crypted), $webmailpw);
modules/webmailtotp/include/totp.php       81)     }
modules/webmailtotp/include/totp.php       82)     if (strlen($crypted) < strlen($webmailpw)) {
modules/webmailtotp/include/totp.php       83)         $webmailpw = substr($webmailpw, 0, strlen($crypted));
modules/webmailtotp/include/totp.php       84)     }
modules/webmailtotp/include/totp.php       85)     $clear = '';
modules/webmailtotp/include/totp.php       86)     for ($i = 0 ; $i != strlen($crypted) ; $i++) {
modules/webmailtotp/include/totp.php       87)         $clear .= chr(ord($crypted[$i]) ^ ord($secret[$i]));
modules/webmailtotp/include/totp.php       88)     }
modules/webmailtotp/include/totp.php       89)     DEBUG('decrypted: '.$clear);
modules/webmailtotp/include/totp.php       90)     return $clear;

modules/googleauth/include/googleauth.php  91) }
modules/googleauth/include/googleauth.php  92) 
modules/googleauth/include/googleauth.php  93) 

modules/webmailtotp/include/totp.php       94) function get_imap_password($username, $webmailpass)
modules/webmailtotp/include/totp.php       95) {

modules/webmailtotp/include/totp.php       96)     $result = db_query("SELECT webmailpass FROM mail.webmail_totp WHERE email=?", [$username]);

modules/webmailtotp/include/totp.php       97)     $tmp = $result->fetch();

modules/webmailtotp/include/totp.php       98) 

modules/webmailtotp/include/totp.php       99)     $crypted = $tmp['webmailpass'];

modules/webmailtotp/include/totp.php      100) 

modules/webmailtotp/include/totp.php      101)     $clear = decode_webmail_password($crypted, $webmailpass);
modules/webmailtotp/include/totp.php      102)     return $clear;

modules/googleauth/include/googleauth.php 103) }

modules/googleauth/include/googleauth.php 104) 

modules/googleauth/include/googleauth.php 105) 
modules/googleauth/include/googleauth.php 106) function check_webmail_password($username, $webmailpass)
modules/googleauth/include/googleauth.php 107) {

modules/webmailtotp/include/totp.php      108)     $clear = get_imap_password($username, $webmailpass);
modules/webmailtotp/include/totp.php      109)     return validate_password($username, $clear);

modules/googleauth/include/googleauth.php 110) }
modules/googleauth/include/googleauth.php 111) 
modules/googleauth/include/googleauth.php 112) 
modules/googleauth/include/googleauth.php 113) function generate_secret($username)
modules/googleauth/include/googleauth.php 114) {

modules/webmailtotp/include/totp.php      115)     $ga = new PHPGangsta_GoogleAuthenticator();

modules/webmailtotp/include/totp.php      116) 

modules/webmailtotp/include/totp.php      117)     $secret = $ga->createSecret();
modules/webmailtotp/include/totp.php      118)     DEBUG('GA-Secret: '.$secret);
modules/webmailtotp/include/totp.php      119)     DEBUG('QrCode: '.$ga->getQRCodeGoogleUrl('Blog', $secret));

modules/webmailtotp/include/totp.php      120)     $args = [":secret" => $secret, ":username" => $username];

modules/webmailtotp/include/totp.php      121)     db_query("UPDATE mail.webmail_totp SET totp_secret=:secret WHERE email=:username", $args);
modules/webmailtotp/include/totp.php      122)     return $secret;

modules/googleauth/include/googleauth.php 123) }
modules/googleauth/include/googleauth.php 124) 

modules/webmailtotp/include/totp.php      125) function check_locked($username)

modules/googleauth/include/googleauth.php 126) {

modules/webmailtotp/include/totp.php      127)     $result = db_query("SELECT 1 FROM mail.webmail_totp WHERE unlock_timestamp IS NOT NULL and unlock_timestamp > NOW() AND email=?", [$username]);

modules/webmailtotp/include/totp.php      128)     return ($result->rowCount() > 0);

modules/googleauth/include/googleauth.php 129) }
modules/googleauth/include/googleauth.php 130) 

modules/webmailtotp/include/totp.php      131) function check_totp($username, $code)
modules/webmailtotp/include/totp.php      132) {
modules/webmailtotp/include/totp.php      133)     if (check_blacklist($username, $code)) {
modules/webmailtotp/include/totp.php      134)         DEBUG('Replay-Attack');
modules/webmailtotp/include/totp.php      135)         return false;
modules/webmailtotp/include/totp.php      136)     }

modules/googleauth/include/googleauth.php 137) 

modules/webmailtotp/include/totp.php      138)     $result = db_query("SELECT totp_secret, failures FROM mail.webmail_totp WHERE email=? AND (unlock_timestamp IS NULL OR unlock_timestamp <= NOW())", [$username]);

modules/webmailtotp/include/totp.php      139)     $tmp = $result->fetch();
modules/webmailtotp/include/totp.php      140)     $secret = $tmp['totp_secret'];

modules/googleauth/include/googleauth.php 141) 

modules/webmailtotp/include/totp.php      142)     $ga = new PHPGangsta_GoogleAuthenticator();

modules/webmailtotp/include/totp.php      143) 

modules/webmailtotp/include/totp.php      144)     $checkResult = $ga->verifyCode($secret, $code, 2);    // 2 = 2*30sec clock tolerance
modules/webmailtotp/include/totp.php      145)     if ($checkResult) {

modules/webmailtotp/include/totp.php      146)         db_query("UPDATE mail.webmail_totp SET failures = 0, unlock_timestamp=NULL WHERE email=?", [$username]);

modules/webmailtotp/include/totp.php      147)         blacklist_token($username, $code);
modules/webmailtotp/include/totp.php      148)         DEBUG('OK');

modules/googleauth/include/googleauth.php 149)     } else {

modules/webmailtotp/include/totp.php      150)         if ($tmp['failures'] > 0 && $tmp['failures'] % 5 == 0) {

modules/webmailtotp/include/totp.php      151)             db_query("UPDATE mail.webmail_totp SET failures = failures+1, unlock_timestamp = NOW() + INTERVAL 5 MINUTE WHERE email=?", [$username]);

modules/webmailtotp/include/totp.php      152)         } else {

modules/webmailtotp/include/totp.php      153)             db_query("UPDATE mail.webmail_totp SET failures = failures+1 WHERE email=?", [$username]);

modules/webmailtotp/include/totp.php      154)         }

modules/webmailtotp/include/totp.php      155) 

modules/webmailtotp/include/totp.php      156)         DEBUG('FAILED');
modules/webmailtotp/include/totp.php      157)     }
modules/webmailtotp/include/totp.php      158)     return $checkResult;

modules/googleauth/include/googleauth.php 159) }
modules/googleauth/include/googleauth.php 160) 

modules/webmailtotp/include/totp.php      161) function generate_qrcode_image($secret)
modules/webmailtotp/include/totp.php      162) {
modules/webmailtotp/include/totp.php      163)     $url = 'otpauth://totp/Webmail?secret='.$secret;

modules/webmailtotp/include/totp.php      164) 

modules/webmailtotp/include/totp.php      165)     $descriptorspec = [
modules/webmailtotp/include/totp.php      166)     0 => ["pipe", "r"],  // STDIN ist eine Pipe, von der das Child liest
modules/webmailtotp/include/totp.php      167)     1 => ["pipe", "w"],  // STDOUT ist eine Pipe, in die das Child schreibt
modules/webmailtotp/include/totp.php      168)     2 => ["pipe", "w"],
modules/webmailtotp/include/totp.php      169)   ];

modules/googleauth/include/googleauth.php 170) 

modules/webmailtotp/include/totp.php      171)     $process = proc_open('qrencode -t PNG -s 5 -o -', $descriptorspec, $pipes);

modules/googleauth/include/googleauth.php 172) 

modules/webmailtotp/include/totp.php      173)     if (is_resource($process)) {
modules/webmailtotp/include/totp.php      174)         // $pipes sieht nun so aus:
modules/webmailtotp/include/totp.php      175)         // 0 => Schreibhandle, das auf das Child STDIN verbunden ist
modules/webmailtotp/include/totp.php      176)         // 1 => Lesehandle, das auf das Child STDOUT verbunden ist

modules/googleauth/include/googleauth.php 177) 

modules/webmailtotp/include/totp.php      178)         fwrite($pipes[0], $url);
modules/webmailtotp/include/totp.php      179)         fclose($pipes[0]);

modules/googleauth/include/googleauth.php 180) 

modules/webmailtotp/include/totp.php      181)         $pngdata = stream_get_contents($pipes[1]);
modules/webmailtotp/include/totp.php      182)         fclose($pipes[1]);

modules/googleauth/include/googleauth.php 183) 

modules/webmailtotp/include/totp.php      184)         // Es ist wichtig, dass Sie alle Pipes schließen bevor Sie
modules/webmailtotp/include/totp.php      185)         // proc_close aufrufen, um Deadlocks zu vermeiden
modules/webmailtotp/include/totp.php      186)         $return_value = proc_close($process);

modules/webmailtotp/include/totp.php      187) 

modules/webmailtotp/include/totp.php      188)         return $pngdata;
modules/webmailtotp/include/totp.php      189)     } else {
modules/webmailtotp/include/totp.php      190)         warning('Es ist ein interner Fehler im Webinterface aufgetreten, aufgrund dessen kein QR-Code erstellt werden kann. Sollte dieser Fehler mehrfach auftreten, kontaktieren Sie bitte die Administratoren.');
modules/webmailtotp/include/totp.php      191)     }

modules/googleauth/include/googleauth.php 192) }
modules/googleauth/include/googleauth.php 193) 

modules/webmailtotp/include/totp.php      194) function accountname($id)

modules/googleauth/include/googleauth.php 195) {

modules/webmailtotp/include/totp.php      196)     $args = [":id" => $id,
modules/webmailtotp/include/totp.php      197)                 ":uid" => $_SESSION['userinfo']['uid'], ];

modules/webmailtotp/include/totp.php      198)     $result = db_query("SELECT email FROM mail.webmail_totp WHERE id=:id AND useraccount=:uid", $args);
modules/webmailtotp/include/totp.php      199)     if ($tmp = $result->fetch()) {
modules/webmailtotp/include/totp.php      200)         return $tmp['email'];
modules/webmailtotp/include/totp.php      201)     }

modules/googleauth/include/googleauth.php 202) }
modules/googleauth/include/googleauth.php 203) 
modules/googleauth/include/googleauth.php 204) 

modules/webmailtotp/include/totp.php      205) function delete_totp($id)

modules/googleauth/include/googleauth.php 206) {

modules/webmailtotp/include/totp.php      207)     $args = [":id" => $id,
modules/webmailtotp/include/totp.php      208)                 ":uid" => $_SESSION['userinfo']['uid'], ];

modules/webmailtotp/include/totp.php      209) 

modules/webmailtotp/include/totp.php      210)     db_query("DELETE FROM mail.webmail_totp WHERE id=:id AND useraccount=:uid", $args);

modules/googleauth/include/googleauth.php 211) }
modules/googleauth/include/googleauth.php 212) 

modules/googleauth/include/googleauth.php 213) 
modules/googleauth/include/googleauth.php 214) function blacklist_token($email, $token)
modules/googleauth/include/googleauth.php 215) {

modules/webmailtotp/include/totp.php      216)     $args = [":email" => $email, ":token" => $token];

modules/webmailtotp/include/totp.php      217)     db_query("INSERT INTO mail.webmail_totp_blacklist (timestamp, email, token) VALUES (NOW(), :email, :token)", $args);

modules/googleauth/include/googleauth.php 218) }
modules/googleauth/include/googleauth.php 219) 
modules/googleauth/include/googleauth.php 220) function check_blacklist($email, $token)
modules/googleauth/include/googleauth.php 221) {

modules/webmailtotp/include/totp.php      222)     $args = [":email" => $email, ":token" => $token];

modules/webmailtotp/include/totp.php      223)     db_query("DELETE FROM mail.webmail_totp_blacklist WHERE timestamp < NOW() - INTERVAL 10 MINUTE");
modules/webmailtotp/include/totp.php      224)     $result = db_query("SELECT id FROM mail.webmail_totp_blacklist WHERE email=:email AND token=:token", $args);
modules/webmailtotp/include/totp.php      225)     return ($result->rowCount() > 0);