webinterface.git

@@ -6,6 +6,7 @@

         "bjeavons/zxcvbn-php": "0.3",

         "giggsey/libphonenumber-for-php": "^8.8",

         "globalcitizen/php-iban": "^2.6",

-        "mpdf/mpdf": "^7.0"

+        "mpdf/mpdf": "^7.0",

+        "PHPGangsta/GoogleAuthenticator": "dev-master"

     }

 }

@@ -4,7 +4,7 @@

         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file",

         "This file is @generated automatically"

     ],

-    "content-hash": "d23e4112dab248fe88e5e21fba2f1972",

+    "content-hash": "af89b3738a8eb6b4ac7f0e66aa03b1e1",

     "packages": [

         {

             "name": "bjeavons/zxcvbn-php",

@@ -53,16 +53,16 @@

         },

         {

             "name": "giggsey/libphonenumber-for-php",

-            "version": "8.8.9",

+            "version": "8.9.8",

             "source": {

                 "type": "git",

                 "url": "https://github.com/giggsey/libphonenumber-for-php.git",

-                "reference": "44e2fb8ee3a62c3fd00fb8a37fe0bad394992c2e"

+                "reference": "420621360d56499ac1b0e6293561ed8661017c6b"

             },

             "dist": {

                 "type": "zip",

-                "url": "https://api.github.com/repos/giggsey/libphonenumber-for-php/zipball/44e2fb8ee3a62c3fd00fb8a37fe0bad394992c2e",

-                "reference": "44e2fb8ee3a62c3fd00fb8a37fe0bad394992c2e",

+                "url": "https://api.github.com/repos/giggsey/libphonenumber-for-php/zipball/420621360d56499ac1b0e6293561ed8661017c6b",

+                "reference": "420621360d56499ac1b0e6293561ed8661017c6b",

                 "shasum": ""

             },

             "require": {

@@ -76,7 +76,7 @@

                 "pear/versioncontrol_git": "^0.5",

                 "phing/phing": "^2.7",

                 "phpunit/phpunit": "^4.8|^5.0",

-                "satooshi/php-coveralls": "^1.0",

+                "satooshi/php-coveralls": "^1.0|^2.0",

                 "symfony/console": "^2.8|^3.0"

             },

             "type": "library",

@@ -117,20 +117,20 @@

                 "phonenumber",

                 "validation"

             ],

-            "time": "2018-01-09T19:14:30+00:00"

+            "time": "2018-06-14T11:25:48+00:00"

         },

         {

             "name": "giggsey/locale",

-            "version": "1.4",

+            "version": "1.5",

             "source": {

                 "type": "git",

                 "url": "https://github.com/giggsey/Locale.git",

-                "reference": "e351a72ad6af6b41b690efdeffe1138fe5cc8b9c"

+                "reference": "3c9cc23c15851c54cb3ccd41a00fd4b5a89feeff"

             },

             "dist": {

                 "type": "zip",

-                "url": "https://api.github.com/repos/giggsey/Locale/zipball/e351a72ad6af6b41b690efdeffe1138fe5cc8b9c",

-                "reference": "e351a72ad6af6b41b690efdeffe1138fe5cc8b9c",

+                "url": "https://api.github.com/repos/giggsey/Locale/zipball/3c9cc23c15851c54cb3ccd41a00fd4b5a89feeff",

+                "reference": "3c9cc23c15851c54cb3ccd41a00fd4b5a89feeff",

                 "shasum": ""

             },

             "require": {

@@ -143,10 +143,10 @@

                 "phing/phing": "~2.7",

                 "phpunit/phpunit": "^4.8|^5.0",

                 "satooshi/php-coveralls": "^1.0",

-                "symfony/console": "^2.8|^3.0",

-                "symfony/filesystem": "^2.8|^3.0",

-                "symfony/finder": "^2.8|^3.0",

-                "symfony/process": "^2.8|^3.0"

+                "symfony/console": "^2.8|^3.0|^4.0",

+                "symfony/filesystem": "^2.8|^3.0|^4.0",

+                "symfony/finder": "^2.8|^3.0|^4.0",

+                "symfony/process": "^2.8|^3.0|^4.0"

             },

             "type": "library",

             "autoload": {

@@ -166,20 +166,20 @@

                 }

             ],

             "description": "Locale functions required by libphonenumber-for-php",

-            "time": "2017-11-01T21:34:27+00:00"

+            "time": "2018-04-03T15:53:12+00:00"

         },

         {

             "name": "globalcitizen/php-iban",

-            "version": "v2.6.1",

+            "version": "v2.6.6",

             "source": {

                 "type": "git",

                 "url": "https://github.com/globalcitizen/php-iban.git",

-                "reference": "3de32bd2c02ebb5fe0694fd28d2d1a5d2f0ec291"

+                "reference": "fd98bd7b4b71cc1bd2a3ecf16fd79b71b44004a1"

             },

             "dist": {

                 "type": "zip",

-                "url": "https://api.github.com/repos/globalcitizen/php-iban/zipball/3de32bd2c02ebb5fe0694fd28d2d1a5d2f0ec291",

-                "reference": "3de32bd2c02ebb5fe0694fd28d2d1a5d2f0ec291",

+                "url": "https://api.github.com/repos/globalcitizen/php-iban/zipball/fd98bd7b4b71cc1bd2a3ecf16fd79b71b44004a1",

+                "reference": "fd98bd7b4b71cc1bd2a3ecf16fd79b71b44004a1",

                 "shasum": ""

             },

             "type": "library",

@@ -194,25 +194,26 @@

                 "LGPL-3.0"

             ],

             "description": "php-iban is a library for parsing and validating IBAN (and IIBAN) bank account information.",

-            "time": "2017-08-10T17:28:10+00:00"

+            "time": "2018-06-19T23:05:14+00:00"

         },

         {

             "name": "mpdf/mpdf",

-            "version": "v7.0.3",

+            "version": "v7.1.0",

             "source": {

                 "type": "git",

                 "url": "https://github.com/mpdf/mpdf.git",

-                "reference": "5681a0cae1eea197143d5d27f06e19b0523cd8d6"

+                "reference": "8e3d0d7bf74f71d04904215fb487d01e924c469a"

             },

             "dist": {

                 "type": "zip",

-                "url": "https://api.github.com/repos/mpdf/mpdf/zipball/5681a0cae1eea197143d5d27f06e19b0523cd8d6",

-                "reference": "5681a0cae1eea197143d5d27f06e19b0523cd8d6",

+                "url": "https://api.github.com/repos/mpdf/mpdf/zipball/8e3d0d7bf74f71d04904215fb487d01e924c469a",

+                "reference": "8e3d0d7bf74f71d04904215fb487d01e924c469a",

                 "shasum": ""

             },

             "require": {

                 "ext-gd": "*",

                 "ext-mbstring": "*",

+                "myclabs/deep-copy": "^1.7",

                 "paragonie/random_compat": "^1.4|^2.0",

                 "php": "^5.6 || ~7.0.0 || ~7.1.0 || ~7.2.0",

                 "psr/log": "^1.0",

@@ -242,7 +243,7 @@

             },

             "notification-url": "https://packagist.org/downloads/",

             "license": [

-                "GPL-2.0"

+                "GPL-2.0-only"

             ],

             "authors": [

                 {

@@ -261,20 +262,68 @@

                 "php",

                 "utf-8"

             ],

-            "time": "2018-01-03T07:32:36+00:00"

+            "time": "2018-05-18T05:41:37+00:00"

+        },

+        {

+            "name": "myclabs/deep-copy",

+            "version": "1.8.1",

+            "source": {

+                "type": "git",

+                "url": "https://github.com/myclabs/DeepCopy.git",

+                "reference": "3e01bdad3e18354c3dce54466b7fbe33a9f9f7f8"

+            },

+            "dist": {

+                "type": "zip",

+                "url": "https://api.github.com/repos/myclabs/DeepCopy/zipball/3e01bdad3e18354c3dce54466b7fbe33a9f9f7f8",

+                "reference": "3e01bdad3e18354c3dce54466b7fbe33a9f9f7f8",

+                "shasum": ""

+            },

+            "require": {

+                "php": "^7.1"

+            },

+            "replace": {

+                "myclabs/deep-copy": "self.version"

+            },

+            "require-dev": {

+                "doctrine/collections": "^1.0",

+                "doctrine/common": "^2.6",

+                "phpunit/phpunit": "^7.1"

+            },

+            "type": "library",

+            "autoload": {

+                "psr-4": {

+                    "DeepCopy\\": "src/DeepCopy/"

+                },

+                "files": [

+                    "src/DeepCopy/deep_copy.php"

+                ]

+            },

+            "notification-url": "https://packagist.org/downloads/",

+            "license": [

+                "MIT"

+            ],

+            "description": "Create deep copies (clones) of your objects",

+            "keywords": [

+                "clone",

+                "copy",

+                "duplicate",

+                "object",

+                "object graph"

+            ],

+            "time": "2018-06-11T23:09:50+00:00"

         },

         {

             "name": "paragonie/random_compat",

-            "version": "v2.0.12",

+            "version": "v2.0.15",

             "source": {

                 "type": "git",

                 "url": "https://github.com/paragonie/random_compat.git",

-                "reference": "258c89a6b97de7dfaf5b8c7607d0478e236b04fb"

+                "reference": "10bcb46e8f3d365170f6de9d05245aa066b81f09"

             },

             "dist": {

                 "type": "zip",

-                "url": "https://api.github.com/repos/paragonie/random_compat/zipball/258c89a6b97de7dfaf5b8c7607d0478e236b04fb",

-                "reference": "258c89a6b97de7dfaf5b8c7607d0478e236b04fb",

+                "url": "https://api.github.com/repos/paragonie/random_compat/zipball/10bcb46e8f3d365170f6de9d05245aa066b81f09",

+                "reference": "10bcb46e8f3d365170f6de9d05245aa066b81f09",

                 "shasum": ""

             },

             "require": {

@@ -306,10 +355,54 @@

             "description": "PHP 5.x polyfill for random_bytes() and random_int() from PHP 7",

             "keywords": [

                 "csprng",

+                "polyfill",

                 "pseudorandom",

                 "random"

             ],

-            "time": "2018-04-04T21:24:14+00:00"

+            "time": "2018-06-08T15:26:40+00:00"

+        },

+        {

+            "name": "phpgangsta/googleauthenticator",

+            "version": "dev-master",

+            "source": {

+                "type": "git",

+                "url": "https://github.com/PHPGangsta/GoogleAuthenticator.git",

+                "reference": "3baa997f399d4afd5d6a81d42244ec9cc3eeb080"

+            },

+            "dist": {

+                "type": "zip",

+                "url": "https://api.github.com/repos/PHPGangsta/GoogleAuthenticator/zipball/3baa997f399d4afd5d6a81d42244ec9cc3eeb080",

+                "reference": "3baa997f399d4afd5d6a81d42244ec9cc3eeb080",

+                "shasum": ""

+            },

+            "require": {

+                "php": ">=5.3"

+            },

+            "type": "library",

+            "autoload": {

+                "classmap": [

+                    "PHPGangsta/GoogleAuthenticator.php"

+                ]

+            },

+            "notification-url": "https://packagist.org/downloads/",

+            "license": [

+                "BSD-4-Clause"

+            ],

+            "authors": [

+                {

+                    "name": "Michael Kliewe",

+                    "email": "info@phpgangsta.de",

+                    "homepage": "http://www.phpgangsta.de/",

+                    "role": "Developer"

+                }

+            ],

+            "description": "Google Authenticator 2-factor authentication",

+            "keywords": [

+                "googleauthenticator",

+                "rfc6238",

+                "totp"

+            ],

+            "time": "2016-10-08T16:35:34+00:00"

         },

         {

             "name": "psr/log",

@@ -411,7 +504,9 @@

     "packages-dev": [],

     "aliases": [],

     "minimum-stability": "stable",

-    "stability-flags": [],

+    "stability-flags": {

+        "phpgangsta/googleauthenticator": 20

+    },

     "prefer-stable": false,

     "prefer-lowest": false,

     "platform": [],

@@ -1,201 +0,0 @@

-<?php

-

-/**

- * PHP Class for handling Google Authenticator 2-factor authentication

- *

- * @author Michael Kliewe

- * @copyright 2012 Michael Kliewe

- * @license http://www.opensource.org/licenses/bsd-license.php BSD License

- * @link http://www.phpgangsta.de/

- */

-

-class PHPGangsta_GoogleAuthenticator

-{

-    protected $_codeLength = 6;

-

-    /**

-     * Create new secret.

-     * 16 characters, randomly chosen from the allowed base32 characters.

-     *

-     * @param int $secretLength

-     * @return string

-     */

-    public function createSecret($secretLength = 16)

-    {

-        $validChars = $this->_getBase32LookupTable();

-        unset($validChars[32]);

-

-        $secret = '';

-        for ($i = 0; $i < $secretLength; $i++) {

-            $secret .= $validChars[array_rand($validChars)];

-        }

-        return $secret;

-    }

-

-    /**

-     * Calculate the code, with given secret and point in time

-     *

-     * @param string $secret

-     * @param int|null $timeSlice

-     * @return string

-     */

-    public function getCode($secret, $timeSlice = null)

-    {

-        if ($timeSlice === null) {

-            $timeSlice = floor(time() / 30);

-        }

-

-        $secretkey = $this->_base32Decode($secret);

-

-        // Pack time into binary string

-        $time = chr(0).chr(0).chr(0).chr(0).pack('N*', $timeSlice);

-        // Hash it with users secret key

-        $hm = hash_hmac('SHA1', $time, $secretkey, true);

-        // Use last nipple of result as index/offset

-        $offset = ord(substr($hm, -1)) & 0x0F;

-        // grab 4 bytes of the result

-        $hashpart = substr($hm, $offset, 4);

-

-        // Unpak binary value

-        $value = unpack('N', $hashpart);

-        $value = $value[1];

-        // Only 32 bits

-        $value = $value & 0x7FFFFFFF;

-

-        $modulo = pow(10, $this->_codeLength);

-        return str_pad($value % $modulo, $this->_codeLength, '0', STR_PAD_LEFT);

-    }

-

-    /**

-     * Get QR-Code URL for image, from google charts

-     *

-     * @param string $name

-     * @param string $secret

-     * @return string

-     */

-    public function getQRCodeGoogleUrl($name, $secret) {

-        $urlencoded = urlencode('otpauth://totp/'.$name.'?secret='.$secret.'');

-        return 'https://chart.googleapis.com/chart?chs=200x200&chld=M|0&cht=qr&chl='.$urlencoded.'';

-    }

-

-    /**

-     * Check if the code is correct. This will accept codes starting from $discrepancy*30sec ago to $discrepancy*30sec from now

-     *

-     * @param string $secret

-     * @param string $code

-     * @param int $discrepancy This is the allowed time drift in 30 second units (8 means 4 minutes before or after)

-     * @return bool

-     */

-    public function verifyCode($secret, $code, $discrepancy = 1)

-    {

-        $currentTimeSlice = floor(time() / 30);

-

-        for ($i = -$discrepancy; $i <= $discrepancy; $i++) {

-            $calculatedCode = $this->getCode($secret, $currentTimeSlice + $i);

-            if ($calculatedCode == $code ) {

-                return true;

-            }

-        }

-

-        return false;

-    }

-

-    /**

-     * Set the code length, should be >=6

-     *

-     * @param int $length

-     * @return PHPGangsta_GoogleAuthenticator

-     */

-    public function setCodeLength($length)

-    {

-        $this->_codeLength = $length;

-        return $this;

-    }

-

-    /**

-     * Helper class to decode base32

-     *

-     * @param $secret

-     * @return bool|string

-     */

-    protected function _base32Decode($secret)

-    {

-        if (empty($secret)) return '';

-

-        $base32chars = $this->_getBase32LookupTable();

-        $base32charsFlipped = array_flip($base32chars);

-

-        $paddingCharCount = substr_count($secret, $base32chars[32]);

-        $allowedValues = array(6, 4, 3, 1, 0);

-        if (!in_array($paddingCharCount, $allowedValues)) return false;

-        for ($i = 0; $i < 4; $i++){

-            if ($paddingCharCount == $allowedValues[$i] &&

-                substr($secret, -($allowedValues[$i])) != str_repeat($base32chars[32], $allowedValues[$i])) return false;

-        }

-        $secret = str_replace('=','', $secret);

-        $secret = str_split($secret);

-        $binaryString = "";

-        for ($i = 0; $i < count($secret); $i = $i+8) {

-            $x = "";

-            if (!in_array($secret[$i], $base32chars)) return false;

-            for ($j = 0; $j < 8; $j++) {

-                $x .= str_pad(base_convert(@$base32charsFlipped[@$secret[$i + $j]], 10, 2), 5, '0', STR_PAD_LEFT);

-            }

-            $eightBits = str_split($x, 8);

-            for ($z = 0; $z < count($eightBits); $z++) {

-                $binaryString .= ( ($y = chr(base_convert($eightBits[$z], 2, 10))) || ord($y) == 48 ) ? $y:"";

-            }

-        }

-        return $binaryString;

-    }

-

-    /**

-     * Helper class to encode base32

-     *

-     * @param string $secret

-     * @param bool $padding

-     * @return string

-     */

-    protected function _base32Encode($secret, $padding = true)

-    {

-        if (empty($secret)) return '';

-

-        $base32chars = $this->_getBase32LookupTable();

-

-        $secret = str_split($secret);

-        $binaryString = "";

-        for ($i = 0; $i < count($secret); $i++) {

-            $binaryString .= str_pad(base_convert(ord($secret[$i]), 10, 2), 8, '0', STR_PAD_LEFT);

-        }

-        $fiveBitBinaryArray = str_split($binaryString, 5);

-        $base32 = "";

-        $i = 0;

-        while ($i < count($fiveBitBinaryArray)) {

-            $base32 .= $base32chars[base_convert(str_pad($fiveBitBinaryArray[$i], 5, '0'), 2, 10)];

-            $i++;

-        }

-        if ($padding && ($x = strlen($binaryString) % 40) != 0) {

-            if ($x == 8) $base32 .= str_repeat($base32chars[32], 6);

-            elseif ($x == 16) $base32 .= str_repeat($base32chars[32], 4);

-            elseif ($x == 24) $base32 .= str_repeat($base32chars[32], 3);

-            elseif ($x == 32) $base32 .= $base32chars[32];

-        }

-        return $base32;

-    }

-

-    /**

-     * Get array with all 32 characters for decoding from/encoding to base32

-     *

-     * @return array

-     */

-    protected function _getBase32LookupTable()

-    {

-        return array(

-            'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', //  7

-            'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', // 15

-            'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', // 23

-            'Y', 'Z', '2', '3', '4', '5', '6', '7', // 31

-            '='  // padding char

-        );

-    }

-}

@@ -14,6 +14,8 @@ http://creativecommons.org/publicdomain/zero/1.0/

 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

 */

+require_once('vendor/autoload.php');

+

 function account_has_totp($username)

 {

     $result = db_query("SELECT id FROM mail.webmail_totp WHERE email=?", array($username));

@@ -106,7 +108,6 @@ function check_webmail_password($username, $webmailpass)

 function generate_secret($username)

 {

-    require_once('external/googleauthenticator/GoogleAuthenticator.php');

     $ga = new PHPGangsta_GoogleAuthenticator();

     $secret = $ga->createSecret();

@@ -134,7 +135,6 @@ function check_totp($username, $code)

     $tmp = $result->fetch();

     $secret = $tmp['totp_secret'];

-    require_once('external/googleauthenticator/GoogleAuthenticator.php');

     $ga = new PHPGangsta_GoogleAuthenticator();

     $checkResult = $ga->verifyCode($secret, $code, 2);    // 2 = 2*30sec clock tolerance