Browse code

Use GoogleAuthenticator from composer

Hanno authored on26/06/2018 14:42:47
Showing4 changed files
... ...
@@ -6,6 +6,7 @@
6 6
         "bjeavons/zxcvbn-php": "0.3",
7 7
         "giggsey/libphonenumber-for-php": "^8.8",
8 8
         "globalcitizen/php-iban": "^2.6",
9
-        "mpdf/mpdf": "^7.0"
9
+        "mpdf/mpdf": "^7.0",
10
+        "PHPGangsta/GoogleAuthenticator": "dev-master"
10 11
     }
11 12
 }
... ...
@@ -4,7 +4,7 @@
4 4
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file",
5 5
         "This file is @generated automatically"
6 6
     ],
7
-    "content-hash": "d23e4112dab248fe88e5e21fba2f1972",
7
+    "content-hash": "af89b3738a8eb6b4ac7f0e66aa03b1e1",
8 8
     "packages": [
9 9
         {
10 10
             "name": "bjeavons/zxcvbn-php",
... ...
@@ -53,16 +53,16 @@
53 53
         },
54 54
         {
55 55
             "name": "giggsey/libphonenumber-for-php",
56
-            "version": "8.8.9",
56
+            "version": "8.9.8",
57 57
             "source": {
58 58
                 "type": "git",
59 59
                 "url": "https://github.com/giggsey/libphonenumber-for-php.git",
60
-                "reference": "44e2fb8ee3a62c3fd00fb8a37fe0bad394992c2e"
60
+                "reference": "420621360d56499ac1b0e6293561ed8661017c6b"
61 61
             },
62 62
             "dist": {
63 63
                 "type": "zip",
64
-                "url": "https://api.github.com/repos/giggsey/libphonenumber-for-php/zipball/44e2fb8ee3a62c3fd00fb8a37fe0bad394992c2e",
65
-                "reference": "44e2fb8ee3a62c3fd00fb8a37fe0bad394992c2e",
64
+                "url": "https://api.github.com/repos/giggsey/libphonenumber-for-php/zipball/420621360d56499ac1b0e6293561ed8661017c6b",
65
+                "reference": "420621360d56499ac1b0e6293561ed8661017c6b",
66 66
                 "shasum": ""
67 67
             },
68 68
             "require": {
... ...
@@ -76,7 +76,7 @@
76 76
                 "pear/versioncontrol_git": "^0.5",
77 77
                 "phing/phing": "^2.7",
78 78
                 "phpunit/phpunit": "^4.8|^5.0",
79
-                "satooshi/php-coveralls": "^1.0",
79
+                "satooshi/php-coveralls": "^1.0|^2.0",
80 80
                 "symfony/console": "^2.8|^3.0"
81 81
             },
82 82
             "type": "library",
... ...
@@ -117,20 +117,20 @@
117 117
                 "phonenumber",
118 118
                 "validation"
119 119
             ],
120
-            "time": "2018-01-09T19:14:30+00:00"
120
+            "time": "2018-06-14T11:25:48+00:00"
121 121
         },
122 122
         {
123 123
             "name": "giggsey/locale",
124
-            "version": "1.4",
124
+            "version": "1.5",
125 125
             "source": {
126 126
                 "type": "git",
127 127
                 "url": "https://github.com/giggsey/Locale.git",
128
-                "reference": "e351a72ad6af6b41b690efdeffe1138fe5cc8b9c"
128
+                "reference": "3c9cc23c15851c54cb3ccd41a00fd4b5a89feeff"
129 129
             },
130 130
             "dist": {
131 131
                 "type": "zip",
132
-                "url": "https://api.github.com/repos/giggsey/Locale/zipball/e351a72ad6af6b41b690efdeffe1138fe5cc8b9c",
133
-                "reference": "e351a72ad6af6b41b690efdeffe1138fe5cc8b9c",
132
+                "url": "https://api.github.com/repos/giggsey/Locale/zipball/3c9cc23c15851c54cb3ccd41a00fd4b5a89feeff",
133
+                "reference": "3c9cc23c15851c54cb3ccd41a00fd4b5a89feeff",
134 134
                 "shasum": ""
135 135
             },
136 136
             "require": {
... ...
@@ -143,10 +143,10 @@
143 143
                 "phing/phing": "~2.7",
144 144
                 "phpunit/phpunit": "^4.8|^5.0",
145 145
                 "satooshi/php-coveralls": "^1.0",
146
-                "symfony/console": "^2.8|^3.0",
147
-                "symfony/filesystem": "^2.8|^3.0",
148
-                "symfony/finder": "^2.8|^3.0",
149
-                "symfony/process": "^2.8|^3.0"
146
+                "symfony/console": "^2.8|^3.0|^4.0",
147
+                "symfony/filesystem": "^2.8|^3.0|^4.0",
148
+                "symfony/finder": "^2.8|^3.0|^4.0",
149
+                "symfony/process": "^2.8|^3.0|^4.0"
150 150
             },
151 151
             "type": "library",
152 152
             "autoload": {
... ...
@@ -166,20 +166,20 @@
166 166
                 }
167 167
             ],
168 168
             "description": "Locale functions required by libphonenumber-for-php",
169
-            "time": "2017-11-01T21:34:27+00:00"
169
+            "time": "2018-04-03T15:53:12+00:00"
170 170
         },
171 171
         {
172 172
             "name": "globalcitizen/php-iban",
173
-            "version": "v2.6.1",
173
+            "version": "v2.6.6",
174 174
             "source": {
175 175
                 "type": "git",
176 176
                 "url": "https://github.com/globalcitizen/php-iban.git",
177
-                "reference": "3de32bd2c02ebb5fe0694fd28d2d1a5d2f0ec291"
177
+                "reference": "fd98bd7b4b71cc1bd2a3ecf16fd79b71b44004a1"
178 178
             },
179 179
             "dist": {
180 180
                 "type": "zip",
181
-                "url": "https://api.github.com/repos/globalcitizen/php-iban/zipball/3de32bd2c02ebb5fe0694fd28d2d1a5d2f0ec291",
182
-                "reference": "3de32bd2c02ebb5fe0694fd28d2d1a5d2f0ec291",
181
+                "url": "https://api.github.com/repos/globalcitizen/php-iban/zipball/fd98bd7b4b71cc1bd2a3ecf16fd79b71b44004a1",
182
+                "reference": "fd98bd7b4b71cc1bd2a3ecf16fd79b71b44004a1",
183 183
                 "shasum": ""
184 184
             },
185 185
             "type": "library",
... ...
@@ -194,25 +194,26 @@
194 194
                 "LGPL-3.0"
195 195
             ],
196 196
             "description": "php-iban is a library for parsing and validating IBAN (and IIBAN) bank account information.",
197
-            "time": "2017-08-10T17:28:10+00:00"
197
+            "time": "2018-06-19T23:05:14+00:00"
198 198
         },
199 199
         {
200 200
             "name": "mpdf/mpdf",
201
-            "version": "v7.0.3",
201
+            "version": "v7.1.0",
202 202
             "source": {
203 203
                 "type": "git",
204 204
                 "url": "https://github.com/mpdf/mpdf.git",
205
-                "reference": "5681a0cae1eea197143d5d27f06e19b0523cd8d6"
205
+                "reference": "8e3d0d7bf74f71d04904215fb487d01e924c469a"
206 206
             },
207 207
             "dist": {
208 208
                 "type": "zip",
209
-                "url": "https://api.github.com/repos/mpdf/mpdf/zipball/5681a0cae1eea197143d5d27f06e19b0523cd8d6",
210
-                "reference": "5681a0cae1eea197143d5d27f06e19b0523cd8d6",
209
+                "url": "https://api.github.com/repos/mpdf/mpdf/zipball/8e3d0d7bf74f71d04904215fb487d01e924c469a",
210
+                "reference": "8e3d0d7bf74f71d04904215fb487d01e924c469a",
211 211
                 "shasum": ""
212 212
             },
213 213
             "require": {
214 214
                 "ext-gd": "*",
215 215
                 "ext-mbstring": "*",
216
+                "myclabs/deep-copy": "^1.7",
216 217
                 "paragonie/random_compat": "^1.4|^2.0",
217 218
                 "php": "^5.6 || ~7.0.0 || ~7.1.0 || ~7.2.0",
218 219
                 "psr/log": "^1.0",
... ...
@@ -242,7 +243,7 @@
242 243
             },
243 244
             "notification-url": "https://packagist.org/downloads/",
244 245
             "license": [
245
-                "GPL-2.0"
246
+                "GPL-2.0-only"
246 247
             ],
247 248
             "authors": [
248 249
                 {
... ...
@@ -261,20 +262,68 @@
261 262
                 "php",
262 263
                 "utf-8"
263 264
             ],
264
-            "time": "2018-01-03T07:32:36+00:00"
265
+            "time": "2018-05-18T05:41:37+00:00"
266
+        },
267
+        {
268
+            "name": "myclabs/deep-copy",
269
+            "version": "1.8.1",
270
+            "source": {
271
+                "type": "git",
272
+                "url": "https://github.com/myclabs/DeepCopy.git",
273
+                "reference": "3e01bdad3e18354c3dce54466b7fbe33a9f9f7f8"
274
+            },
275
+            "dist": {
276
+                "type": "zip",
277
+                "url": "https://api.github.com/repos/myclabs/DeepCopy/zipball/3e01bdad3e18354c3dce54466b7fbe33a9f9f7f8",
278
+                "reference": "3e01bdad3e18354c3dce54466b7fbe33a9f9f7f8",
279
+                "shasum": ""
280
+            },
281
+            "require": {
282
+                "php": "^7.1"
283
+            },
284
+            "replace": {
285
+                "myclabs/deep-copy": "self.version"
286
+            },
287
+            "require-dev": {
288
+                "doctrine/collections": "^1.0",
289
+                "doctrine/common": "^2.6",
290
+                "phpunit/phpunit": "^7.1"
291
+            },
292
+            "type": "library",
293
+            "autoload": {
294
+                "psr-4": {
295
+                    "DeepCopy\\": "src/DeepCopy/"
296
+                },
297
+                "files": [
298
+                    "src/DeepCopy/deep_copy.php"
299
+                ]
300
+            },
301
+            "notification-url": "https://packagist.org/downloads/",
302
+            "license": [
303
+                "MIT"
304
+            ],
305
+            "description": "Create deep copies (clones) of your objects",
306
+            "keywords": [
307
+                "clone",
308
+                "copy",
309
+                "duplicate",
310
+                "object",
311
+                "object graph"
312
+            ],
313
+            "time": "2018-06-11T23:09:50+00:00"
265 314
         },
266 315
         {
267 316
             "name": "paragonie/random_compat",
268
-            "version": "v2.0.12",
317
+            "version": "v2.0.15",
269 318
             "source": {
270 319
                 "type": "git",
271 320
                 "url": "https://github.com/paragonie/random_compat.git",
272
-                "reference": "258c89a6b97de7dfaf5b8c7607d0478e236b04fb"
321
+                "reference": "10bcb46e8f3d365170f6de9d05245aa066b81f09"
273 322
             },
274 323
             "dist": {
275 324
                 "type": "zip",
276
-                "url": "https://api.github.com/repos/paragonie/random_compat/zipball/258c89a6b97de7dfaf5b8c7607d0478e236b04fb",
277
-                "reference": "258c89a6b97de7dfaf5b8c7607d0478e236b04fb",
325
+                "url": "https://api.github.com/repos/paragonie/random_compat/zipball/10bcb46e8f3d365170f6de9d05245aa066b81f09",
326
+                "reference": "10bcb46e8f3d365170f6de9d05245aa066b81f09",
278 327
                 "shasum": ""
279 328
             },
280 329
             "require": {
... ...
@@ -306,10 +355,54 @@
306 355
             "description": "PHP 5.x polyfill for random_bytes() and random_int() from PHP 7",
307 356
             "keywords": [
308 357
                 "csprng",
358
+                "polyfill",
309 359
                 "pseudorandom",
310 360
                 "random"
311 361
             ],
312
-            "time": "2018-04-04T21:24:14+00:00"
362
+            "time": "2018-06-08T15:26:40+00:00"
363
+        },
364
+        {
365
+            "name": "phpgangsta/googleauthenticator",
366
+            "version": "dev-master",
367
+            "source": {
368
+                "type": "git",
369
+                "url": "https://github.com/PHPGangsta/GoogleAuthenticator.git",
370
+                "reference": "3baa997f399d4afd5d6a81d42244ec9cc3eeb080"
371
+            },
372
+            "dist": {
373
+                "type": "zip",
374
+                "url": "https://api.github.com/repos/PHPGangsta/GoogleAuthenticator/zipball/3baa997f399d4afd5d6a81d42244ec9cc3eeb080",
375
+                "reference": "3baa997f399d4afd5d6a81d42244ec9cc3eeb080",
376
+                "shasum": ""
377
+            },
378
+            "require": {
379
+                "php": ">=5.3"
380
+            },
381
+            "type": "library",
382
+            "autoload": {
383
+                "classmap": [
384
+                    "PHPGangsta/GoogleAuthenticator.php"
385
+                ]
386
+            },
387
+            "notification-url": "https://packagist.org/downloads/",
388
+            "license": [
389
+                "BSD-4-Clause"
390
+            ],
391
+            "authors": [
392
+                {
393
+                    "name": "Michael Kliewe",
394
+                    "email": "info@phpgangsta.de",
395
+                    "homepage": "http://www.phpgangsta.de/",
396
+                    "role": "Developer"
397
+                }
398
+            ],
399
+            "description": "Google Authenticator 2-factor authentication",
400
+            "keywords": [
401
+                "googleauthenticator",
402
+                "rfc6238",
403
+                "totp"
404
+            ],
405
+            "time": "2016-10-08T16:35:34+00:00"
313 406
         },
314 407
         {
315 408
             "name": "psr/log",
... ...
@@ -411,7 +504,9 @@
411 504
     "packages-dev": [],
412 505
     "aliases": [],
413 506
     "minimum-stability": "stable",
414
-    "stability-flags": [],
507
+    "stability-flags": {
508
+        "phpgangsta/googleauthenticator": 20
509
+    },
415 510
     "prefer-stable": false,
416 511
     "prefer-lowest": false,
417 512
     "platform": [],
418 513
deleted file mode 100644
... ...
@@ -1,201 +0,0 @@
1
-<?php
2
-
3
-/**
4
- * PHP Class for handling Google Authenticator 2-factor authentication
5
- *
6
- * @author Michael Kliewe
7
- * @copyright 2012 Michael Kliewe
8
- * @license http://www.opensource.org/licenses/bsd-license.php BSD License
9
- * @link http://www.phpgangsta.de/
10
- */
11
-
12
-class PHPGangsta_GoogleAuthenticator
13
-{
14
-    protected $_codeLength = 6;
15
-
16
-    /**
17
-     * Create new secret.
18
-     * 16 characters, randomly chosen from the allowed base32 characters.
19
-     *
20
-     * @param int $secretLength
21
-     * @return string
22
-     */
23
-    public function createSecret($secretLength = 16)
24
-    {
25
-        $validChars = $this->_getBase32LookupTable();
26
-        unset($validChars[32]);
27
-
28
-        $secret = '';
29
-        for ($i = 0; $i < $secretLength; $i++) {
30
-            $secret .= $validChars[array_rand($validChars)];
31
-        }
32
-        return $secret;
33
-    }
34
-
35
-    /**
36
-     * Calculate the code, with given secret and point in time
37
-     *
38
-     * @param string $secret
39
-     * @param int|null $timeSlice
40
-     * @return string
41
-     */
42
-    public function getCode($secret, $timeSlice = null)
43
-    {
44
-        if ($timeSlice === null) {
45
-            $timeSlice = floor(time() / 30);
46
-        }
47
-
48
-        $secretkey = $this->_base32Decode($secret);
49
-
50
-        // Pack time into binary string
51
-        $time = chr(0).chr(0).chr(0).chr(0).pack('N*', $timeSlice);
52
-        // Hash it with users secret key
53
-        $hm = hash_hmac('SHA1', $time, $secretkey, true);
54
-        // Use last nipple of result as index/offset
55
-        $offset = ord(substr($hm, -1)) & 0x0F;
56
-        // grab 4 bytes of the result
57
-        $hashpart = substr($hm, $offset, 4);
58
-
59
-        // Unpak binary value
60
-        $value = unpack('N', $hashpart);
61
-        $value = $value[1];
62
-        // Only 32 bits
63
-        $value = $value & 0x7FFFFFFF;
64
-
65
-        $modulo = pow(10, $this->_codeLength);
66
-        return str_pad($value % $modulo, $this->_codeLength, '0', STR_PAD_LEFT);
67
-    }
68
-
69
-    /**
70
-     * Get QR-Code URL for image, from google charts
71
-     *
72
-     * @param string $name
73
-     * @param string $secret
74
-     * @return string
75
-     */
76
-    public function getQRCodeGoogleUrl($name, $secret) {
77
-        $urlencoded = urlencode('otpauth://totp/'.$name.'?secret='.$secret.'');
78
-        return 'https://chart.googleapis.com/chart?chs=200x200&chld=M|0&cht=qr&chl='.$urlencoded.'';
79
-    }
80
-
81
-    /**
82
-     * Check if the code is correct. This will accept codes starting from $discrepancy*30sec ago to $discrepancy*30sec from now
83
-     *
84
-     * @param string $secret
85
-     * @param string $code
86
-     * @param int $discrepancy This is the allowed time drift in 30 second units (8 means 4 minutes before or after)
87
-     * @return bool
88
-     */
89
-    public function verifyCode($secret, $code, $discrepancy = 1)
90
-    {
91
-        $currentTimeSlice = floor(time() / 30);
92
-
93
-        for ($i = -$discrepancy; $i <= $discrepancy; $i++) {
94
-            $calculatedCode = $this->getCode($secret, $currentTimeSlice + $i);
95
-            if ($calculatedCode == $code ) {
96
-                return true;
97
-            }
98
-        }
99
-
100
-        return false;
101
-    }
102
-
103
-    /**
104
-     * Set the code length, should be >=6
105
-     *
106
-     * @param int $length
107
-     * @return PHPGangsta_GoogleAuthenticator
108
-     */
109
-    public function setCodeLength($length)
110
-    {
111
-        $this->_codeLength = $length;
112
-        return $this;
113
-    }
114
-
115
-    /**
116
-     * Helper class to decode base32
117
-     *
118
-     * @param $secret
119
-     * @return bool|string
120
-     */
121
-    protected function _base32Decode($secret)
122
-    {
123
-        if (empty($secret)) return '';
124
-
125
-        $base32chars = $this->_getBase32LookupTable();
126
-        $base32charsFlipped = array_flip($base32chars);
127
-
128
-        $paddingCharCount = substr_count($secret, $base32chars[32]);
129
-        $allowedValues = array(6, 4, 3, 1, 0);
130
-        if (!in_array($paddingCharCount, $allowedValues)) return false;
131
-        for ($i = 0; $i < 4; $i++){
132
-            if ($paddingCharCount == $allowedValues[$i] &&
133
-                substr($secret, -($allowedValues[$i])) != str_repeat($base32chars[32], $allowedValues[$i])) return false;
134
-        }
135
-        $secret = str_replace('=','', $secret);
136
-        $secret = str_split($secret);
137
-        $binaryString = "";
138
-        for ($i = 0; $i < count($secret); $i = $i+8) {
139
-            $x = "";
140
-            if (!in_array($secret[$i], $base32chars)) return false;
141
-            for ($j = 0; $j < 8; $j++) {
142
-                $x .= str_pad(base_convert(@$base32charsFlipped[@$secret[$i + $j]], 10, 2), 5, '0', STR_PAD_LEFT);
143
-            }
144
-            $eightBits = str_split($x, 8);
145
-            for ($z = 0; $z < count($eightBits); $z++) {
146
-                $binaryString .= ( ($y = chr(base_convert($eightBits[$z], 2, 10))) || ord($y) == 48 ) ? $y:"";
147
-            }
148
-        }
149
-        return $binaryString;
150
-    }
151
-
152
-    /**
153
-     * Helper class to encode base32
154
-     *
155
-     * @param string $secret
156
-     * @param bool $padding
157
-     * @return string
158
-     */
159
-    protected function _base32Encode($secret, $padding = true)
160
-    {
161
-        if (empty($secret)) return '';
162
-
163
-        $base32chars = $this->_getBase32LookupTable();
164
-
165
-        $secret = str_split($secret);
166
-        $binaryString = "";
167
-        for ($i = 0; $i < count($secret); $i++) {
168
-            $binaryString .= str_pad(base_convert(ord($secret[$i]), 10, 2), 8, '0', STR_PAD_LEFT);
169
-        }
170
-        $fiveBitBinaryArray = str_split($binaryString, 5);
171
-        $base32 = "";
172
-        $i = 0;
173
-        while ($i < count($fiveBitBinaryArray)) {
174
-            $base32 .= $base32chars[base_convert(str_pad($fiveBitBinaryArray[$i], 5, '0'), 2, 10)];
175
-            $i++;
176
-        }
177
-        if ($padding && ($x = strlen($binaryString) % 40) != 0) {
178
-            if ($x == 8) $base32 .= str_repeat($base32chars[32], 6);
179
-            elseif ($x == 16) $base32 .= str_repeat($base32chars[32], 4);
180
-            elseif ($x == 24) $base32 .= str_repeat($base32chars[32], 3);
181
-            elseif ($x == 32) $base32 .= $base32chars[32];
182
-        }
183
-        return $base32;
184
-    }
185
-
186
-    /**
187
-     * Get array with all 32 characters for decoding from/encoding to base32
188
-     *
189
-     * @return array
190
-     */
191
-    protected function _getBase32LookupTable()
192
-    {
193
-        return array(
194
-            'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', //  7
195
-            'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', // 15
196
-            'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', // 23
197
-            'Y', 'Z', '2', '3', '4', '5', '6', '7', // 31
198
-            '='  // padding char
199
-        );
200
-    }
201
-}
... ...
@@ -14,6 +14,8 @@ http://creativecommons.org/publicdomain/zero/1.0/
14 14
 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.
15 15
 */
16 16
 
17
+require_once('vendor/autoload.php');
18
+
17 19
 function account_has_totp($username)
18 20
 {
19 21
     $result = db_query("SELECT id FROM mail.webmail_totp WHERE email=?", array($username));
... ...
@@ -106,7 +108,6 @@ function check_webmail_password($username, $webmailpass)
106 108
 
107 109
 function generate_secret($username)
108 110
 {
109
-    require_once('external/googleauthenticator/GoogleAuthenticator.php');
110 111
     $ga = new PHPGangsta_GoogleAuthenticator();
111 112
   
112 113
     $secret = $ga->createSecret();
... ...
@@ -134,7 +135,6 @@ function check_totp($username, $code)
134 135
     $tmp = $result->fetch();
135 136
     $secret = $tmp['totp_secret'];
136 137
 
137
-    require_once('external/googleauthenticator/GoogleAuthenticator.php');
138 138
     $ga = new PHPGangsta_GoogleAuthenticator();
139 139
   
140 140
     $checkResult = $ga->verifyCode($secret, $code, 2);    // 2 = 2*30sec clock tolerance