blallo/tt-rss
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

require entering current one time code to enable otp

Browse source
This commit is contained in:
Andrew Dolgov 2013-04-16 21:07:26 +04:00
parent 6f148528dc
commit 9deca86d96
1 changed files with 29 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
classes/pref/prefs.php
View file

@ -399,8 +399,8 @@ class Pref_Prefs extends Handler_Protected {
parameters: dojo.objectToQuery(this.getValues()),
onComplete: function(transport) {
notify('');
if (transport.responseText.indexOf('ERROR: ') == 0) {
notify_error(transport.responseText.replace('ERROR: ', ''));
if (transport.responseText.indexOf('ERROR:') == 0) {
notify_error(transport.responseText.replace('ERROR:', ''));
} else {
window.location.reload();
}
@ -416,11 +416,13 @@ class Pref_Prefs extends Handler_Protected {
print "<td class=\"prefValue\"><input dojoType=\"dijit.form.ValidationTextBox\" type=\"password\" required=\"1\"
name=\"password\"></td></tr>";
print "<tr><td colspan=\"2\">";
print "<tr><td width=\"40%\">".__("Enter the generated one time password")."</td>";
print "<input dojoType=\"dijit.form.CheckBox\" required=\"1\"
type=\"checkbox\" id=\"enable_otp\" name=\"enable_otp\"/> ";
print "<label for=\"enable_otp\">".__("I have scanned the code and would like to enable OTP")."</label>";
print "<td class=\"prefValue\"><input dojoType=\"dijit.form.ValidationTextBox\" autocomplete=\"off\"
required=\"1\"
name=\"otp\"></td></tr>";
print "<tr><td colspan=\"2\">";
print "</td></tr><tr><td colspan=\"2\">";
@ -957,22 +959,39 @@ class Pref_Prefs extends Handler_Protected {
}
function otpenable() {
$password = db_escape_string($this->link, $_REQUEST["password"]);
$enable_otp = $_REQUEST["enable_otp"] == "on";
require_once "lib/otphp/vendor/base32.php";
require_once "lib/otphp/lib/otp.php";
require_once "lib/otphp/lib/totp.php";
$password = $_REQUEST["password"];
$otp = $_REQUEST["otp"];
global $pluginhost;
$authenticator = $pluginhost->get_plugin($_SESSION["auth_module"]);
if ($authenticator->check_password($_SESSION["uid"], $password)) {
if ($enable_otp) {
$result = db_query($this->link, "SELECT salt
FROM ttrss_users
WHERE id = ".$_SESSION["uid"]);
$base32 = new Base32();
$secret = $base32->encode(sha1(db_fetch_result($result, 0, "salt")));
$topt = new \OTPHP\TOTP($secret);
$otp_check = $topt->now();
if ($otp == $otp_check) {
db_query($this->link, "UPDATE ttrss_users SET otp_enabled = true WHERE
id = " . $_SESSION["uid"]);
print "OK";
} else {
print "ERROR:".__("Incorrect one time password");
}
} else {
print "ERROR: ".__("Incorrect password");
print "ERROR:".__("Incorrect password");
}
}