flashwave
383e2ed0e0
This one took multiple days and it pretty invasive into the core of Misuzu so issue might (will) arise, there's also some features that have gone temporarily missing in the mean time and some inefficiencies introduced that will be fixed again at a later time. The old class isn't gone entirely because I still have to figure out what I'm gonna do about validation, but for the most part this knocks out one of the "layers of backwards compatibility", as I've been referring to it, and is moving us closer to a future where Flashii actually gets real updates. If you run into anything that's broken and you're inhibited from reporting it through the forum, do it through chat or mail me at flashii-issues@flash.moe.
101 lines
3.2 KiB
PHP
101 lines
3.2 KiB
PHP
<?php
|
|
namespace Misuzu;
|
|
|
|
use RuntimeException;
|
|
use Misuzu\TOTPGenerator;
|
|
|
|
if($msz->isLoggedIn()) {
|
|
url_redirect('index');
|
|
return;
|
|
}
|
|
|
|
$users = $msz->getUsers();
|
|
$sessions = $msz->getSessions();
|
|
$tfaSessions = $msz->getTFASessions();
|
|
$loginAttempts = $msz->getLoginAttempts();
|
|
|
|
$ipAddress = $_SERVER['REMOTE_ADDR'];
|
|
$countryCode = $_SERVER['COUNTRY_CODE'] ?? 'XX';
|
|
$userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
|
|
$twofactor = !empty($_POST['twofactor']) && is_array($_POST['twofactor']) ? $_POST['twofactor'] : [];
|
|
$notices = [];
|
|
|
|
$remainingAttempts = $loginAttempts->countRemainingAttempts($ipAddress);
|
|
|
|
$tokenString = !empty($_GET['token']) && is_string($_GET['token']) ? $_GET['token'] : (
|
|
!empty($twofactor['token']) && is_string($twofactor['token']) ? $twofactor['token'] : ''
|
|
);
|
|
|
|
$tokenUserId = $tfaSessions->getTokenUserId($tokenString);
|
|
if(empty($tokenUserId)) {
|
|
url_redirect('auth-login');
|
|
return;
|
|
}
|
|
|
|
$userInfo = $users->getUser($tokenUserId, 'id');
|
|
|
|
// checking user_totp_key specifically because there's a fringe chance that
|
|
// there's a token present, but totp is actually disabled
|
|
if(!$userInfo->hasTOTPKey()) {
|
|
url_redirect('auth-login');
|
|
return;
|
|
}
|
|
|
|
while(!empty($twofactor)) {
|
|
if(!CSRF::validateRequest()) {
|
|
$notices[] = 'Was unable to verify the request, please try again!';
|
|
break;
|
|
}
|
|
|
|
$userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
|
|
$redirect = !empty($twofactor['redirect']) && is_string($twofactor['redirect']) ? $twofactor['redirect'] : '';
|
|
|
|
if(empty($twofactor['code']) || !is_string($twofactor['code'])) {
|
|
$notices[] = 'Code field was empty.';
|
|
break;
|
|
}
|
|
|
|
if($remainingAttempts < 1) {
|
|
$notices[] = 'There are too many failed login attempts from your IP address, please try again later.';
|
|
break;
|
|
}
|
|
|
|
$clientInfo = ClientInfo::fromRequest();
|
|
$totp = new TOTPGenerator($userInfo->getTOTPKey());
|
|
|
|
if(!in_array($twofactor['code'], $totp->generateRange())) {
|
|
$notices[] = sprintf(
|
|
"Invalid two factor code, %d attempt%s remaining",
|
|
$remainingAttempts - 1,
|
|
$remainingAttempts === 2 ? '' : 's'
|
|
);
|
|
$loginAttempts->recordAttempt(false, $ipAddress, $countryCode, $userAgent, $clientInfo, $userInfo);
|
|
break;
|
|
}
|
|
|
|
$loginAttempts->recordAttempt(true, $ipAddress, $countryCode, $userAgent, $clientInfo, $userInfo);
|
|
$tfaSessions->deleteToken($tokenString);
|
|
|
|
try {
|
|
$sessionInfo = $sessions->createSession($userInfo, $ipAddress, $countryCode, $userAgent, $clientInfo);
|
|
} catch(RuntimeException $ex) {
|
|
$notices[] = "Something broke while creating a session for you, please tell an administrator or developer about this!";
|
|
break;
|
|
}
|
|
|
|
$authToken = AuthToken::create($userInfo, $sessionInfo);
|
|
$authToken->applyCookie($sessionInfo->getExpiresTime());
|
|
|
|
if(!is_local_url($redirect))
|
|
$redirect = url('index');
|
|
|
|
redirect($redirect);
|
|
return;
|
|
}
|
|
|
|
Template::render('auth.twofactor', [
|
|
'twofactor_notices' => $notices,
|
|
'twofactor_redirect' => !empty($_GET['redirect']) && is_string($_GET['redirect']) ? $_GET['redirect'] : url('index'),
|
|
'twofactor_attempts_remaining' => $remainingAttempts,
|
|
'twofactor_token' => $tokenString,
|
|
]);
|