From cf92618c708cc4789651fe3e88acfad0a775e80f Mon Sep 17 00:00:00 2001 From: snipe Date: Wed, 20 Mar 2019 00:49:44 -0700 Subject: [PATCH] Fixed #6834 and #6402 - use inline QR code generation for --- app/Http/Controllers/Auth/LoginController.php | 69 +++--- composer.json | 3 +- composer.lock | 209 +++++++++++------- config/app.php | 2 +- resources/lang/en/auth/message.php | 12 + .../views/auth/two_factor_enroll.blade.php | 2 +- 6 files changed, 192 insertions(+), 105 deletions(-) diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php index cfd9549d4e..99464ffdbe 100644 --- a/app/Http/Controllers/Auth/LoginController.php +++ b/app/Http/Controllers/Auth/LoginController.php @@ -213,22 +213,23 @@ class LoginController extends Controller return redirect()->route('login')->with('error', 'You must be logged in.'); } - $user = Auth::user(); - $google2fa = app()->make('PragmaRX\Google2FA\Contracts\Google2FA'); - if ($user->two_factor_secret=='') { - $user->two_factor_secret = $google2fa->generateSecretKey(32); - $user->save(); + $settings = Setting::getSettings(); + $user = Auth::user(); + + if (($user->two_factor_secret!='') && ($user->two_factor_enrolled==1)) { + return redirect()->route('two-factor')->with('error', 'Your device is already enrolled.'); } - $google2fa_url = $google2fa->getQRCodeGoogleUrl( - urlencode(Setting::getSettings()->site_name), - urlencode($user->username), - $user->two_factor_secret - ); + $google2fa = new Google2FA(); + $secret = $google2fa->generateSecretKey(); + $user->two_factor_secret = $secret; + $user->save(); - return view('auth.two_factor_enroll')->with('google2fa_url', $google2fa_url); + $barcode = new \Com\Tecnick\Barcode\Barcode(); + $barcode_obj = $barcode->getBarcodeObj('QRCODE', 'otpauth://totp/'.urlencode($settings->site_name).':'.urlencode($user->username).'?secret='.urlencode($secret).'&issuer=Snipe-IT&period=30', 300, 300, 'black', array(-2, -2, -2, -2)); + return view('auth.two_factor_enroll')->with('barcode_obj', $barcode_obj); } @@ -240,6 +241,16 @@ class LoginController extends Controller */ public function getTwoFactorAuth() { + if (!Auth::check()) { + return redirect()->route('login')->with('error', 'You must be logged in.'); + } + + $user = Auth::user(); + + if (($user->two_factor_secret=='') || ($user->two_factor_enrolled!=1)) { + return redirect()->route('two-factor-enroll'); + } + return view('auth.two_factor'); } @@ -255,18 +266,22 @@ class LoginController extends Controller return redirect()->route('login')->with('error', 'You must be logged in.'); } - $user = Auth::user(); - $secret = $request->get('two_factor_secret'); - $google2fa = app()->make('PragmaRX\Google2FA\Contracts\Google2FA'); - $valid = $google2fa->verifyKey($user->two_factor_secret, $secret); + if (!$request->has('two_factor_secret')) { + return redirect()->route('two-factor')->with('error', 'Two-factor code is required.'); + } - if ($valid) { + $user = Auth::user(); + $google2fa = new Google2FA(); + $secret = $request->input('two_factor_secret'); + + if ($google2fa->verifyKey($user->two_factor_secret, $secret)) { $user->two_factor_enrolled = 1; $user->save(); $request->session()->put('2fa_authed', 'true'); return redirect()->route('home')->with('success', 'You are logged in!'); } + \Log::debug('Did not match'); return redirect()->route('two-factor')->with('error', 'Invalid two-factor code'); @@ -315,11 +330,11 @@ class LoginController extends Controller } /** - * Redirect the user after determining they are locked out. - * - * @param \Illuminate\Http\Request $request - * @return \Illuminate\Http\RedirectResponse - */ + * Redirect the user after determining they are locked out. + * + * @param \Illuminate\Http\Request $request + * @return \Illuminate\Http\RedirectResponse + */ protected function sendLockoutResponse(Request $request) { $seconds = $this->limiter()->availableIn( @@ -330,18 +345,18 @@ class LoginController extends Controller $message = \Lang::get('auth/message.throttle', ['minutes' => $minutes]); - return redirect()->back() + return redirect()->back() ->withInput($request->only($this->username(), 'remember')) ->withErrors([$this->username() => $message]); } /** - * Override the lockout time and duration - * - * @param \Illuminate\Http\Request $request - * @return \Illuminate\Http\RedirectResponse - */ + * Override the lockout time and duration + * + * @param \Illuminate\Http\Request $request + * @return bool + */ protected function hasTooManyLoginAttempts(Request $request) { $lockoutTime = config('auth.throttle.lockout_duration'); diff --git a/composer.json b/composer.json index 6822043467..33a5a21d67 100644 --- a/composer.json +++ b/composer.json @@ -27,7 +27,8 @@ "patchwork/utf8": "~1.2", "phpdocumentor/reflection-docblock": "3.2.2", "phpspec/prophecy": "1.6.2", - "pragmarx/google2fa": "^1.0", + "pragmarx/google2fa": "^5.0", + "pragmarx/google2fa-laravel": "^0.3.0", "predis/predis": "^1.1", "rollbar/rollbar-laravel": "2.4.1", "schuppo/password-strength": "~1.5", diff --git a/composer.lock b/composer.lock index e42a3de8d3..295ed72d53 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file", "This file is @generated automatically" ], - "content-hash": "f44697f67c1de6fd46cb9a7cb8bc20a6", + "content-hash": "2cca559455a131968b936d097d3fe682", "packages": [ { "name": "barryvdh/laravel-debugbar", @@ -55,60 +55,6 @@ ], "time": "2017-07-21T11:56:48+00:00" }, - { - "name": "christian-riesen/base32", - "version": "1.3.1", - "source": { - "type": "git", - "url": "https://github.com/ChristianRiesen/base32.git", - "reference": "0a31e50c0fa9b1692d077c86ac188eecdcbaf7fa" - }, - "dist": { - "type": "zip", - "url": "https://api.github.com/repos/ChristianRiesen/base32/zipball/0a31e50c0fa9b1692d077c86ac188eecdcbaf7fa", - "reference": "0a31e50c0fa9b1692d077c86ac188eecdcbaf7fa", - "shasum": "" - }, - "require": { - "php": ">=5.3.0" - }, - "require-dev": { - "phpunit/phpunit": "4.*", - "satooshi/php-coveralls": "0.*" - }, - "type": "library", - "extra": { - "branch-alias": { - "dev-master": "1.1.x-dev" - } - }, - "autoload": { - "psr-4": { - "Base32\\": "src/" - } - }, - "notification-url": "https://packagist.org/downloads/", - "license": [ - "MIT" - ], - "authors": [ - { - "name": "Christian Riesen", - "email": "chris.riesen@gmail.com", - "homepage": "http://christianriesen.com", - "role": "Developer" - } - ], - "description": "Base32 encoder/decoder according to RFC 4648", - "homepage": "https://github.com/ChristianRiesen/base32", - "keywords": [ - "base32", - "decode", - "encode", - "rfc4648" - ], - "time": "2016-05-05T11:49:03+00:00" - }, { "name": "defuse/php-encryption", "version": "v2.2.1", @@ -2306,6 +2252,69 @@ ], "time": "2018-02-28T20:30:58+00:00" }, + { + "name": "paragonie/constant_time_encoding", + "version": "v1.0.4", + "source": { + "type": "git", + "url": "https://github.com/paragonie/constant_time_encoding.git", + "reference": "2132f0f293d856026d7d11bd81b9f4a23a1dc1f6" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/paragonie/constant_time_encoding/zipball/2132f0f293d856026d7d11bd81b9f4a23a1dc1f6", + "reference": "2132f0f293d856026d7d11bd81b9f4a23a1dc1f6", + "shasum": "" + }, + "require": { + "php": "^5.3|^7" + }, + "require-dev": { + "paragonie/random_compat": "^1.4|^2", + "phpunit/phpunit": "4.*|5.*", + "vimeo/psalm": "^0.3|^1" + }, + "type": "library", + "autoload": { + "psr-4": { + "ParagonIE\\ConstantTime\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Paragon Initiative Enterprises", + "email": "security@paragonie.com", + "homepage": "https://paragonie.com", + "role": "Maintainer" + }, + { + "name": "Steve 'Sc00bz' Thomas", + "email": "steve@tobtu.com", + "homepage": "https://www.tobtu.com", + "role": "Original Developer" + } + ], + "description": "Constant-time Implementations of RFC 4648 Encoding (Base-64, Base-32, Base-16)", + "keywords": [ + "base16", + "base32", + "base32_decode", + "base32_encode", + "base64", + "base64_decode", + "base64_encode", + "bin2hex", + "encoding", + "hex", + "hex2bin", + "rfc4648" + ], + "time": "2018-04-30T17:57:16+00:00" + }, { "name": "paragonie/random_compat", "version": "v2.0.17", @@ -2717,48 +2726,43 @@ }, { "name": "pragmarx/google2fa", - "version": "v1.0.1", + "version": "v5.0.0", "source": { "type": "git", "url": "https://github.com/antonioribeiro/google2fa.git", - "reference": "b346dc138339b745c5831405d00cff7c1351aa0d" + "reference": "17c969c82f427dd916afe4be50bafc6299aef1b4" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/antonioribeiro/google2fa/zipball/b346dc138339b745c5831405d00cff7c1351aa0d", - "reference": "b346dc138339b745c5831405d00cff7c1351aa0d", + "url": "https://api.github.com/repos/antonioribeiro/google2fa/zipball/17c969c82f427dd916afe4be50bafc6299aef1b4", + "reference": "17c969c82f427dd916afe4be50bafc6299aef1b4", "shasum": "" }, "require": { - "christian-riesen/base32": "~1.3", - "paragonie/random_compat": "~1.4|~2.0", + "paragonie/constant_time_encoding": "~1.0|~2.0", + "paragonie/random_compat": ">=1", "php": ">=5.4", "symfony/polyfill-php56": "~1.2" }, "require-dev": { - "phpspec/phpspec": "~2.1" - }, - "suggest": { - "bacon/bacon-qr-code": "Required to generate inline QR Codes." + "phpunit/phpunit": "~4|~5|~6" }, "type": "library", "extra": { "component": "package", - "frameworks": [ - "Laravel" - ], "branch-alias": { - "dev-master": "1.0-dev" + "dev-master": "2.0-dev" } }, "autoload": { "psr-4": { - "PragmaRX\\Google2FA\\": "src/" + "PragmaRX\\Google2FA\\": "src/", + "PragmaRX\\Google2FA\\Tests\\": "tests/" } }, "notification-url": "https://packagist.org/downloads/", "license": [ - "BSD-3-Clause" + "MIT" ], "authors": [ { @@ -2769,12 +2773,12 @@ ], "description": "A One Time Password Authentication package, compatible with Google Authenticator.", "keywords": [ + "2fa", "Authentication", "Two Factor Authentication", - "google2fa", - "laravel" + "google2fa" ], - "time": "2016-07-18T20:25:04+00:00" + "time": "2019-03-19T22:44:16+00:00" }, { "name": "predis/predis", @@ -4145,7 +4149,7 @@ }, { "name": "Gert de Pagter", - "email": "BackEndTea@gmail.com" + "email": "backendtea@gmail.com" } ], "description": "Symfony polyfill for ctype functions", @@ -5293,6 +5297,60 @@ ], "time": "2016-10-30T11:50:56+00:00" }, + { + "name": "christian-riesen/base32", + "version": "1.3.1", + "source": { + "type": "git", + "url": "https://github.com/ChristianRiesen/base32.git", + "reference": "0a31e50c0fa9b1692d077c86ac188eecdcbaf7fa" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/ChristianRiesen/base32/zipball/0a31e50c0fa9b1692d077c86ac188eecdcbaf7fa", + "reference": "0a31e50c0fa9b1692d077c86ac188eecdcbaf7fa", + "shasum": "" + }, + "require": { + "php": ">=5.3.0" + }, + "require-dev": { + "phpunit/phpunit": "4.*", + "satooshi/php-coveralls": "0.*" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "1.1.x-dev" + } + }, + "autoload": { + "psr-4": { + "Base32\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Christian Riesen", + "email": "chris.riesen@gmail.com", + "homepage": "http://christianriesen.com", + "role": "Developer" + } + ], + "description": "Base32 encoder/decoder according to RFC 4648", + "homepage": "https://github.com/ChristianRiesen/base32", + "keywords": [ + "base32", + "decode", + "encode", + "rfc4648" + ], + "time": "2016-05-05T11:49:03+00:00" + }, { "name": "codeception/codeception", "version": "2.3.6", @@ -5930,6 +5988,7 @@ "mock", "xunit" ], + "abandoned": true, "time": "2017-06-30T09:13:00+00:00" }, { diff --git a/config/app.php b/config/app.php index 73091160c5..8f6ae429a3 100755 --- a/config/app.php +++ b/config/app.php @@ -291,7 +291,7 @@ return [ Collective\Html\HtmlServiceProvider::class, Spatie\Backup\BackupServiceProvider::class, Fideloper\Proxy\TrustedProxyServiceProvider::class, - PragmaRX\Google2FA\Vendor\Laravel\ServiceProvider::class, + PragmaRX\Google2FALaravel\ServiceProvider::class, Laravel\Passport\PassportServiceProvider::class, Laravel\Tinker\TinkerServiceProvider::class, Unicodeveloper\DumbPassword\DumbPasswordServiceProvider::class, diff --git a/resources/lang/en/auth/message.php b/resources/lang/en/auth/message.php index 3aee689e54..7c0cd5b50f 100644 --- a/resources/lang/en/auth/message.php +++ b/resources/lang/en/auth/message.php @@ -9,11 +9,23 @@ return array( 'account_banned' => 'This user account is banned.', 'throttle' => 'Too many failed login attempts. Please try again in :seconds seconds.', + 'two_factor' => array( + 'already_enrolled' => 'Your device is already enrolled.', + 'success' => 'You have successfully logged in.', + 'code_required' => 'Two-factor code is required.', + 'invalid_code' => 'Two-factor code is invalid.', + ), + 'signin' => array( 'error' => 'There was a problem while trying to log you in, please try again.', 'success' => 'You have successfully logged in.', ), + 'logout' => array( + 'error' => 'There was a problem while trying to log you out, please try again.', + 'success' => 'You have successfully logged out.', + ), + 'signup' => array( 'error' => 'There was a problem while trying to create your account, please try again.', 'success' => 'Account sucessfully created.', diff --git a/resources/views/auth/two_factor_enroll.blade.php b/resources/views/auth/two_factor_enroll.blade.php index 1fe9c89c9b..05b367583e 100644 --- a/resources/views/auth/two_factor_enroll.blade.php +++ b/resources/views/auth/two_factor_enroll.blade.php @@ -28,7 +28,7 @@
- + {!! $barcode_obj->getHtmlDiv() !!}