src/Module/Settings/TwoFactor/Verify.php

   1 <?php
   2
   3
   4 namespace Friendica\Module\Settings\TwoFactor;
   5
   6
   7 use BaconQrCode\Renderer\Image\SvgImageBackEnd;
   8 use BaconQrCode\Renderer\ImageRenderer;
   9 use BaconQrCode\Renderer\RendererStyle\RendererStyle;
  10 use BaconQrCode\Writer;
  11 use Friendica\BaseModule;
  12 use Friendica\Core\L10n;
  13 use Friendica\Core\PConfig;
  14 use Friendica\Core\Renderer;
  15 use Friendica\Core\Session;
  16 use Friendica\DI;
  17 use Friendica\Module\BaseSettingsModule;
  18 use Friendica\Module\Security\Login;
  19 use PragmaRX\Google2FA\Google2FA;
  20
  21 /**
  22  * // Page 4: 2FA enabled but not verified, QR code and verification
  23  *
  24  * @package Friendica\Module\TwoFactor\Settings
  25  */
  26 class Verify extends BaseSettingsModule
  27 {
  28         public static function init(array $parameters = [])
  29         {
  30                 if (!local_user()) {
  31                         return;
  32                 }
  33
  34                 $secret = DI::pConfig()->get(local_user(), '2fa', 'secret');
  35                 $verified = DI::pConfig()->get(local_user(), '2fa', 'verified');
  36
  37                 if ($secret && $verified) {
  38                         DI::baseUrl()->redirect('settings/2fa');
  39                 }
  40
  41                 if (!self::checkFormSecurityToken('settings_2fa_password', 't')) {
  42                         notice(L10n::t('Please enter your password to access this page.'));
  43                         DI::baseUrl()->redirect('settings/2fa');
  44                 }
  45         }
  46
  47         public static function post(array $parameters = [])
  48         {
  49                 if (!local_user()) {
  50                         return;
  51                 }
  52
  53                 if (($_POST['action'] ?? '') == 'verify') {
  54                         self::checkFormSecurityTokenRedirectOnError('settings/2fa/verify', 'settings_2fa_verify');
  55
  56                         $google2fa = new Google2FA();
  57
  58                         $valid = $google2fa->verifyKey(DI::pConfig()->get(local_user(), '2fa', 'secret'), $_POST['verify_code'] ?? '');
  59
  60                         if ($valid) {
  61                                 PConfig::set(local_user(), '2fa', 'verified', true);
  62                                 Session::set('2fa', true);
  63
  64                                 notice(L10n::t('Two-factor authentication successfully activated.'));
  65
  66                                 DI::baseUrl()->redirect('settings/2fa');
  67                         } else {
  68                                 notice(L10n::t('Invalid code, please retry.'));
  69                         }
  70                 }
  71         }
  72
  73         public static function content(array $parameters = [])
  74         {
  75                 if (!local_user()) {
  76                         return Login::form('settings/2fa/verify');
  77                 }
  78
  79                 parent::content($parameters);
  80
  81                 $company = 'Friendica';
  82                 $holder = Session::get('my_address');
  83                 $secret = DI::pConfig()->get(local_user(), '2fa', 'secret');
  84
  85                 $otpauthUrl = (new Google2FA())->getQRCodeUrl($company, $holder, $secret);
  86
  87                 $renderer = (new \BaconQrCode\Renderer\Image\Svg())
  88                         ->setHeight(256)
  89                         ->setWidth(256);
  90
  91                 $writer = new Writer($renderer);
  92
  93                 $qrcode_image = str_replace('<?xml version="1.0" encoding="UTF-8"?>', '', $writer->writeString($otpauthUrl));
  94
  95                 $shortOtpauthUrl = explode('?', $otpauthUrl)[0];
  96
  97                 $manual_message = L10n::t('<p>Or you can submit the authentication settings manually:</p>
  98 <dl>
  99         <dt>Issuer</dt>
 100         <dd>%s</dd>
 101         <dt>Account Name</dt>
 102         <dd>%s</dd>
 103         <dt>Secret Key</dt>
 104         <dd>%s</dd>
 105         <dt>Type</dt>
 106         <dd>Time-based</dd>
 107         <dt>Number of digits</dt>
 108         <dd>6</dd>
 109         <dt>Hashing algorithm</dt>
 110         <dd>SHA-1</dd>
 111 </dl>', $company, $holder, $secret);
 112
 113                 return Renderer::replaceMacros(Renderer::getMarkupTemplate('settings/twofactor/verify.tpl'), [
 114                         '$form_security_token'     => self::getFormSecurityToken('settings_2fa_verify'),
 115                         '$password_security_token' => self::getFormSecurityToken('settings_2fa_password'),
 116
 117                         '$title'              => L10n::t('Two-factor code verification'),
 118                         '$help_label'         => L10n::t('Help'),
 119                         '$message'            => L10n::t('<p>Please scan this QR Code with your authenticator app and submit the provided code.</p>'),
 120                         '$qrcode_image'       => $qrcode_image,
 121                         '$qrcode_url_message' => L10n::t('<p>Or you can open the following URL in your mobile devicde:</p><p><a href="%s">%s</a></p>', $otpauthUrl, $shortOtpauthUrl),
 122                         '$manual_message'     => $manual_message,
 123                         '$company'            => $company,
 124                         '$holder'             => $holder,
 125                         '$secret'             => $secret,
 126
 127                         '$verify_code'  => ['verify_code', L10n::t('Please enter a code from your authentication app'), '', '', 'required', 'autofocus placeholder="000000"'],
 128                         '$verify_label' => L10n::t('Verify code and enable two-factor authentication'),
 129                 ]);
 130         }
 131 }