src/Module/Settings/TwoFactor/Verify.php

   1 <?php
   2
   3 namespace Friendica\Module\Settings\TwoFactor;
   4
   5 use BaconQrCode\Renderer\Image\SvgImageBackEnd;
   6 use BaconQrCode\Renderer\ImageRenderer;
   7 use BaconQrCode\Renderer\RendererStyle\RendererStyle;
   8 use BaconQrCode\Writer;
   9 use Friendica\Core\Renderer;
  10 use Friendica\Core\Session;
  11 use Friendica\DI;
  12 use Friendica\Module\BaseSettings;
  13 use Friendica\Module\Security\Login;
  14 use PragmaRX\Google2FA\Google2FA;
  15
  16 /**
  17  * // Page 4: 2FA enabled but not verified, QR code and verification
  18  *
  19  * @package Friendica\Module\TwoFactor\Settings
  20  */
  21 class Verify extends BaseSettings
  22 {
  23         public static function init(array $parameters = [])
  24         {
  25                 if (!local_user()) {
  26                         return;
  27                 }
  28
  29                 $secret = DI::pConfig()->get(local_user(), '2fa', 'secret');
  30                 $verified = DI::pConfig()->get(local_user(), '2fa', 'verified');
  31
  32                 if ($secret && $verified) {
  33                         DI::baseUrl()->redirect('settings/2fa');
  34                 }
  35
  36                 if (!self::checkFormSecurityToken('settings_2fa_password', 't')) {
  37                         notice(DI::l10n()->t('Please enter your password to access this page.'));
  38                         DI::baseUrl()->redirect('settings/2fa');
  39                 }
  40         }
  41
  42         public static function post(array $parameters = [])
  43         {
  44                 if (!local_user()) {
  45                         return;
  46                 }
  47
  48                 if (($_POST['action'] ?? '') == 'verify') {
  49                         self::checkFormSecurityTokenRedirectOnError('settings/2fa/verify', 'settings_2fa_verify');
  50
  51                         $google2fa = new Google2FA();
  52
  53                         $valid = $google2fa->verifyKey(DI::pConfig()->get(local_user(), '2fa', 'secret'), $_POST['verify_code'] ?? '');
  54
  55                         if ($valid) {
  56                                 DI::pConfig()->set(local_user(), '2fa', 'verified', true);
  57                                 Session::set('2fa', true);
  58
  59                                 notice(DI::l10n()->t('Two-factor authentication successfully activated.'));
  60
  61                                 DI::baseUrl()->redirect('settings/2fa');
  62                         } else {
  63                                 notice(DI::l10n()->t('Invalid code, please retry.'));
  64                         }
  65                 }
  66         }
  67
  68         public static function content(array $parameters = [])
  69         {
  70                 if (!local_user()) {
  71                         return Login::form('settings/2fa/verify');
  72                 }
  73
  74                 parent::content($parameters);
  75
  76                 $company = 'Friendica';
  77                 $holder = Session::get('my_address');
  78                 $secret = DI::pConfig()->get(local_user(), '2fa', 'secret');
  79
  80                 $otpauthUrl = (new Google2FA())->getQRCodeUrl($company, $holder, $secret);
  81
  82                 $renderer = (new \BaconQrCode\Renderer\Image\Svg())
  83                         ->setHeight(256)
  84                         ->setWidth(256);
  85
  86                 $writer = new Writer($renderer);
  87
  88                 $qrcode_image = str_replace('<?xml version="1.0" encoding="UTF-8"?>', '', $writer->writeString($otpauthUrl));
  89
  90                 $shortOtpauthUrl = explode('?', $otpauthUrl)[0];
  91
  92                 $manual_message = DI::l10n()->t('<p>Or you can submit the authentication settings manually:</p>
  93 <dl>
  94         <dt>Issuer</dt>
  95         <dd>%s</dd>
  96         <dt>Account Name</dt>
  97         <dd>%s</dd>
  98         <dt>Secret Key</dt>
  99         <dd>%s</dd>
 100         <dt>Type</dt>
 101         <dd>Time-based</dd>
 102         <dt>Number of digits</dt>
 103         <dd>6</dd>
 104         <dt>Hashing algorithm</dt>
 105         <dd>SHA-1</dd>
 106 </dl>', $company, $holder, $secret);
 107
 108                 return Renderer::replaceMacros(Renderer::getMarkupTemplate('settings/twofactor/verify.tpl'), [
 109                         '$form_security_token'     => self::getFormSecurityToken('settings_2fa_verify'),
 110                         '$password_security_token' => self::getFormSecurityToken('settings_2fa_password'),
 111
 112                         '$title'              => DI::l10n()->t('Two-factor code verification'),
 113                         '$help_label'         => DI::l10n()->t('Help'),
 114                         '$message'            => DI::l10n()->t('<p>Please scan this QR Code with your authenticator app and submit the provided code.</p>'),
 115                         '$qrcode_image'       => $qrcode_image,
 116                         '$qrcode_url_message' => DI::l10n()->t('<p>Or you can open the following URL in your mobile devicde:</p><p><a href="%s">%s</a></p>', $otpauthUrl, $shortOtpauthUrl),
 117                         '$manual_message'     => $manual_message,
 118                         '$company'            => $company,
 119                         '$holder'             => $holder,
 120                         '$secret'             => $secret,
 121
 122                         '$verify_code'  => ['verify_code', DI::l10n()->t('Please enter a code from your authentication app'), '', '', 'required', 'autofocus placeholder="000000"'],
 123                         '$verify_label' => DI::l10n()->t('Verify code and enable two-factor authentication'),
 124                 ]);
 125         }
 126 }