From 5eb7b35bfeaf58dfdd6ea9ac6a3a37e2fc9828f2 Mon Sep 17 00:00:00 2001 From: sparkyx Date: Tue, 5 Aug 2025 13:26:39 +0200 Subject: [PATCH] TOTP : improve email and fix small bug --- html/login.php | 12 +++++++++++- include/class/dossier.class.php | 4 +--- include/class/noalyss_user.class.php | 14 ++++++++------ include/lib/otp.class.php | 11 ++++++++++- include/otp-link.php | 13 +++++-------- include/sql/patch/ac-upgrade20.sql | 3 +-- include/template/noalyss_user-input_otp.php | 4 ++-- include/user.inc.php | 8 +++++++- include/user_detail.inc.php | 6 +++--- 9 files changed, 48 insertions(+), 27 deletions(-) diff --git a/html/login.php b/html/login.php index 53506e3eb..90aeac88b 100644 --- a/html/login.php +++ b/html/login.php @@ -36,7 +36,10 @@ if (defined('MULTI') && MULTI == 0) $version = $rep->get_value('select val from version'); $http=new HttpInput(); - +/** + * If p_user is set , it means that the user tries to connect, the $_SESSION + * does not exist yet + */ if ( isset ($_POST["p_user"] ) ) { $http=new HttpInput(); @@ -116,6 +119,9 @@ if ( isset ($_POST["p_user"] ) ) } else { + /** + * User has a session + */ $rep=new Database(); /* @@ -160,6 +166,9 @@ else } $otp_send_secret = new Otp_Send_Secret_SQL($rep, $os_id); + /** + * second code is valid, so delete it + */ if ( $vrf_code == $otp_send_secret->get('os_code') || $User->check_otp($vrf_code) @@ -172,6 +181,7 @@ else // check that backurl is valid $backurl=preg_replace('/^.*\?/','',$backurl); $backurl=NOALYSS_URL."/do.php?$backurl"; + $otp_send_secret->delete(); } header("Location: $backurl"); return; diff --git a/include/class/dossier.class.php b/include/class/dossier.class.php index 4da008c90..4e4ac664c 100644 --- a/include/class/dossier.class.php +++ b/include/class/dossier.class.php @@ -160,12 +160,10 @@ class Dossier from ac_dossier as ds join jnt_use_dos as jt on (jt.dos_id=ds.dos_id) group by jt.use_id) as dossier_name on (jt_use_id=ac.use_id) - where - use_login!=$1 $sql "; - $res=$this->cn->get_array($sql, array(NOALYSS_ADMINISTRATOR)); + $res=$this->cn->get_array($sql); return $res; } diff --git a/include/class/noalyss_user.class.php b/include/class/noalyss_user.class.php index fff1ddcf7..a1037c429 100644 --- a/include/class/noalyss_user.class.php +++ b/include/class/noalyss_user.class.php @@ -1967,13 +1967,13 @@ Voici votre code secret pour NOALYSS : $code $uuid= guidv4(); $repository=new \Database(); // remove old for this user - $repository->exec_sql("delete from otp_send_secret where use_id=$1" + $repository->exec_sql("delete from otp_send_secret where use_id=$1 and os_code is not null" ,[$this->id]); // remove also old one $repository->exec_sql("delete from otp_send_secret where os_valid_time < now()"); $now=new \DateTime(); $valid=new \DateTime(); - $valid->modify('+20 minutes'); + $valid->modify('+10 minutes'); $otp_send_secret=new Otp_Send_Secret_SQL($repository); $otp_send_secret->set("use_id",$this->id) @@ -2001,6 +2001,9 @@ Voici votre code secret pour NOALYSS : $code $noalyss_url = NOALYSS_URL; $uuid = guidv4(); $id = $this->getId(); + $valid_time=new \DateTime(); + $valid_time->add(new \DateInterval('PT12H')); + $str_time=$valid_time->format('d-m-Y H:i'); /** * save in DB first */ @@ -2009,7 +2012,7 @@ Voici votre code secret pour NOALYSS : $code Afin de pouvoir utiliser la double authentification avec 2FA: OTP, pourriez-vous suivre ce lien et scanner le QRCode avec votre application android freeOTP ou Google Authenticator. - Ce lien ne sera actif que 12 heures. + Ce lien ne sera actif que 12 heures et expirera le {$str_time}. {$noalyss_url}/index.php?otp={$uuid} @@ -2023,12 +2026,11 @@ Bien cordialement, try { $repository = new \Database(); // remove old for this user - $repository->exec_sql("delete from otp_send_secret where use_id=$1" + $repository->exec_sql("delete from otp_send_secret where use_id=$1 and os_code is null" ,[$this->id]); // remove also old one $repository->exec_sql("delete from otp_send_secret where os_valid_time < now()"); - $valid_time=new \DateTime(); - $valid_time->add(new \DateInterval('PT12H')); + $otp_send_secret_sql = new \Otp_Send_Secret_SQL($repository); $otp_send_secret_sql->set('use_id', $id) ->set('os_valid_time',$valid_time->format('d-m-Y H:i')) diff --git a/include/lib/otp.class.php b/include/lib/otp.class.php index 4ecebb1c4..8e324343e 100644 --- a/include/lib/otp.class.php +++ b/include/lib/otp.class.php @@ -69,5 +69,14 @@ class OTP { $this->authenticator->setSecret($secret); return $this->authenticator->code(); } - + public function get_authenticator() { + return $this->authenticator; + } + + public function set_authenticator($authenticator) { + $this->authenticator = $authenticator; + return $this; + } + + } diff --git a/include/otp-link.php b/include/otp-link.php index 3d6fd5da0..167af0b1a 100644 --- a/include/otp-link.php +++ b/include/otp-link.php @@ -142,7 +142,7 @@ try { $uuid = $http->get('otp'); $repository = new \Database(0); // remove old request (> 24 hours) - $repository->exec_sql("delete from otp_send_secret where os_timestamp < now()-interval '24 hours'"); + $repository->exec_sql("delete from otp_send_secret where os_timestamp < now()-interval '12 hours'"); // check if UUID exist $id = $repository->get_value("select os_id from otp_send_secret where os_request=$1", @@ -159,13 +159,10 @@ try { $secret = $user->get_otp_secret(); // OTP - $options = new AuthenticatorOptions; - $options->secret_length = 32; - $options->algorithm = AuthenticatorInterface::ALGO_SHA512; - $options->digits=6; - $authenticator = new Authenticator($options); - $authenticator->setSecret($secret); - $data= $authenticator->getUri(label:"noalyss:".$user->getEmail(),issuer:"noalyss.eu"); + + $authenticator = new \Noalyss\OTP(); + $authenticator->get_authenticator()->setSecret($secret); + $data= $authenticator->get_authenticator()->getUri(label:"noalyss:".$user->getEmail(),issuer:"noalyss.eu"); // load secret for this id //echo "use with php -S localhost:5000 puis ouvrir index.html "; $writer = new PngWriter(); diff --git a/include/sql/patch/ac-upgrade20.sql b/include/sql/patch/ac-upgrade20.sql index bc8c97f66..4e04a5f1d 100644 --- a/include/sql/patch/ac-upgrade20.sql +++ b/include/sql/patch/ac-upgrade20.sql @@ -17,8 +17,7 @@ CREATE TABLE public.otp_send_secret ( use_id int4 NOT NULL, -- FK to ac_users os_code varchar(8) NULL, os_valid_time timestamp NOT NULL, - CONSTRAINT otp_send_secret_pk PRIMARY KEY (os_id), - CONSTRAINT otp_send_secret_unique UNIQUE (use_id) + CONSTRAINT otp_send_secret_pk PRIMARY KEY (os_id) ); COMMENT ON TABLE public.otp_send_secret IS 'sent to user for scanning a QRCODE for FreeOTP or digit to connect, depends of ac_users use_auth_method.'; diff --git a/include/template/noalyss_user-input_otp.php b/include/template/noalyss_user-input_otp.php index 03c174370..75e18f769 100644 --- a/include/template/noalyss_user-input_otp.php +++ b/include/template/noalyss_user-input_otp.php @@ -142,8 +142,8 @@ form { Rafraichissez la page pour recevoir un nouveau code.

- - + +

diff --git a/include/user.inc.php b/include/user.inc.php index 69addd3de..868753549 100644 --- a/include/user.inc.php +++ b/include/user.inc.php @@ -172,6 +172,12 @@ else if ($sbaction == "delete") } if ( $code != $ctl_code) { echo_warning (_("Code invalide, effacement refusé")); + require_once NOALYSS_INCLUDE.'/user_detail.inc.php'; + return; + } + if ($uid == 1) { + echo_warning(_("Administrateur ne peut pas être effacé")); + require_once NOALYSS_INCLUDE.'/user_detail.inc.php'; return; } $cn = new Database(); @@ -301,7 +307,7 @@ if ( !empty ($a_user) ) echo ''.$header->get_header(2).''; echo ''.$header->get_header(4).''; echo ""._('Type').""; - echo ''.$header->get_header(2).''; + echo ''.$header->get_header(3).''; echo ''; $a_auth=[0=>_("Mot de passe"),1=>'Email et OTP',2=>'OTP']; diff --git a/include/user_detail.inc.php b/include/user_detail.inc.php index 0b825dc84..ef4e93071 100644 --- a/include/user_detail.inc.php +++ b/include/user_detail.inc.php @@ -126,8 +126,8 @@ $it_pass->value=""; $auth_method=new ISelect('auth_method'); $auth_method->value=array( array('value'=>0,'label'=>_('Aucune')), - array('value'=>1,'label'=>_('email + OTP')), - array('value'=>2,'label'=>_('OTP')), + array('value'=>1,'label'=>_('Mot de passe et code par courriel (ou TOTP) ')), + array('value'=>2,'label'=>_('Mot de passe et TOTP')), ); $auth_method->selected=$UserChange->authent_method; echo $auth_method->input(); @@ -144,7 +144,7 @@ $it_pass->value=""; - > +