q
class.google2fa.php _ 0 .DS_Store _ j m
plugin.php _ [
config.php _ MqF ? lib/Sonata/GoogleAuthenticator/GoogleAuthenticatorInterface.php _ ` 3 lib/Sonata/GoogleAuthenticator/FixedBitNotation.php& _& T 3 lib/Sonata/GoogleAuthenticator/RuntimeException.php _ 6 lib/Sonata/GoogleAuthenticator/GoogleAuthenticator.php _ k)_ . lib/Sonata/GoogleAuthenticator/GoogleQrUrl.php _ \ googleauth.php _ Yq getQRCode($thisstaff);
if ($googleAuth->validateQRCode($thisstaff)) {
return array(
'' => new FreeTextField(array(
'configuration' => array(
'content' => sprintf(
'
Use the Google Authenticator application on your phone to scan and
the QR Code below. If you lose the QR Code
on the app, you will need to have your 2FA configurations reset by
a helpdesk Administrator.
',
$thisstaff->getEmail(), $qrCodeURL),
)
)),
);
}
}
protected function getInputOptions() {
return array(
'token' => new TextboxField(array(
'id'=>1, 'label'=>__('Verification Code'), 'required'=>true, 'default'=>'',
'validator'=>'number',
'hint'=>__('Please enter the code from your Google Authenticator app'),
'configuration'=>array(
'size'=>40, 'length'=>40,
'autocomplete' => 'one-time-code',
'inputmode' => 'numeric',
'pattern' => '[0-9]*',
'validator-error' => __('Invalid Code format'),
),
)),
);
}
function validate($form, $user) {
// Make sure form is valid and token exists
if (!($form->isValid()
&& ($clean=$form->getClean())
&& $clean['token']))
return false;
if (!$this->validateLoginCode($clean['token']))
return false;
// upstream validation might throw an exception due to expired token
// or too many attempts (timeout). It's the responsibility of the
// caller to catch and handle such exceptions.
$secretKey = self::getSecretKey();
if (!$this->_validate($secretKey))
return false;
// Validator doesn't do house cleaning - it's our responsibility
$this->onValidate($user);
return true;
}
function send($user) {
global $cfg;
// Get backend configuration for this user
if (!$cfg || !($info = $user->get2FAConfig($this->getId())))
return false;
// get configuration
$config = $info['config'];
// Generate Secret Key
if (!$this->secretKey)
$this->secretKey = self::getSecretKey($user);
$this->store($this->secretKey);
return true;
}
function store($secretKey) {
global $thisstaff;
$store = &$_SESSION['_2fa'][$this->getId()];
$store = ['otp' => $secretKey, 'time' => time(), 'strikes' => 0];
if ($thisstaff) {
$config = array('config' => array('key' => $secretKey, 'external2fa' => true));
$_config = new Config('staff.'.$thisstaff->getId());
$_config->set($this->getId(), JsonDataEncoder::encode($config));
$thisstaff->_config = $_config->getInfo();
$errors['err'] = '';
}
return $store;
}
function validateLoginCode($code) {
$googleAuth = new \Sonata\GoogleAuthenticator\GoogleAuthenticator();
$secretKey = self::getSecretKey();
return $googleAuth->checkCode($secretKey, $code);
}
function getSecretKey($staff=false) {
if (!$staff) {
$s = StaffAuthenticationBackend::getUser();
$staff = Staff::lookup($s->getId());
}
if (!$token = ConfigItem::getConfigsByNamespace('staff.'.$staff->getId(), 'gauth.agent')) {
$googleAuth = new \Sonata\GoogleAuthenticator\GoogleAuthenticator();
$this->secretKey = $googleAuth->generateSecret();
$this->store($this->secretKey);
}
$key = $token->value ?: $this->secretKey;
if (strpos($key, 'config')) {
$key = json_decode($key, true);
$key = $key['config']['key'];
}
return $key;
}
function getQRCode($staff=false) {
$staffEmail = $staff->getEmail();
$secretKey = self::getSecretKey($staff);
return \Sonata\GoogleAuthenticator\GoogleQrUrl::generate($staffEmail, $secretKey, 'osTicket');
}
function validateQRCode($staff=false) {
$googleAuth = new \Sonata\GoogleAuthenticator\GoogleAuthenticator();
$secretKey = self::getSecretKey($staff);
$code = $googleAuth->getCode($secretKey);
return $googleAuth->checkCode($secretKey, $code);
}
function getCode() {
$googleAuth = new \Sonata\GoogleAuthenticator\GoogleAuthenticator();
$secretKey = self::getSecretKey();
return $googleAuth->getCode($secretKey);
}
}
Bud1 % @ @ @ @ E % DSDB ` @ @ @ '2fa:gauth', # notrans
'version' => '0.2',
'name' => /* trans */ 'Google Authenticator 2FA',
'author' => 'Adriane Alexander',
'description' => /* trans */ 'Provides 2 Factor Authentication
using the Google Authenticator App',
'url' => 'https://www.osticket.com/download',
'plugin' => 'googleauth.php:GoogleAuth2FAPlugin',
'requires' => array(
"sonata-project/google-authenticator" => array(
"version" => "*",
"map" => array(
"sonata-project/google-authenticator/src" => 'lib/Sonata/GoogleAuthenticator',
)
),
),
);
?>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace Sonata\GoogleAuthenticator;
interface GoogleAuthenticatorInterface
{
/**
* @param string $secret
* @param string $code
*/
public function checkCode($secret, $code): bool;
/**
* NEXT_MAJOR: add the interface typehint to $time and remove deprecation.
*
* @param string $secret
* @param float|string|int|null|\DateTimeInterface $time
*/
public function getCode($secret, /* \DateTimeInterface */$time = null): string;
/**
* NEXT_MAJOR: Remove this method.
*
* @param string $user
* @param string $hostname
* @param string $secret
*
* @deprecated deprecated as of 2.1 and will be removed in 3.0. Use Sonata\GoogleAuthenticator\GoogleQrUrl::generate() instead.
*/
public function getUrl($user, $hostname, $secret): string;
public function generateSecret(): string;
}
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace Sonata\GoogleAuthenticator;
/**
* FixedBitNotation.
*
* The FixedBitNotation class is for binary to text conversion. It
* can handle many encoding schemes, formally defined or not, that
* use a fixed number of bits to encode each character.
*
* @author Andre DeMarre
*/
final class FixedBitNotation
{
/**
* @var string
*/
private $chars;
/**
* @var int
*/
private $bitsPerCharacter;
/**
* @var int
*/
private $radix;
/**
* @var bool
*/
private $rightPadFinalBits;
/**
* @var bool
*/
private $padFinalGroup;
/**
* @var string
*/
private $padCharacter;
/**
* @var string[]
*/
private $charmap;
/**
* @param int $bitsPerCharacter Bits to use for each encoded character
* @param string $chars Base character alphabet
* @param bool $rightPadFinalBits How to encode last character
* @param bool $padFinalGroup Add padding to end of encoded output
* @param string $padCharacter Character to use for padding
*/
public function __construct(int $bitsPerCharacter, string $chars = null, bool $rightPadFinalBits = false, bool $padFinalGroup = false, string $padCharacter = '=')
{
// Ensure validity of $chars
if (!is_string($chars) || ($charLength = strlen($chars)) < 2) {
$chars =
'0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-,';
$charLength = 64;
}
// Ensure validity of $bitsPerCharacter
if ($bitsPerCharacter < 1) {
// $bitsPerCharacter must be at least 1
$bitsPerCharacter = 1;
$radix = 2;
} elseif ($charLength < 1 << $bitsPerCharacter) {
// Character length of $chars is too small for $bitsPerCharacter
// Set $bitsPerCharacter to greatest acceptable value
$bitsPerCharacter = 1;
$radix = 2;
while ($charLength >= ($radix <<= 1) && $bitsPerCharacter < 8) {
++$bitsPerCharacter;
}
$radix >>= 1;
} elseif ($bitsPerCharacter > 8) {
// $bitsPerCharacter must not be greater than 8
$bitsPerCharacter = 8;
$radix = 256;
} else {
$radix = 1 << $bitsPerCharacter;
}
$this->chars = $chars;
$this->bitsPerCharacter = $bitsPerCharacter;
$this->radix = $radix;
$this->rightPadFinalBits = $rightPadFinalBits;
$this->padFinalGroup = $padFinalGroup;
$this->padCharacter = $padCharacter[0];
}
/**
* Encode a string.
*
* @param string $rawString Binary data to encode
*
* @return string
*/
public function encode($rawString): string
{
// Unpack string into an array of bytes
$bytes = unpack('C*', $rawString);
$byteCount = count($bytes);
$encodedString = '';
$byte = array_shift($bytes);
$bitsRead = 0;
$chars = $this->chars;
$bitsPerCharacter = $this->bitsPerCharacter;
$rightPadFinalBits = $this->rightPadFinalBits;
$padFinalGroup = $this->padFinalGroup;
$padCharacter = $this->padCharacter;
// Generate encoded output;
// each loop produces one encoded character
for ($c = 0; $c < $byteCount * 8 / $bitsPerCharacter; ++$c) {
// Get the bits needed for this encoded character
if ($bitsRead + $bitsPerCharacter > 8) {
// Not enough bits remain in this byte for the current
// character
// Save the remaining bits before getting the next byte
$oldBitCount = 8 - $bitsRead;
$oldBits = $byte ^ ($byte >> $oldBitCount << $oldBitCount);
$newBitCount = $bitsPerCharacter - $oldBitCount;
if (!$bytes) {
// Last bits; match final character and exit loop
if ($rightPadFinalBits) {
$oldBits <<= $newBitCount;
}
$encodedString .= $chars[$oldBits];
if ($padFinalGroup) {
// Array of the lowest common multiples of
// $bitsPerCharacter and 8, divided by 8
$lcmMap = [1 => 1, 2 => 1, 3 => 3, 4 => 1, 5 => 5, 6 => 3, 7 => 7, 8 => 1];
$bytesPerGroup = $lcmMap[$bitsPerCharacter];
$pads = $bytesPerGroup * 8 / $bitsPerCharacter
- ceil((strlen($rawString) % $bytesPerGroup)
* 8 / $bitsPerCharacter);
$encodedString .= str_repeat($padCharacter[0], $pads);
}
break;
}
// Get next byte
$byte = array_shift($bytes);
$bitsRead = 0;
} else {
$oldBitCount = 0;
$newBitCount = $bitsPerCharacter;
}
// Read only the needed bits from this byte
$bits = $byte >> 8 - ($bitsRead + $newBitCount);
$bits ^= $bits >> $newBitCount << $newBitCount;
$bitsRead += $newBitCount;
if ($oldBitCount) {
// Bits come from seperate bytes, add $oldBits to $bits
$bits = ($oldBits << $newBitCount) | $bits;
}
$encodedString .= $chars[$bits];
}
return $encodedString;
}
/**
* Decode a string.
*
* @param string $encodedString Data to decode
* @param bool $caseSensitive
* @param bool $strict Returns null if $encodedString contains
* an undecodable character
*
* @return string
*/
public function decode($encodedString, $caseSensitive = true, $strict = false): string
{
if (!$encodedString || !is_string($encodedString)) {
// Empty string, nothing to decode
return '';
}
$chars = $this->chars;
$bitsPerCharacter = $this->bitsPerCharacter;
$radix = $this->radix;
$rightPadFinalBits = $this->rightPadFinalBits;
$padCharacter = $this->padCharacter;
// Get index of encoded characters
if ($this->charmap) {
$charmap = $this->charmap;
} else {
$charmap = [];
for ($i = 0; $i < $radix; ++$i) {
$charmap[$chars[$i]] = $i;
}
$this->charmap = $charmap;
}
// The last encoded character is $encodedString[$lastNotatedIndex]
$lastNotatedIndex = strlen($encodedString) - 1;
// Remove trailing padding characters
while ($encodedString[$lastNotatedIndex] == $padCharacter[0]) {
$encodedString = substr($encodedString, 0, $lastNotatedIndex);
--$lastNotatedIndex;
}
$rawString = '';
$byte = 0;
$bitsWritten = 0;
// Convert each encoded character to a series of unencoded bits
for ($c = 0; $c <= $lastNotatedIndex; ++$c) {
if (!isset($charmap[$encodedString[$c]]) && !$caseSensitive) {
// Encoded character was not found; try other case
if (isset($charmap[$cUpper = strtoupper($encodedString[$c])])) {
$charmap[$encodedString[$c]] = $charmap[$cUpper];
} elseif (isset($charmap[$cLower = strtolower($encodedString[$c])])) {
$charmap[$encodedString[$c]] = $charmap[$cLower];
}
}
if (isset($charmap[$encodedString[$c]])) {
$bitsNeeded = 8 - $bitsWritten;
$unusedBitCount = $bitsPerCharacter - $bitsNeeded;
// Get the new bits ready
if ($bitsNeeded > $bitsPerCharacter) {
// New bits aren't enough to complete a byte; shift them
// left into position
$newBits = $charmap[$encodedString[$c]] << $bitsNeeded
- $bitsPerCharacter;
$bitsWritten += $bitsPerCharacter;
} elseif ($c != $lastNotatedIndex || $rightPadFinalBits) {
// Zero or more too many bits to complete a byte;
// shift right
$newBits = $charmap[$encodedString[$c]] >> $unusedBitCount;
$bitsWritten = 8; //$bitsWritten += $bitsNeeded;
} else {
// Final bits don't need to be shifted
$newBits = $charmap[$encodedString[$c]];
$bitsWritten = 8;
}
$byte |= $newBits;
if (8 == $bitsWritten || $c == $lastNotatedIndex) {
// Byte is ready to be written
$rawString .= pack('C', $byte);
if ($c != $lastNotatedIndex) {
// Start the next byte
$bitsWritten = $unusedBitCount;
$byte = ($charmap[$encodedString[$c]]
^ ($newBits << $unusedBitCount)) << 8 - $bitsWritten;
}
}
} elseif ($strict) {
// Unable to decode character; abort
return null;
}
}
return $rawString;
}
}
// NEXT_MAJOR: Remove class alias
class_alias('Sonata\GoogleAuthenticator\FixedBitNotation', 'Google\Authenticator\FixedBitNotation', false);
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace Sonata\GoogleAuthenticator;
/**
* Contains runtime exception templates.
*
* @author Iltar van der Berg
*/
final class RuntimeException extends \RuntimeException
{
public static function InvalidAccountName(string $accountName): self
{
return new self(sprintf(
'The account name may not contain a double colon (:) and may not be an empty string. Given "%s".',
$accountName
));
}
public static function InvalidIssuer(string $issuer): self
{
return new self(sprintf(
'The issuer name may not contain a double colon (:) and may not be an empty string. Given "%s".',
$issuer
));
}
public static function InvalidSecret(): self
{
return new self('The secret name may not be an empty string.');
}
}
// NEXT_MAJOR: Remove class alias
class_alias('Sonata\GoogleAuthenticator\RuntimeException', 'Google\Authenticator\RuntimeException', false);
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace Sonata\GoogleAuthenticator;
/**
* @see https://github.com/google/google-authenticator/wiki/Key-Uri-Format
*/
final class GoogleAuthenticator implements GoogleAuthenticatorInterface
{
/**
* @var int
*/
private $passCodeLength;
/**
* @var int
*/
private $secretLength;
/**
* @var int
*/
private $pinModulo;
/**
* @var \DateTimeInterface
*/
private $now;
/**
* @var int
*/
private $codePeriod = 30;
/**
* @param int $passCodeLength
* @param int $secretLength
* @param \DateTimeInterface|null $now
*/
public function __construct(int $passCodeLength = 6, int $secretLength = 10, \DateTimeInterface $now = null)
{
$this->passCodeLength = $passCodeLength;
$this->secretLength = $secretLength;
$this->pinModulo = 10 ** $passCodeLength;
$this->now = $now ?? new \DateTimeImmutable();
}
/**
* @param string $secret
* @param string $code
*/
public function checkCode($secret, $code): bool
{
/**
* The result of each comparison is accumulated here instead of using a guard clause
* (https://refactoring.com/catalog/replaceNestedConditionalWithGuardClauses.html). This is to implement
* constant time comparison to make side-channel attacks harder. See
* https://cryptocoding.net/index.php/Coding_rules#Compare_secret_strings_in_constant_time for details.
* Each comparison uses hash_equals() instead of an operator to implement constant time equality comparison
* for each code.
*/
$result = 0;
// current period
$result += hash_equals($this->getCode($secret, $this->now), $code);
// previous period, happens if the user was slow to enter or it just crossed over
$dateTime = new \DateTimeImmutable('@'.($this->now->getTimestamp() - $this->codePeriod));
$result += hash_equals($this->getCode($secret, $dateTime), $code);
// next period, happens if the user is not completely synced and possibly a few seconds ahead
$dateTime = new \DateTimeImmutable('@'.($this->now->getTimestamp() + $this->codePeriod));
$result += hash_equals($this->getCode($secret, $dateTime), $code);
return $result > 0;
}
/**
* NEXT_MAJOR: add the interface typehint to $time and remove deprecation.
*
* @param string $secret
* @param float|string|int|null|\DateTimeInterface $time
*/
public function getCode($secret, /* \DateTimeInterface */$time = null): string
{
if (null === $time) {
$time = $this->now;
}
if ($time instanceof \DateTimeInterface) {
$timeForCode = floor($time->getTimestamp() / $this->codePeriod);
} else {
@trigger_error(
'Passing anything other than null or a DateTimeInterface to $time is deprecated as of 2.0 '.
'and will not be possible as of 3.0.',
E_USER_DEPRECATED
);
$timeForCode = $time;
}
$base32 = new FixedBitNotation(5, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567', true, true);
$secret = $base32->decode($secret);
$timeForCode = str_pad(pack('N', $timeForCode), 8, chr(0), STR_PAD_LEFT);
$hash = hash_hmac('sha1', $timeForCode, $secret, true);
$offset = ord(substr($hash, -1));
$offset &= 0xF;
$truncatedHash = $this->hashToInt($hash, $offset) & 0x7FFFFFFF;
return str_pad((string) ($truncatedHash % $this->pinModulo), $this->passCodeLength, '0', STR_PAD_LEFT);
}
/**
* NEXT_MAJOR: Remove this method.
*
* @param string $user
* @param string $hostname
* @param string $secret
*
* @deprecated deprecated as of 2.1 and will be removed in 3.0. Use Sonata\GoogleAuthenticator\GoogleQrUrl::generate() instead.
*/
public function getUrl($user, $hostname, $secret): string
{
@trigger_error(sprintf(
'Using %s() is deprecated as of 2.1 and will be removed in 3.0. '.
'Use Sonata\GoogleAuthenticator\GoogleQrUrl::generate() instead.',
__METHOD__
), E_USER_DEPRECATED);
$issuer = func_get_args()[3] ?? null;
$accountName = sprintf('%s@%s', $user, $hostname);
// manually concat the issuer to avoid a change in URL
$url = GoogleQrUrl::generate($accountName, $secret);
if ($issuer) {
$url .= '%26issuer%3D'.$issuer;
}
return $url;
}
public function generateSecret(): string
{
return (new FixedBitNotation(5, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567', true, true))
->encode(random_bytes($this->secretLength));
}
/**
* @param string $bytes
* @param int $start
*/
private function hashToInt(string $bytes, int $start): int
{
return unpack('N', substr(substr($bytes, $start), 0, 4))[1];
}
}
// NEXT_MAJOR: Remove class alias
class_alias('Sonata\GoogleAuthenticator\GoogleAuthenticator', 'Google\Authenticator\GoogleAuthenticator', false);
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
namespace Sonata\GoogleAuthenticator;
/**
* Responsible for QR image url generation.
*
* @see https://developers.google.com/chart/infographics/docs/qr_codes
* @see https://github.com/google/google-authenticator/wiki/Key-Uri-Format
*
* @author Iltar van der Berg
*/
final class GoogleQrUrl
{
/**
* Private by design.
*/
private function __construct()
{
}
/**
* Generates a URL that is used to show a QR code.
*
* Account names may not contain a double colon (:). Valid account name
* examples:
* - "John.Doe@gmail.com"
* - "John Doe"
* - "John_Doe_976"
*
* The Issuer may not contain a double colon (:). The issuer is recommended
* to pass along. If used, it will also be appended before the accountName.
*
* The previous examples with the issuer "Acme inc" would result in label:
* - "Acme inc:John.Doe@gmail.com"
* - "Acme inc:John Doe"
* - "Acme inc:John_Doe_976"
*
* The contents of the label, issuer and secret will be encoded to generate
* a valid URL.
*
* @param string $accountName The account name to show and identify
* @param string $secret The secret is the generated secret unique to that user
* @param string|null $issuer Where you log in to
* @param int $size Image size in pixels, 200 will make it 200x200
*
* @return string
*/
public static function generate(string $accountName, string $secret, string $issuer = null, int $size = 200): string
{
if ('' === $accountName || false !== strpos($accountName, ':')) {
throw RuntimeException::InvalidAccountName($accountName);
}
if ('' === $secret) {
throw RuntimeException::InvalidSecret();
}
$label = $accountName;
$otpauthString = 'otpauth://totp/%s?secret=%s';
if (null !== $issuer) {
if ('' === $issuer || false !== strpos($issuer, ':')) {
throw RuntimeException::InvalidIssuer($issuer);
}
// use both the issuer parameter and label prefix as recommended by Google for BC reasons
$label = $issuer.':'.$label;
$otpauthString .= '&issuer=%s';
}
$otpauthString = rawurlencode(sprintf($otpauthString, $label, $secret, $issuer));
return sprintf(
'https://chart.googleapis.com/chart?chs=%1$dx%1$d&chld=M|0&cht=qr&chl=%2$s',
$size,
$otpauthString
);
}
}
// NEXT_MAJOR: Remove class alias
class_alias('Sonata\GoogleAuthenticator\GoogleQrUrl', 'Google\Authenticator\GoogleQrUrl', false);
delete();
$tokens = ConfigItem::getConfigsByNamespace(false, 'gauth.agent');
foreach($tokens as $token)
$token->delete();
return parent::disable();
}
}
require_once(INCLUDE_DIR.'UniversalClassLoader.php');
use Symfony\Component\ClassLoader\UniversalClassLoader_osTicket;
$loader = new UniversalClassLoader_osTicket();
$loader->registerNamespaceFallbacks(array(
dirname(__file__).'/lib'));
$loader->register();
9ANM GBMB