commit a1702cea73ca4b9d278bd9c25e5103fb153ce3f3 parent eb0d29d6c43b908c03ac749376fed70240fee2f2 Author: MTRNord <mtrnord1@gmail.com> Date: Tue, 30 Dec 2014 23:20:06 +0100 it seems that I miss some iles ;) Diffstat:
11 files changed, 437 insertions(+), 5 deletions(-)
diff --git a/core/backend/admin/modules/.gitignore b/core/backend/admin/modules/.gitignore @@ -1,4 +0,0 @@ -# Ignore everything in this directory -* -# Except this file -!.gitignore -\ No newline at end of file diff --git a/core/backend/admin/modules/module_normal-login/check_auth.php b/core/backend/admin/modules/module_normal-login/check_auth.php @@ -0,0 +1,57 @@ +<?php + /* + * useable var + * authokay boolean + * authinfo Integer/String if (authokay) { the userid } else { the reason because the auth faild} + */ + ############################### + # include files from root dir # + ############################### + $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); + $currentdir = getcwd(); + $root_2 = str_replace($root_1, '', $currentdir); + $root_3 = explode("/", $root_2); + if ($root_3[1] == 'core') { + $root = realpath($_SERVER["DOCUMENT_ROOT"]); + }else{ + $root = $root_1 . '/' . $root_3[1]; + } + $authokay = false; + include($root . '/core/config/connect.db.inc.php'); + //Check if Database connection established + if (mysqli_connect_errno()) { + printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); + exit(); + } + + if (!empty($_SERVER['HTTP_CLIENT_IP'])) { + $ip = $_SERVER['HTTP_CLIENT_IP']; + } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) { + $ip = $_SERVER['HTTP_X_FORWARDED_FOR']; + } else { + $ip = $_SERVER['REMOTE_ADDR']; + } + $hash=hash('sha512',$_SERVER['HTTP_USER_AGENT'].$ip); + $abfrage = "SELECT id, hash,vaildtime,userid FROM cookiedata WHERE hash = '$hash'"; + $ergebnis = mysqli_query($connection, $abfrage); + while($row = mysqli_fetch_object($ergebnis)){ + if ($row->hash == $hash){ + $id_db = $row->id; + $expirtaion_time=$row->vaildtime; + $userid = $row->userid; + } + } + $cookie = hash('sha512',$hash.$userid.$expirtaion_time); + if ($expirtaion_time< time()) { + $loeschen = "DELETE FROM acess_data WHERE id = '$id_db'"; + $loesch = mysqli_query($connection, $loeschen); + $authinfo = 'cookie timeout'; + }else{ + if ($_COOKIE["acess"] == $cookie) { + $authokay = true; + $authinfo = $userid; + } else { + $authinfo = 'wrong cookie'; + } + } +?> +\ No newline at end of file diff --git a/core/backend/admin/modules/module_normal-login/del_token.php b/core/backend/admin/modules/module_normal-login/del_token.php @@ -0,0 +1,24 @@ +<?php + ############################### + # include files from root dir # + ############################### + $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); + $currentdir = getcwd(); + $root_2 = str_replace($root_1, '', $currentdir); + $root_3 = explode("/", $root_2); + if ($root_3[1] == 'core') { + $root = realpath($_SERVER["DOCUMENT_ROOT"]); + }else{ + $root = $root_1 . '/' . $root_3[1]; + } + $token = $_GET['token']; + include($root . '/core/config/connect.db.inc.php'); + //Check if Database connection established + if (mysqli_connect_errno()) { + printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); + exit(); + } + $loeschen = "DELETE FROM hashtoken WHERE token = '$token'"; + $loesch = mysqli_query($connection, $loeschen); + header("Location: ./login.php"); +?> diff --git a/core/backend/admin/modules/module_normal-login/inhalt.php b/core/backend/admin/modules/module_normal-login/inhalt.php @@ -0,0 +1,9 @@ +<?php + include('./navi.php'); + include('./check_auth.php'); + if ($authokay) { + print("hallo Benutzer mit der ID ".$authinfo); + } else { + die($authinfo); + } +?> +\ No newline at end of file diff --git a/core/backend/admin/modules/module_normal-login/login.php b/core/backend/admin/modules/module_normal-login/login.php @@ -0,0 +1,77 @@ +<html> + <head> + <title>login</title> + <meta http-equiv="content-type" content="text/html; charset=UTF-8"> + <!--<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js"></script>!--> + <script type="text/javascript" src="../../../../libs/security/sha.js"></script> + <script type="text/javascript"> + window.setTimeout("reload_timeout()", 295000); + function reload_timeout() { + var token = document.getElementById('token').innerHTML; + self.location.href='./del_token.php?token='+token; + } + function go() { + var token = document.getElementById('token').innerHTML; + var username = document.getElementById('username').value; + var passwd = document.getElementById('passwd').value; + var ga_token = document.getElementById('ga_token').value; + var shaObj = new jsSHA(passwd+username, "TEXT"); + var hash = shaObj.getHash("SHA-512", "HEX"); + //document.write(hash); + var shaObj1 = new jsSHA(hash+token, "TEXT"); + var hash = shaObj1.getHash("SHA-512", "HEX"); + //document.write('<br/>'); + //document.write(hash); + //alert("test") + var anfragestr = './login_handling.php?username='+username+'&token='+token+'&hash='+hash+'&ga_token='+ga_token; + self.location.href=anfragestr; + } + </script> + </head> + <body> + <div id='token' style="display:none"> + <?php + ############################### + # include files from root dir # + ############################### + $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); + $currentdir = getcwd(); + $root_2 = str_replace($root_1, '', $currentdir); + $root_3 = explode("/", $root_2); + if ($root_3[1] == 'core') { + $root = realpath($_SERVER["DOCUMENT_ROOT"]); + }else{ + $root = $root_1 . '/' . $root_3[1]; + } + include($root . '/core/config/connect.db.inc.php'); + //Check if Database connection established + if (mysqli_connect_errno()) { + printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); + exit(); + } + $token = hash('sha512',rand().time()); + $time = time(); + $eintrag = "INSERT INTO hashtoken(token, time)VALUES('$token', '$time')"; + $eintragen = mysqli_query($connection, $eintrag); + print($token); + ?> + </div> + <?php + include_once('./navi.php'); + ?> + <h1>Login ohne Klartext-Passwort übertragung</h1> + Username: + <br/> + <input type='text' id='username' name='username'/> + <br/> + Passwort: + <br/> + <input type="password" id='passwd' name="passwd"/> + <br/> + Token: + <br/> + <input type="text" id='ga_token' name="ga_token"/> + <br/> + <input type='submit' name="go" value="go" onClick='go()'/> + </body> +</html> +\ No newline at end of file diff --git a/core/backend/admin/modules/module_normal-login/login_handling.php b/core/backend/admin/modules/module_normal-login/login_handling.php @@ -0,0 +1,109 @@ +<?php + ############################### + # include files from root dir # + ############################### + $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); + $currentdir = getcwd(); + $root_2 = str_replace($root_1, '', $currentdir); + $root_3 = explode("/", $root_2); + if ($root_3[1] == 'core') { + $root = realpath($_SERVER["DOCUMENT_ROOT"]); + }else{ + $root = $root_1 . '/' . $root_3[1]; + } + include_once('./navi.php'); + include_once($root . '/core/libs/GA/GoogleAuthenticator.php'); + $g = new GoogleAuthenticator(); + function die_back($str) { + die ($str.'<br/><a href="./login.php">back</a>'); + } + $token = $_GET['ga_token']; + $user = $_GET['username']; + $hash = $_GET['hash']; + $ga_token_input = $_GET['ga_token']; + include($root . '/core/config/connect.db.inc.php'); + //Check if Database connection established + if (mysqli_connect_errno()) { + printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); + exit(); + } + $token_vaild = false; + $abfrage = "SELECT time,vaild_sec,token FROM hashtoken WHERE token = '$token'"; + $ergebnis = mysqli_query($connection, $abfrage); + + while($row = mysqli_fetch_object($ergebnis)){ + $token_vaild = true; + $creat_time = $row->time; + $vaild_sec = $row->vaild_sec; + } + + if (!($token_vaild)) { + die_back('something went wrong :/'); + } + if (($creat_time + $vaild_sec) < time()) { + die_back('timeout'); + } + $loeschen = "DELETE FROM hashtoken WHERE token = '$token'"; + $loesch = mysqli_query($connection, $loeschen); + $user_exist = false; + $abfrage = "SELECT name,passwdhash,id,ga_secret FROM user WHERE name = '$user'"; + $ergebnis = mysqli_query($connection, $abfrage); + while($row = mysqli_fetch_object($ergebnis)){ + $user_exist = true; + $passwdhash = $row->passwdhash; + $userid = $row->id; + $ga_secret = $row->ga_secret; + } + if (!$user_exist) { + die_back('unbekanter benutzername'); + } + $hash_db = hash('sha512',$passwdhash.$token); + if ($hash_db == $hash) { + print("du bist eingelogt"); + } else { + die_back('falsches passwort'); + } + + if (!empty($_SERVER['HTTP_CLIENT_IP'])) { + $ip = $_SERVER['HTTP_CLIENT_IP']; + } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) { + $ip = $_SERVER['HTTP_X_FORWARDED_FOR']; + } else { + $ip = $_SERVER['REMOTE_ADDR']; + } + $hash=hash('sha512',$_SERVER['HTTP_USER_AGENT'].$ip); + + $vorhanden = false; + + $abfrage = "SELECT id, hash FROM cookiedata WHERE hash = '$hash'"; + $ergebnis = mysqli_query($connection, $abfrage); + while($row = mysqli_fetch_object($ergebnis)){ + if ($row->hash == $hash){ + $id_cookie = $row->id; + $vorhanden =true; + } + } + + $expiration_time = time() +120*60; //laenge des auth + $cookie = hash('sha512',$hash.$userid.$expiration_time); + if ($vorhanden){ + $aendern = "UPDATE cookiedata Set hash = '$hash', userid = '$userid', vaildtime = '$expiration_time' cookie_hash = '$cookie' WHERE id = '$id_cookie'"; + $update = mysqli_query($connection, $aendern); + print("update"); + } else { + $eintrag = "INSERT INTO cookiedata (hash, userid, vaildtime, cookie_hash) VALUES ('$hash', '$userid', '$expiration_time', '$cookie')"; + $eintragen = mysqli_query($connection, $eintrag); + print("new"); + } + + if ($eintragen ||$update) { + if ($g->checkCode($ga_secret,$ga_token_input)) { + setcookie("acess",$cookie,$expiration_time); + print("Hallo ".$user."<br/>Wilkommen"); + } else { + die_back("the token is wrong or to old, try it again"); + } + } else { + die_back("something on the db went wrong"); + } +?> +\ No newline at end of file diff --git a/core/backend/admin/modules/module_normal-login/logout.php b/core/backend/admin/modules/module_normal-login/logout.php @@ -0,0 +1,29 @@ +<?php + ############################### + # include files from root dir # + ############################### + $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); + $currentdir = getcwd(); + $root_2 = str_replace($root_1, '', $currentdir); + $root_3 = explode("/", $root_2); + if ($root_3[1] == 'core') { + $root = realpath($_SERVER["DOCUMENT_ROOT"]); + }else{ + $root = $root_1 . '/' . $root_3[1]; + } + include('./navi.php'); + $cookie = $_COOKIE["acess"]; + include($root . '/core/config/connect.db.inc.php'); + //Check if Database connection established + if (mysqli_connect_errno()) { + printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); + exit(); + } + include('./check_auth.php'); + if (!$authokay) { + die('nobody to logout'); + } + $loeschen = "DELETE FROM cookiedata WHERE cookie_hash = '$cookie'"; + $loesch = mysql_query($connection, $loeschen); + print('logged out'); +?> +\ No newline at end of file diff --git a/core/backend/admin/modules/module_normal-login/navi.php b/core/backend/admin/modules/module_normal-login/navi.php @@ -0,0 +1,5 @@ +<a href="./login.php">login</a></br> +<a href="./logout.php">logout</a></br> +<a href="./register.php">register</a></br> +<a href="./secret.php">show secret</a></br> +<a href="./inhalt.php">inhalt</a></br> diff --git a/core/backend/admin/modules/module_normal-login/register.php b/core/backend/admin/modules/module_normal-login/register.php @@ -0,0 +1,18 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" + "http://www.w3.org/TR/html4/strict.dtd"> +<html> + <head> + <title>register</title> + <meta http-equiv="content-type" content="text/html; charset=UTF-8"> + </head> + <body> + <form action='./register_handling.php' method='POST'> + Username: + <input type='text' name='username'/> + <br/> + Passwort + <input type="password" name="passwd"/> + <input type='submit' name="go" value="go"/> + </form> + </body> +</html> +\ No newline at end of file diff --git a/core/backend/admin/modules/module_normal-login/register_handling.php b/core/backend/admin/modules/module_normal-login/register_handling.php @@ -0,0 +1,47 @@ +<?php + //<body onload="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';"> + ############################### + # include files from root dir # + ############################### + $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); + $currentdir = getcwd(); + $root_2 = str_replace($root_1, '', $currentdir); + $root_3 = explode("/", $root_2); + if ($root_3[1] == 'core') { + $root = realpath($_SERVER["DOCUMENT_ROOT"]); + }else{ + $root = $root_1 . '/' . $root_3[1]; + } + include_once('./navi.php'); + if (isset($_POST['go'])) { + include_once($root . '/core/libs/GA/GoogleAuthenticator.php'); + $g = new GoogleAuthenticator(); + $ga_secret = $g->generateSecret(); + $username = $_POST['username']; + $passwdhash = hash('sha512',$_POST['passwd'].$username); + include($root . '/core/config/connect.db.inc.php'); + //Check if Database connection established + if (mysqli_connect_errno()) { + printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); + exit(); + } + $eintrag = "INSERT INTO user(name, passwdhash, ga_secret)VALUES('$username', '$passwdhash', '$ga_secret')"; + $eintragen = mysqli_query($connection, $eintrag); + print("registiert<br/>"); + //* + print "this is your secret for the GoogleAuthenticator: <div id='secret' style='visibility:hidden'>$ga_secret</div> \n"; + print("keep it secret!!!!<br/>"); + //*/ + //include('./secret.php'); +?> + <a href="#" onmousedown="document.getElementById('qr_code').style.visibility='visible'; document.getElementById('secret').style.visibility='visible';" onmouseup="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';" onmouseout="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';">show QR Code and secret</a><br> + <br/> +<?php + //* + print('<img id="qr_code" src="'); + print $g->getURL($username,'loginsec',$ga_secret); + print('" style="visibility:hidden"> '); + //print('" alt="" visibility="hidden"> '); + //*/ + } +?> diff --git a/core/backend/admin/modules/module_normal-login/secret.php b/core/backend/admin/modules/module_normal-login/secret.php @@ -0,0 +1,55 @@ +<body onload="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';"> +<?php + ############################### + # include files from root dir # + ############################### + $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); + $currentdir = getcwd(); + $root_2 = str_replace($root_1, '', $currentdir); + $root_3 = explode("/", $root_2); + if ($root_3[1] == 'core') { + $root = realpath($_SERVER["DOCUMENT_ROOT"]); + }else{ + $root = $root_1 . '/' . $root_3[1]; + } + if (empty($_SERVER['HTTPS'])) { + print('<body style="background-color:red;font-size:30px"><div style="color:white"><div style="font-size:240px">Stop</div><p>You wanted do view this site without an SSL encryption. The Secret can be stolen</p><br/><a href="https://raspberrypi/login_sec/secret.php">Here is the SSL Site</a></div></body>'); + die(); + } + include('./navi.php'); + include('./check_auth.php'); + if (!$authokay) { + die('not allowed'); + } + include_once($root . '/core/libs/GA/GoogleAuthenticator.php'); + $g = new GoogleAuthenticator(); + include($root . '/core/config/connect.db.inc.php'); + //Check if Database connection established + if (mysqli_connect_errno()) { + printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); + exit(); + } + $user_exist = false; + $abfrage = "SELECT name,ga_secret FROM user WHERE id = '$authinfo'"; + $ergebnis = mysqli_query($connection, $abfrage); + while($row = mysqli_fetch_object($ergebnis)){ + $user_exist = true; + $username = $row->name; + $ga_secret = $row->ga_secret; + } + if (!$user_exist) { + die('user $user not found!'); + } + print "this is your secret for the GoogleAuthenticator: <div id='secret' style='visibility:hidden'>$ga_secret</div> \n"; + print("keep it secret!!!!<br/>"); +?> +<a href="#" onmousedown="document.getElementById('qr_code').style.visibility='visible'; document.getElementById('secret').style.visibility='visible';" onmouseup="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';" onmouseout="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';">show QR Code and secret</a><br> +<br/> +<?php + print('<img id="qr_code" src="'); + print $g->getURL($username,'loginsec',$ga_secret); + print('" visibility="hidden" style="visibility:hidden"> '); + //print('" alt="" visibility="hidden"> '); + +?> +</body> +\ No newline at end of file