commit eb0d29d6c43b908c03ac749376fed70240fee2f2
parent fc50c6d8017211ceb6c32b06d2d16789b1c95e48
Author: MTRNord <mtrnord1@gmail.com>
Date: Tue, 30 Dec 2014 23:19:05 +0100
update login calling
Diffstat:
10 files changed, 19 insertions(+), 437 deletions(-)
diff --git a/core/backend/admin/user/login/check_auth.php b/core/backend/admin/user/login/check_auth.php
@@ -1,57 +0,0 @@
-<?php
- /*
- * useable var
- * authokay boolean
- * authinfo Integer/String if (authokay) { the userid } else { the reason because the auth faild}
- */
- ###############################
- # include files from root dir #
- ###############################
- $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]);
- $currentdir = getcwd();
- $root_2 = str_replace($root_1, '', $currentdir);
- $root_3 = explode("/", $root_2);
- if ($root_3[1] == 'core') {
- $root = realpath($_SERVER["DOCUMENT_ROOT"]);
- }else{
- $root = $root_1 . '/' . $root_3[1];
- }
- $authokay = false;
- include($root . '/core/config/connect.db.inc.php');
- //Check if Database connection established
- if (mysqli_connect_errno()) {
- printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error());
- exit();
- }
-
- if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
- $ip = $_SERVER['HTTP_CLIENT_IP'];
- } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
- $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
- } else {
- $ip = $_SERVER['REMOTE_ADDR'];
- }
- $hash=hash('sha512',$_SERVER['HTTP_USER_AGENT'].$ip);
- $abfrage = "SELECT id, hash,vaildtime,userid FROM cookiedata WHERE hash = '$hash'";
- $ergebnis = mysqli_query($connection, $abfrage);
- while($row = mysqli_fetch_object($ergebnis)){
- if ($row->hash == $hash){
- $id_db = $row->id;
- $expirtaion_time=$row->vaildtime;
- $userid = $row->userid;
- }
- }
- $cookie = hash('sha512',$hash.$userid.$expirtaion_time);
- if ($expirtaion_time< time()) {
- $loeschen = "DELETE FROM acess_data WHERE id = '$id_db'";
- $loesch = mysqli_query($connection, $loeschen);
- $authinfo = 'cookie timeout';
- }else{
- if ($_COOKIE["acess"] == $cookie) {
- $authokay = true;
- $authinfo = $userid;
- } else {
- $authinfo = 'wrong cookie';
- }
- }
-?>
-\ No newline at end of file
diff --git a/core/backend/admin/user/login/del_token.php b/core/backend/admin/user/login/del_token.php
@@ -1,24 +0,0 @@
-<?php
- ###############################
- # include files from root dir #
- ###############################
- $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]);
- $currentdir = getcwd();
- $root_2 = str_replace($root_1, '', $currentdir);
- $root_3 = explode("/", $root_2);
- if ($root_3[1] == 'core') {
- $root = realpath($_SERVER["DOCUMENT_ROOT"]);
- }else{
- $root = $root_1 . '/' . $root_3[1];
- }
- $token = $_GET['token'];
- include($root . '/core/config/connect.db.inc.php');
- //Check if Database connection established
- if (mysqli_connect_errno()) {
- printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error());
- exit();
- }
- $loeschen = "DELETE FROM hashtoken WHERE token = '$token'";
- $loesch = mysqli_query($connection, $loeschen);
- header("Location: ./login.php");
-?>
diff --git a/core/backend/admin/user/login/inhalt.php b/core/backend/admin/user/login/inhalt.php
@@ -1,9 +0,0 @@
-<?php
- include('./navi.php');
- include('./check_auth.php');
- if ($authokay) {
- print("hallo Benutzer mit der ID ".$authinfo);
- } else {
- die($authinfo);
- }
-?>
-\ No newline at end of file
diff --git a/core/backend/admin/user/login/login.php b/core/backend/admin/user/login/login.php
@@ -1,77 +1,18 @@
-<html>
- <head>
- <title>login</title>
- <meta http-equiv="content-type" content="text/html; charset=UTF-8">
- <!--<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js"></script>!-->
- <script type="text/javascript" src="../../../../libs/security/sha.js"></script>
- <script type="text/javascript">
- window.setTimeout("reload_timeout()", 295000);
- function reload_timeout() {
- var token = document.getElementById('token').innerHTML;
- self.location.href='./del_token.php?token='+token;
- }
- function go() {
- var token = document.getElementById('token').innerHTML;
- var username = document.getElementById('username').value;
- var passwd = document.getElementById('passwd').value;
- var ga_token = document.getElementById('ga_token').value;
- var shaObj = new jsSHA(passwd+username, "TEXT");
- var hash = shaObj.getHash("SHA-512", "HEX");
- //document.write(hash);
- var shaObj1 = new jsSHA(hash+token, "TEXT");
- var hash = shaObj1.getHash("SHA-512", "HEX");
- //document.write('<br/>');
- //document.write(hash);
- //alert("test")
- var anfragestr = './login_handling.php?username='+username+'&token='+token+'&hash='+hash+'&ga_token='+ga_token;
- self.location.href=anfragestr;
- }
- </script>
- </head>
- <body>
- <div id='token' style="display:none">
- <?php
- ###############################
- # include files from root dir #
- ###############################
- $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]);
- $currentdir = getcwd();
- $root_2 = str_replace($root_1, '', $currentdir);
- $root_3 = explode("/", $root_2);
- if ($root_3[1] == 'core') {
- $root = realpath($_SERVER["DOCUMENT_ROOT"]);
- }else{
- $root = $root_1 . '/' . $root_3[1];
- }
- include($root . '/core/config/connect.db.inc.php');
- //Check if Database connection established
- if (mysqli_connect_errno()) {
- printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error());
- exit();
- }
- $token = hash('sha512',rand().time());
- $time = time();
- $eintrag = "INSERT INTO hashtoken(token, time)VALUES('$token', '$time')";
- $eintragen = mysqli_query($connection, $eintrag);
- print($token);
- ?>
- </div>
- <?php
- include_once('./navi.php');
- ?>
- <h1>Login ohne Klartext-Passwort übertragung</h1>
- Username:
- <br/>
- <input type='text' id='username' name='username'/>
- <br/>
- Passwort:
- <br/>
- <input type="password" id='passwd' name="passwd"/>
- <br/>
- Token:
- <br/>
- <input type="text" id='ga_token' name="ga_token"/>
- <br/>
- <input type='submit' name="go" value="go" onClick='go()'/>
- </body>
-</html>
-\ No newline at end of file
+<?php
+ ###############################
+ # include files from root dir #
+ ###############################
+ $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]);
+ $currentdir = getcwd();
+ $root_2 = str_replace($root_1, '', $currentdir);
+ $root_3 = explode("/", $root_2);
+ if ($root_3[1] == 'core') {
+ echo $root_3[1];
+ $root = realpath($_SERVER["DOCUMENT_ROOT"]);
+ }else{
+ $root = $root_1 . '/' . $root_3[1];
+ }
+ $login_module = "module_google-plus-login";
+ $content = file($root."/core/backend/admin/module/".$login_module."login.php");
+ echo $content;
+?>
+\ No newline at end of file
diff --git a/core/backend/admin/user/login/login_handling.php b/core/backend/admin/user/login/login_handling.php
@@ -1,109 +0,0 @@
-<?php
- ###############################
- # include files from root dir #
- ###############################
- $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]);
- $currentdir = getcwd();
- $root_2 = str_replace($root_1, '', $currentdir);
- $root_3 = explode("/", $root_2);
- if ($root_3[1] == 'core') {
- $root = realpath($_SERVER["DOCUMENT_ROOT"]);
- }else{
- $root = $root_1 . '/' . $root_3[1];
- }
- include_once('./navi.php');
- include_once($root . '/core/libs/GA/GoogleAuthenticator.php');
- $g = new GoogleAuthenticator();
- function die_back($str) {
- die ($str.'<br/><a href="./login.php">back</a>');
- }
- $token = $_GET['ga_token'];
- $user = $_GET['username'];
- $hash = $_GET['hash'];
- $ga_token_input = $_GET['ga_token'];
- include($root . '/core/config/connect.db.inc.php');
- //Check if Database connection established
- if (mysqli_connect_errno()) {
- printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error());
- exit();
- }
- $token_vaild = false;
- $abfrage = "SELECT time,vaild_sec,token FROM hashtoken WHERE token = '$token'";
- $ergebnis = mysqli_query($connection, $abfrage);
-
- while($row = mysqli_fetch_object($ergebnis)){
- $token_vaild = true;
- $creat_time = $row->time;
- $vaild_sec = $row->vaild_sec;
- }
-
- if (!($token_vaild)) {
- die_back('something went wrong :/');
- }
- if (($creat_time + $vaild_sec) < time()) {
- die_back('timeout');
- }
- $loeschen = "DELETE FROM hashtoken WHERE token = '$token'";
- $loesch = mysqli_query($connection, $loeschen);
- $user_exist = false;
- $abfrage = "SELECT name,passwdhash,id,ga_secret FROM user WHERE name = '$user'";
- $ergebnis = mysqli_query($connection, $abfrage);
- while($row = mysqli_fetch_object($ergebnis)){
- $user_exist = true;
- $passwdhash = $row->passwdhash;
- $userid = $row->id;
- $ga_secret = $row->ga_secret;
- }
- if (!$user_exist) {
- die_back('unbekanter benutzername');
- }
- $hash_db = hash('sha512',$passwdhash.$token);
- if ($hash_db == $hash) {
- print("du bist eingelogt");
- } else {
- die_back('falsches passwort');
- }
-
- if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
- $ip = $_SERVER['HTTP_CLIENT_IP'];
- } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
- $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
- } else {
- $ip = $_SERVER['REMOTE_ADDR'];
- }
- $hash=hash('sha512',$_SERVER['HTTP_USER_AGENT'].$ip);
-
- $vorhanden = false;
-
- $abfrage = "SELECT id, hash FROM cookiedata WHERE hash = '$hash'";
- $ergebnis = mysqli_query($connection, $abfrage);
- while($row = mysqli_fetch_object($ergebnis)){
- if ($row->hash == $hash){
- $id_cookie = $row->id;
- $vorhanden =true;
- }
- }
-
- $expiration_time = time() +120*60; //laenge des auth
- $cookie = hash('sha512',$hash.$userid.$expiration_time);
- if ($vorhanden){
- $aendern = "UPDATE cookiedata Set hash = '$hash', userid = '$userid', vaildtime = '$expiration_time' cookie_hash = '$cookie' WHERE id = '$id_cookie'";
- $update = mysqli_query($connection, $aendern);
- print("update");
- } else {
- $eintrag = "INSERT INTO cookiedata (hash, userid, vaildtime, cookie_hash) VALUES ('$hash', '$userid', '$expiration_time', '$cookie')";
- $eintragen = mysqli_query($connection, $eintrag);
- print("new");
- }
-
- if ($eintragen ||$update) {
- if ($g->checkCode($ga_secret,$ga_token_input)) {
- setcookie("acess",$cookie,$expiration_time);
- print("Hallo ".$user."<br/>Wilkommen");
- } else {
- die_back("the token is wrong or to old, try it again");
- }
- } else {
- die_back("something on the db went wrong");
- }
-?>
-\ No newline at end of file
diff --git a/core/backend/admin/user/login/logout.php b/core/backend/admin/user/login/logout.php
@@ -1,29 +0,0 @@
-<?php
- ###############################
- # include files from root dir #
- ###############################
- $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]);
- $currentdir = getcwd();
- $root_2 = str_replace($root_1, '', $currentdir);
- $root_3 = explode("/", $root_2);
- if ($root_3[1] == 'core') {
- $root = realpath($_SERVER["DOCUMENT_ROOT"]);
- }else{
- $root = $root_1 . '/' . $root_3[1];
- }
- include('./navi.php');
- $cookie = $_COOKIE["acess"];
- include($root . '/core/config/connect.db.inc.php');
- //Check if Database connection established
- if (mysqli_connect_errno()) {
- printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error());
- exit();
- }
- include('./check_auth.php');
- if (!$authokay) {
- die('nobody to logout');
- }
- $loeschen = "DELETE FROM cookiedata WHERE cookie_hash = '$cookie'";
- $loesch = mysql_query($connection, $loeschen);
- print('logged out');
-?>
-\ No newline at end of file
diff --git a/core/backend/admin/user/login/navi.php b/core/backend/admin/user/login/navi.php
@@ -1,5 +0,0 @@
-<a href="./login.php">login</a></br>
-<a href="./logout.php">logout</a></br>
-<a href="./register.php">register</a></br>
-<a href="./secret.php">show secret</a></br>
-<a href="./inhalt.php">inhalt</a></br>
diff --git a/core/backend/admin/user/login/register.php b/core/backend/admin/user/login/register.php
@@ -1,18 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
- "http://www.w3.org/TR/html4/strict.dtd">
-<html>
- <head>
- <title>register</title>
- <meta http-equiv="content-type" content="text/html; charset=UTF-8">
- </head>
- <body>
- <form action='./register_handling.php' method='POST'>
- Username:
- <input type='text' name='username'/>
- <br/>
- Passwort
- <input type="password" name="passwd"/>
- <input type='submit' name="go" value="go"/>
- </form>
- </body>
-</html>
-\ No newline at end of file
diff --git a/core/backend/admin/user/login/register_handling.php b/core/backend/admin/user/login/register_handling.php
@@ -1,47 +0,0 @@
-<?php
- //<body onload="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';">
- ###############################
- # include files from root dir #
- ###############################
- $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]);
- $currentdir = getcwd();
- $root_2 = str_replace($root_1, '', $currentdir);
- $root_3 = explode("/", $root_2);
- if ($root_3[1] == 'core') {
- $root = realpath($_SERVER["DOCUMENT_ROOT"]);
- }else{
- $root = $root_1 . '/' . $root_3[1];
- }
- include_once('./navi.php');
- if (isset($_POST['go'])) {
- include_once($root . '/core/libs/GA/GoogleAuthenticator.php');
- $g = new GoogleAuthenticator();
- $ga_secret = $g->generateSecret();
- $username = $_POST['username'];
- $passwdhash = hash('sha512',$_POST['passwd'].$username);
- include($root . '/core/config/connect.db.inc.php');
- //Check if Database connection established
- if (mysqli_connect_errno()) {
- printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error());
- exit();
- }
- $eintrag = "INSERT INTO user(name, passwdhash, ga_secret)VALUES('$username', '$passwdhash', '$ga_secret')";
- $eintragen = mysqli_query($connection, $eintrag);
- print("registiert<br/>");
- //*
- print "this is your secret for the GoogleAuthenticator: <div id='secret' style='visibility:hidden'>$ga_secret</div> \n";
- print("keep it secret!!!!<br/>");
- //*/
- //include('./secret.php');
-?>
- <a href="#" onmousedown="document.getElementById('qr_code').style.visibility='visible'; document.getElementById('secret').style.visibility='visible';" onmouseup="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';" onmouseout="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';">show QR Code and secret</a><br>
- <br/>
-<?php
- //*
- print('<img id="qr_code" src="');
- print $g->getURL($username,'loginsec',$ga_secret);
- print('" style="visibility:hidden"> ');
- //print('" alt="" visibility="hidden"> ');
- //*/
- }
-?>
diff --git a/core/backend/admin/user/login/secret.php b/core/backend/admin/user/login/secret.php
@@ -1,55 +0,0 @@
-<body onload="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';">
-<?php
- ###############################
- # include files from root dir #
- ###############################
- $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]);
- $currentdir = getcwd();
- $root_2 = str_replace($root_1, '', $currentdir);
- $root_3 = explode("/", $root_2);
- if ($root_3[1] == 'core') {
- $root = realpath($_SERVER["DOCUMENT_ROOT"]);
- }else{
- $root = $root_1 . '/' . $root_3[1];
- }
- if (empty($_SERVER['HTTPS'])) {
- print('<body style="background-color:red;font-size:30px"><div style="color:white"><div style="font-size:240px">Stop</div><p>You wanted do view this site without an SSL encryption. The Secret can be stolen</p><br/><a href="https://raspberrypi/login_sec/secret.php">Here is the SSL Site</a></div></body>');
- die();
- }
- include('./navi.php');
- include('./check_auth.php');
- if (!$authokay) {
- die('not allowed');
- }
- include_once($root . '/core/libs/GA/GoogleAuthenticator.php');
- $g = new GoogleAuthenticator();
- include($root . '/core/config/connect.db.inc.php');
- //Check if Database connection established
- if (mysqli_connect_errno()) {
- printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error());
- exit();
- }
- $user_exist = false;
- $abfrage = "SELECT name,ga_secret FROM user WHERE id = '$authinfo'";
- $ergebnis = mysqli_query($connection, $abfrage);
- while($row = mysqli_fetch_object($ergebnis)){
- $user_exist = true;
- $username = $row->name;
- $ga_secret = $row->ga_secret;
- }
- if (!$user_exist) {
- die('user $user not found!');
- }
- print "this is your secret for the GoogleAuthenticator: <div id='secret' style='visibility:hidden'>$ga_secret</div> \n";
- print("keep it secret!!!!<br/>");
-?>
-<a href="#" onmousedown="document.getElementById('qr_code').style.visibility='visible'; document.getElementById('secret').style.visibility='visible';" onmouseup="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';" onmouseout="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';">show QR Code and secret</a><br>
-<br/>
-<?php
- print('<img id="qr_code" src="');
- print $g->getURL($username,'loginsec',$ga_secret);
- print('" visibility="hidden" style="visibility:hidden"> ');
- //print('" alt="" visibility="hidden"> ');
-
-?>
-</body>
-\ No newline at end of file
