GoogleAuthenticator.php (3568B)
1 <?php 2 // Licensed under the Apache License, Version 2.0 (the "License"); 3 // you may not use this file except in compliance with the License. 4 // You may obtain a copy of the License at 5 // 6 // http://www.apache.org/licenses/LICENSE-2.0 7 // 8 // Unless required by applicable law or agreed to in writing, software 9 // distributed under the License is distributed on an "AS IS" BASIS, 10 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11 // See the License for the specific language governing permissions and 12 // limitations under the License. 13 // 14 //Changed by Benjamin Fabricius around Line 70 15 //the & in the string for the QR-Code isnt good for HTTP-GET 16 //Now it also use the API form goqr.me 17 18 ############################### 19 # include files from root dir # 20 ############################### 21 $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); 22 $currentdir = getcwd(); 23 $root_2 = str_replace($root_1, '', $currentdir); 24 $root_3 = explode("/", $root_2); 25 if ($root_3[1] == 'core') { 26 $root = realpath($_SERVER["DOCUMENT_ROOT"]); 27 }else{ 28 $root = $root_1 . '/' . $root_3[1]; 29 } 30 include_once($root . '/core/libs/helpers/FixedByteNotation.php'); 31 32 33 class GoogleAuthenticator { 34 static $PASS_CODE_LENGTH = 6; 35 static $PIN_MODULO; 36 static $SECRET_LENGTH = 10; 37 38 public function __construct() { 39 self::$PIN_MODULO = pow(10, self::$PASS_CODE_LENGTH); 40 } 41 42 public function checkCode($secret,$code) { 43 $time = floor(time() / 30); 44 for ( $i = -1; $i <= 1; $i++) { 45 46 if ($this->getCode($secret,$time + $i) == $code) { 47 return true; 48 } 49 } 50 51 return false; 52 53 } 54 55 public function getCode($secret,$time = null) { 56 57 if (!$time) { 58 $time = floor(time() / 30); 59 } 60 $base32 = new FixedBitNotation(5, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567', TRUE, TRUE); 61 $secret = $base32->decode($secret); 62 63 $time = pack("N", $time); 64 $time = str_pad($time,8, chr(0), STR_PAD_LEFT); 65 66 $hash = hash_hmac('sha1',$time,$secret,true); 67 $offset = ord(substr($hash,-1)); 68 $offset = $offset & 0xF; 69 70 $truncatedHash = self::hashToInt($hash, $offset) & 0x7FFFFFFF; 71 $pinValue = str_pad($truncatedHash % self::$PIN_MODULO,6,"0",STR_PAD_LEFT);; 72 return $pinValue; 73 } 74 75 protected function hashToInt($bytes, $start) { 76 $input = substr($bytes, $start, strlen($bytes) - $start); 77 $val2 = unpack("N",substr($input,0,4)); 78 return $val2[1]; 79 } 80 81 public function getUrl($user, $hostname, $secret) { 82 /* 83 $url = sprintf("otpauth://totp/%s@%s?secret=%s", $user, $hostname, $secret); 84 $encoder = "https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl="; 85 86 $encoderURL = sprintf( "otpauth://totp/%s@%s&secret=%s", $user, $hostname, $secret); 87 $encoderURL = $encoder.urlencode($encoderURL); 88 //*/ 89 //* 90 $url = 'https://api.qrserver.com/v1/create-qr-code/?size=150x150&data='; 91 $encoderURL = $url.urlencode("otpauth://totp/".$user."@".$hostname."?secret=".$secret); 92 //*/ 93 return $encoderURL; 94 95 } 96 97 public function generateSecret() { 98 $secret = ""; 99 for($i = 1; $i<= self::$SECRET_LENGTH;$i++) { 100 $c = rand(0,255); 101 $secret .= pack("c",$c); 102 } 103 $base32 = new FixedBitNotation(5, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567', TRUE, TRUE); 104 return $base32->encode($secret); 105 106 107 } 108 109 } 110