plugins/yubikey/corelib.php
author Dan
Thu, 30 Apr 2009 16:11:13 -0400
changeset 16 3163b9f58ae8
parent 10 748fa1b80031
child 18 dd8c53454f31
permissions -rw-r--r--
Added error for HTTP connection failure.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
0
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
     1
<?php
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
     2
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
     3
define('YK_SEC_NORMAL_USERNAME', 1);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
     4
define('YK_SEC_NORMAL_PASSWORD', 2);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
     5
define('YK_SEC_ELEV_USERNAME', 4);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
     6
define('YK_SEC_ELEV_PASSWORD', 8);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
     7
define('YK_SEC_ALLOW_NO_OTP', 16);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
     8
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
     9
define('YK_DEFAULT_VERIFY_URL', 'http://api.yubico.com/wsapi/verify');
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    10
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    11
function generate_yubikey_field($name = 'yubikey_otp', $value = false)
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    12
{
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    13
  global $lang;
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    14
  
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    15
  $fid = substr(sha1(microtime() . mt_rand()), 0, 12);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    16
  $class = $value ? 'wasfull' : 'wasempty';
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    17
  $html = '<input id="yubifield' . $fid . '" class="' . $class . '" type="hidden" name="' . $name . '" value="' . ( is_string($value) ? $value : '' ) . '" />';
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    18
  if ( $value )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    19
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    20
    $html .= '<span id="yubistat' . $fid . '" class="yubikey_status enrolled">' . $lang->get('yubiauth_ctl_status_enrolled') . '</span>';
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    21
    $atext = $lang->get('yubiauth_ctl_btn_change_key');
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    22
    $classadd = ' abutton_green';
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    23
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    24
  else
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    25
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    26
    $html .= '<span id="yubistat' . $fid . '" class="yubikey_status empty">' . $lang->get('yubiauth_ctl_status_empty') . '</span>';
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    27
    $atext = $lang->get('yubiauth_ctl_btn_enroll');
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    28
    $classadd = '';
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    29
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    30
  $html .= ' <a class="abutton' . $classadd . ' yubikey_enroll" onclick="yk_mb_init(\'yubifield' . $fid . '\', \'yubistat' . $fid . '\'); return false;" href="#enroll">' . $atext . '</a>';
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    31
  if ( $value )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    32
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    33
    $html .= ' <a class="abutton abutton_red yubikey_enroll" onclick="yk_clear(\'yubifield' . $fid . '\', \'yubistat' . $fid . '\'); return false;" href="#enroll">'
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    34
             . $lang->get('yubiauth_ctl_btn_clear') .
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    35
             '</a>';
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    36
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    37
  $html = '<noscript><input type="text" name="' . $name . '" class="yubikey_noscript" value="' . ( is_string($value) ? $value : '' ) . '" /> </noscript>'
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    38
          . $html; // '<script type="text/javascript">document.write(unescape("' . rawurlencode($html) . '"));</script>';
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    39
  return $html;
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    40
}
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    41
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    42
function yubikey_validate_otp($otp)
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    43
{
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    44
  $api_key = getConfig('yubikey_api_key');
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    45
  $api_id  = getConfig('yubikey_api_key_id');
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    46
  if ( !$api_key || !$api_id )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    47
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    48
    return array(
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    49
        'success' => false,
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    50
        'error' => 'missing_api_key'
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    51
      );
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    52
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    53
  if ( !preg_match('/^[cbdefghijklnrtuv]{44}$/', $otp) )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    54
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    55
    return array(
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    56
        'success' => false,
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    57
        'error' => 'otp_invalid_chars'
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    58
      );
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    59
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    60
  // make HTTP request
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    61
  require_once( ENANO_ROOT . '/includes/http.php' );
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    62
  $auth_url = getConfig('yubikey_auth_server', YK_DEFAULT_VERIFY_URL);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    63
  $auth_url = preg_replace('#^https?://#i', '', $auth_url);
16
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    64
  if ( !preg_match('#^(\[?[a-z0-9-:]+(?:\.[a-z0-9-:]+\]?)*)(?::([0-9]+))?(/.*)$#U', $auth_url, $match) )
0
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    65
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    66
    return array(
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    67
        'success' => false,
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    68
        'error' => 'invalid_auth_url'
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    69
      );
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    70
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    71
  $auth_server =& $match[1];
16
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    72
  $auth_port = ( !empty($match[2]) ) ? intval($match[2]) : 80;
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    73
  $auth_uri =& $match[3];
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    74
  try
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    75
  {
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    76
    $req = new Request_HTTP($auth_server, $auth_uri, 'GET', $auth_port);
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    77
    $req->add_get('id', strval($api_id));
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    78
    $req->add_get('otp', $otp);
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    79
    $req->add_get('h', yubikey_sign($req->parms_get));
0
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    80
  
16
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    81
    $response = $req->get_response_body();
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    82
  }
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    83
  catch ( Exception $e )
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    84
  {
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    85
    return array(
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    86
        'success' => false,
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    87
        'error' => 'http_failed',
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    88
        'http_error' => $e->getMessage()
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    89
      );
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
    90
  }
0
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    91
  
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    92
  if ( $req->response_code != HTTP_OK )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    93
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    94
    return array(
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    95
        'success' => false,
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    96
        'error' => 'http_response_error'
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    97
      );
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    98
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
    99
  $response = trim($response);
4
73aecd46bb56 Should work with Yubico's official server now - forgot to account for newlines.
Dan
parents: 3
diff changeset
   100
  if ( !preg_match_all('/^([a-z0-9_]+)=(.*?)\r?$/m', $response, $matches) )
0
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   101
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   102
    return array(
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   103
        'success' => false,
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   104
        'error' => 'malformed_response'
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   105
      );
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   106
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   107
  $response = array();
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   108
  foreach ( $matches[0] as $i => $_ )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   109
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   110
    $response[$matches[1][$i]] = $matches[2][$i];
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   111
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   112
  // make sure we have a status
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   113
  if ( !isset($response['status']) )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   114
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   115
    return array(
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   116
        'success' => false,
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   117
        'error' => 'response_missing_status'
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   118
      );
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   119
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   120
  // verify response signature
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   121
  // MISSING_PARAMETER is the ONLY situation under which an unsigned response is acceptable
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   122
  if ( $response['status'] !== 'MISSING_PARAMETER' )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   123
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   124
    if ( !isset($response['h']) )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   125
    {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   126
      return array(
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   127
          'success' => false,
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   128
          'error' => 'response_missing_sig'
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   129
        );
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   130
    }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   131
    if ( yubikey_sign($response) !== $response['h'] )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   132
    {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   133
      return array(
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   134
          'success' => false,
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   135
          'error' => 'response_invalid_sig'
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   136
        );
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   137
    }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   138
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   139
  if ( $response['status'] === 'OK' )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   140
  {
10
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   141
    if ( yubikey_verify_timestamp($response['t']) )
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   142
    {
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   143
      return array(
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   144
          'success' => true
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   145
        );
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   146
    }
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   147
    else
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   148
    {
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   149
      return array(
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   150
          'success' => false,
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   151
          'error' => 'timestamp_check_failed'
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   152
        );
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   153
    }
0
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   154
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   155
  else
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   156
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   157
    return array(
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   158
        'success' => false,
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   159
        'error' => strtolower("response_{$response['status']}")
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   160
      );
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   161
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   162
}
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   163
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   164
function yubikey_sign($arr)
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   165
{
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   166
  static $api_key = false;
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   167
  
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   168
  ksort($arr);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   169
  
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   170
  if ( !$api_key )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   171
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   172
    $api_key = getConfig('yubikey_api_key');
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   173
    $api_key = hexencode(base64_decode($api_key), '', '');
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   174
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   175
  
4
73aecd46bb56 Should work with Yubico's official server now - forgot to account for newlines.
Dan
parents: 3
diff changeset
   176
  if ( isset($arr['h']) )
73aecd46bb56 Should work with Yubico's official server now - forgot to account for newlines.
Dan
parents: 3
diff changeset
   177
    unset($arr['h']);
73aecd46bb56 Should work with Yubico's official server now - forgot to account for newlines.
Dan
parents: 3
diff changeset
   178
  
0
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   179
  $req = array();
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   180
  foreach ( $arr as $key => $val )
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   181
  {
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   182
    $req[] = "$key=$val";
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   183
  }
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   184
  $req = implode('&', $req);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   185
  
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   186
  $sig = hmac_sha1($req, $api_key);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   187
  $sig = hexdecode($sig);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   188
  $sig = base64_encode($sig);
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   189
  
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   190
  return $sig;
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   191
}
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   192
10
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   193
/**
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   194
 * Validate the timestamp returned in a Yubico API response. Borrowed from Drupal and backported for friendliness with earlier versions of PHP.
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   195
 * @param string Yubico timestamp
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   196
 * @return bool True if valid, false otherwise
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   197
 */
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   198
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   199
function yubikey_verify_timestamp($timestamp)
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   200
{
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   201
  $tolerance = intval(getConfig('yubikey_api_ts_tolerance', 150));
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   202
  
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   203
  $now = time();
16
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
   204
  $timestamp = preg_replace('/Z[0-9]{3}$/', '', $timestamp);
3163b9f58ae8 Added error for HTTP connection failure.
Dan
parents: 10
diff changeset
   205
  $timestamp_seconds = strtotime($timestamp);
10
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   206
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   207
  if ( !$timestamp || !$now )
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   208
  {
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   209
    return false;
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   210
  }
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   211
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   212
  if ( ( $timestamp_seconds + $tolerance ) > $now && ( $timestamp_seconds - $tolerance ) < $now )
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   213
  {
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   214
    return true;
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   215
  }
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   216
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   217
  return false;
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   218
}
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   219
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   220
0
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   221
$plugins->attachHook('compile_template', 'yubikey_attach_headers($this);');
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   222
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   223
function yubikey_attach_headers(&$template)
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   224
{
10
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   225
  global $db, $session, $paths, $template, $plugins; // Common objects
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   226
  
3
d0fe7acaf0e8 Maybe we could actually make yubikey_enable in config not ignored!
Dan
parents: 0
diff changeset
   227
  if ( getConfig('yubikey_enable', '1') != '1' )
d0fe7acaf0e8 Maybe we could actually make yubikey_enable in config not ignored!
Dan
parents: 0
diff changeset
   228
    return true;
d0fe7acaf0e8 Maybe we could actually make yubikey_enable in config not ignored!
Dan
parents: 0
diff changeset
   229
  
0
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   230
  $template->add_header('<script type="text/javascript" src="' . scriptPath . '/plugins/yubikey/yubikey.js"></script>');
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   231
  $template->add_header('<link rel="stylesheet" type="text/css" href="' . scriptPath . '/plugins/yubikey/yubikey.css" />');
9
65965da01c41 If yubikey_reg_require_otp is 1, opening login window now auto-opens Yubikey prompt
Dan
parents: 4
diff changeset
   232
  // config option for all users have yubikey
10
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   233
  $user_flags = 0;
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   234
  if ( $session->user_logged_in )
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   235
  {
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   236
    $q = $db->sql_query('SELECT COUNT(yubi_uid) > 0 FROM ' . table_prefix . "yubikey WHERE user_id = {$session->user_id};");
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   237
    if ( !$q )
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   238
      $db->_die();
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   239
    
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   240
    list($user_flags) = $db->fetchrow_num();
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   241
    $db->free_result();
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   242
  }
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   243
  
748fa1b80031 Added timestamp-based verification.
Dan
parents: 9
diff changeset
   244
  $template->add_header('<script type="text/javascript">var yk_reg_require_otp = ' . getConfig('yubikey_reg_require_otp', '0') . '; var yk_user_enabled = ' . $user_flags . ';</script>');
0
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   245
}
9d2c4f04a0d0 First commit! Hoping everything works.
Dan
parents:
diff changeset
   246