From 6071fe81b410ec6a971d0e45379a51809cbeec71 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 00:55:26 -0400
Subject: [PATCH 01/13] Move Authentication::setAuthenticatedSessionForUser to
 Session::setAuthenticatedForUser

---
 include/api.php             |   4 +-
 mod/manage.php              |   5 +-
 mod/openid.php              |   4 +-
 src/Core/Authentication.php | 109 ----------------------------
 src/Core/Session.php        | 138 +++++++++++++++++++++++++++++++++++-
 src/Module/Login.php        |   9 ++-
 6 files changed, 150 insertions(+), 119 deletions(-)

diff --git a/include/api.php b/include/api.php
index f360dc411..eccd77675 100644
--- a/include/api.php
+++ b/include/api.php
@@ -11,7 +11,6 @@ use Friendica\Content\ContactSelector;
 use Friendica\Content\Feature;
 use Friendica\Content\Text\BBCode;
 use Friendica\Content\Text\HTML;
-use Friendica\Core\Authentication;
 use Friendica\Core\Config;
 use Friendica\Core\Hook;
 use Friendica\Core\L10n;
@@ -19,6 +18,7 @@ use Friendica\Core\Logger;
 use Friendica\Core\NotificationsManager;
 use Friendica\Core\PConfig;
 use Friendica\Core\Protocol;
+use Friendica\Core\Session;
 use Friendica\Core\System;
 use Friendica\Core\Worker;
 use Friendica\Database\DBA;
@@ -250,7 +250,7 @@ function api_login(App $a)
 		throw new UnauthorizedException("This API requires login");
 	}
 
-	Authentication::setAuthenticatedSessionForUser($record);
+	Session::setAuthenticatedForUser($a, $record);
 
 	$_SESSION["allow_api"] = true;
 
diff --git a/mod/manage.php b/mod/manage.php
index 52ddfdf03..58590264a 100644
--- a/mod/manage.php
+++ b/mod/manage.php
@@ -2,11 +2,12 @@
 /**
  * @file mod/manage.php
  */
+
 use Friendica\App;
-use Friendica\Core\Authentication;
 use Friendica\Core\Hook;
 use Friendica\Core\L10n;
 use Friendica\Core\Renderer;
+use Friendica\Core\Session;
 use Friendica\Database\DBA;
 
 function manage_post(App $a) {
@@ -108,7 +109,7 @@ function manage_post(App $a) {
 		unset($_SESSION['sysmsg_info']);
 	}
 
-	Authentication::setAuthenticatedSessionForUser($r[0], true, true);
+	Session::setAuthenticatedForUser($a, $r[0], true, true);
 
 	if ($limited_id) {
 		$_SESSION['submanage'] = $original_id;
diff --git a/mod/openid.php b/mod/openid.php
index 7300c686b..def34ff08 100644
--- a/mod/openid.php
+++ b/mod/openid.php
@@ -4,10 +4,10 @@
  */
 
 use Friendica\App;
-use Friendica\Core\Authentication;
 use Friendica\Core\Config;
 use Friendica\Core\L10n;
 use Friendica\Core\Logger;
+use Friendica\Core\Session;
 use Friendica\Database\DBA;
 use Friendica\Util\Strings;
 
@@ -52,7 +52,7 @@ function openid_content(App $a) {
 
 				unset($_SESSION['openid']);
 
-				Authentication::setAuthenticatedSessionForUser($r[0],true,true);
+				Session::setAuthenticatedForUser($a, $r[0],true,true);
 
 				// just in case there was no return url set
 				// and we fell through
diff --git a/src/Core/Authentication.php b/src/Core/Authentication.php
index 1963d34b4..1826602df 100644
--- a/src/Core/Authentication.php
+++ b/src/Core/Authentication.php
@@ -6,10 +6,7 @@
 namespace Friendica\Core;
 
 use Friendica\BaseObject;
-use Friendica\Database\DBA;
-use Friendica\Model\User;
 use Friendica\Util\BaseURL;
-use Friendica\Util\DateTimeFormat;
 
 /**
 * Handle Authentification, Session and Cookies
@@ -55,112 +52,6 @@ class Authentication extends BaseObject
 		setcookie("Friendica", $value, $time, "/", "", (Config::get('system', 'ssl_policy') == BaseUrl::SSL_POLICY_FULL), true);
 	}
 
-	/**
-	 * @brief Sets the provided user's authenticated session
-	 *
-	 * @todo  Should be moved to Friendica\Core\Session once it's created
-	 *
-	 * @param array $user_record
-	 * @param bool  $login_initial
-	 * @param bool  $interactive
-	 * @param bool  $login_refresh
-	 * @throws \Friendica\Network\HTTPException\InternalServerErrorException
-	 */
-	public static function setAuthenticatedSessionForUser($user_record, $login_initial = false, $interactive = false, $login_refresh = false)
-	{
-		$a = self::getApp();
-
-		$_SESSION['uid'] = $user_record['uid'];
-		$_SESSION['theme'] = $user_record['theme'];
-		$_SESSION['mobile-theme'] = PConfig::get($user_record['uid'], 'system', 'mobile_theme');
-		$_SESSION['authenticated'] = 1;
-		$_SESSION['page_flags'] = $user_record['page-flags'];
-		$_SESSION['my_url'] = $a->getbaseUrl() . '/profile/' . $user_record['nickname'];
-		$_SESSION['my_address'] = $user_record['nickname'] . '@' . substr($a->getbaseUrl(), strpos($a->getbaseUrl(), '://') + 3);
-		$_SESSION['addr'] = defaults($_SERVER, 'REMOTE_ADDR', '0.0.0.0');
-
-		$a->user = $user_record;
-
-		if ($interactive) {
-			if ($a->user['login_date'] <= DBA::NULL_DATETIME) {
-				$_SESSION['return_path'] = 'profile_photo/new';
-				$a->module = 'profile_photo';
-				info(L10n::t("Welcome ") . $a->user['username'] . EOL);
-				info(L10n::t('Please upload a profile photo.') . EOL);
-			} else {
-				info(L10n::t("Welcome back ") . $a->user['username'] . EOL);
-			}
-		}
-
-		$member_since = strtotime($a->user['register_date']);
-		if (time() < ($member_since + ( 60 * 60 * 24 * 14))) {
-			$_SESSION['new_member'] = true;
-		} else {
-			$_SESSION['new_member'] = false;
-		}
-		if (strlen($a->user['timezone'])) {
-			date_default_timezone_set($a->user['timezone']);
-			$a->timezone = $a->user['timezone'];
-		}
-
-		$masterUid = $user_record['uid'];
-
-		if (!empty($_SESSION['submanage'])) {
-			$user = DBA::selectFirst('user', ['uid'], ['uid' => $_SESSION['submanage']]);
-			if (DBA::isResult($user)) {
-				$masterUid = $user['uid'];
-			}
-		}
-
-		$a->identities = User::identities($masterUid);
-
-		if ($login_initial) {
-			Logger::log('auth_identities: ' . print_r($a->identities, true), Logger::DEBUG);
-		}
-		if ($login_refresh) {
-			Logger::log('auth_identities refresh: ' . print_r($a->identities, true), Logger::DEBUG);
-		}
-
-		$contact = DBA::selectFirst('contact', [], ['uid' => $_SESSION['uid'], 'self' => true]);
-		if (DBA::isResult($contact)) {
-			$a->contact = $contact;
-			$a->cid = $contact['id'];
-			$_SESSION['cid'] = $a->cid;
-		}
-
-		header('X-Account-Management-Status: active; name="' . $a->user['username'] . '"; id="' . $a->user['nickname'] . '"');
-
-		if ($login_initial || $login_refresh) {
-			DBA::update('user', ['login_date' => DateTimeFormat::utcNow()], ['uid' => $_SESSION['uid']]);
-
-			// Set the login date for all identities of the user
-			DBA::update('user', ['login_date' => DateTimeFormat::utcNow()],
-				['parent-uid' => $masterUid, 'account_removed' => false]);
-		}
-
-		if ($login_initial) {
-			/*
-			 * If the user specified to remember the authentication, then set a cookie
-			 * that expires after one week (the default is when the browser is closed).
-			 * The cookie will be renewed automatically.
-			 * The week ensures that sessions will expire after some inactivity.
-			 */
-			if (!empty($_SESSION['remember'])) {
-				Logger::log('Injecting cookie for remembered user ' . $a->user['nickname']);
-				self::setCookie(604800, $user_record);
-				unset($_SESSION['remember']);
-			}
-		}
-
-		if ($login_initial) {
-			Hook::callAll('logged_in', $a->user);
-
-			if (($a->module !== 'home') && isset($_SESSION['return_path'])) {
-				$a->internalRedirect($_SESSION['return_path']);
-			}
-		}
-	}
-
 	/**
 	 * @brief Kills the "Friendica" cookie and all session data
 	 */
diff --git a/src/Core/Session.php b/src/Core/Session.php
index f1da864bb..9dadbb168 100644
--- a/src/Core/Session.php
+++ b/src/Core/Session.php
@@ -5,9 +5,13 @@
  */
 namespace Friendica\Core;
 
+use Friendica\App;
 use Friendica\Core\Session\CacheSessionHandler;
 use Friendica\Core\Session\DatabaseSessionHandler;
+use Friendica\Database\DBA;
+use Friendica\Model\User;
 use Friendica\Util\BaseURL;
+use Friendica\Util\DateTimeFormat;
 
 /**
  * High-level Session service class
@@ -25,7 +29,7 @@ class Session
 		ini_set('session.use_only_cookies', 1);
 		ini_set('session.cookie_httponly', 1);
 
-		if (Config::get('system', 'ssl_policy') == BaseUrl::SSL_POLICY_FULL) {
+		if (Config::get('system', 'ssl_policy') == BaseURL::SSL_POLICY_FULL) {
 			ini_set('session.cookie_secure', 1);
 		}
 
@@ -66,8 +70,140 @@ class Session
 		return $return;
 	}
 
+	/**
+	 * Sets a single session variable.
+	 * Overrides value of existing key.
+	 *
+	 * @param string $name
+	 * @param mixed $value
+	 */
 	public static function set($name, $value)
 	{
 		$_SESSION[$name] = $value;
 	}
+
+	/**
+	 * Sets multiple session variables.
+	 * Overrides values for existing keys.
+	 *
+	 * @param array $values
+	 */
+	public static function setMultiple(array $values)
+	{
+		$_SESSION = $values + $_SESSION;
+	}
+
+	/**
+	 * Removes a session variable.
+	 * Ignores missing keys.
+	 *
+	 * @param $name
+	 */
+	public static function remove($name)
+	{
+		unset($_SESSION[$name]);
+	}
+
+	/**
+	 * @brief Sets the provided user's authenticated session
+	 *
+	 * @param App   $a
+	 * @param array $user_record
+	 * @param bool  $login_initial
+	 * @param bool  $interactive
+	 * @param bool  $login_refresh
+	 * @throws \Friendica\Network\HTTPException\InternalServerErrorException
+	 */
+	public static function setAuthenticatedForUser(App $a, array $user_record, $login_initial = false, $interactive = false, $login_refresh = false)
+	{
+		self::setMultiple([
+			'uid'           => $user_record['uid'],
+			'theme'         => $user_record['theme'],
+			'mobile-theme'  => PConfig::get($user_record['uid'], 'system', 'mobile_theme'),
+			'authenticated' => 1,
+			'page_flags'    => $user_record['page-flags'],
+			'my_url'        => $a->getBaseURL() . '/profile/' . $user_record['nickname'],
+			'my_address'    => $user_record['nickname'] . '@' . substr($a->getBaseURL(), strpos($a->getBaseURL(), '://') + 3),
+			'addr'          => defaults($_SERVER, 'REMOTE_ADDR', '0.0.0.0'),
+		]);
+
+		$member_since = strtotime($user_record['register_date']);
+		self::set('new_member', time() < ($member_since + ( 60 * 60 * 24 * 14)));
+
+		if (strlen($user_record['timezone'])) {
+			date_default_timezone_set($user_record['timezone']);
+			$a->timezone = $user_record['timezone'];
+		}
+
+		$masterUid = $user_record['uid'];
+
+		if (!empty($_SESSION['submanage'])) {
+			$user = DBA::selectFirst('user', ['uid'], ['uid' => $_SESSION['submanage']]);
+			if (DBA::isResult($user)) {
+				$masterUid = $user['uid'];
+			}
+		}
+
+		$a->identities = User::identities($masterUid);
+
+		if ($login_initial) {
+			$a->getLogger()->info('auth_identities: ' . print_r($a->identities, true));
+		}
+
+		if ($login_refresh) {
+			$a->getLogger()->info('auth_identities refresh: ' . print_r($a->identities, true));
+		}
+
+		$contact = DBA::selectFirst('contact', [], ['uid' => $_SESSION['uid'], 'self' => true]);
+		if (DBA::isResult($contact)) {
+			$a->contact = $contact;
+			$a->cid = $contact['id'];
+			self::set('cid', $a->cid);
+		}
+
+		header('X-Account-Management-Status: active; name="' . $user_record['username'] . '"; id="' . $user_record['nickname'] . '"');
+
+		if ($login_initial || $login_refresh) {
+			DBA::update('user', ['login_date' => DateTimeFormat::utcNow()], ['uid' => $_SESSION['uid']]);
+
+			// Set the login date for all identities of the user
+			DBA::update('user', ['login_date' => DateTimeFormat::utcNow()],
+				['parent-uid' => $masterUid, 'account_removed' => false]);
+		}
+
+		if ($login_initial) {
+			/*
+			 * If the user specified to remember the authentication, then set a cookie
+			 * that expires after one week (the default is when the browser is closed).
+			 * The cookie will be renewed automatically.
+			 * The week ensures that sessions will expire after some inactivity.
+			 */
+			;
+			if (self::get('remember')) {
+				$a->getLogger()->info('Injecting cookie for remembered user ' . $user_record['nickname']);
+				Authentication::setCookie(604800, $user_record);
+				self::remove('remember');
+			}
+		}
+
+		if ($interactive) {
+			if ($user_record['login_date'] <= DBA::NULL_DATETIME) {
+				info(L10n::t('Welcome %s', $user_record['username']));
+				info(L10n::t('Please upload a profile photo.'));
+				$a->internalRedirect('profile_photo/new');
+			} else {
+				info(L10n::t("Welcome back %s", $user_record['username']));
+			}
+		}
+
+		$a->user = $user_record;
+
+		if ($login_initial) {
+			Hook::callAll('logged_in', $a->user);
+
+			if ($a->module !== 'home' && self::exists('return_path')) {
+				$a->internalRedirect(self::get('return_path'));
+			}
+		}
+	}
 }
diff --git a/src/Module/Login.php b/src/Module/Login.php
index b0897f2d7..7a3b6ae45 100644
--- a/src/Module/Login.php
+++ b/src/Module/Login.php
@@ -12,6 +12,7 @@ use Friendica\Core\Hook;
 use Friendica\Core\L10n;
 use Friendica\Core\Logger;
 use Friendica\Core\Renderer;
+use Friendica\Core\Session;
 use Friendica\Core\System;
 use Friendica\Database\DBA;
 use Friendica\Model\User;
@@ -160,7 +161,8 @@ class Login extends BaseModule
 		// if we haven't failed up this point, log them in.
 		$_SESSION['remember'] = $remember;
 		$_SESSION['last_login_date'] = DateTimeFormat::utcNow();
-		Authentication::setAuthenticatedSessionForUser($record, true, true);
+
+		Session::setAuthenticatedForUser($a, $record, true, true);
 
 		if (!empty($_SESSION['return_path'])) {
 			$return_path = $_SESSION['return_path'];
@@ -210,7 +212,7 @@ class Login extends BaseModule
 
 					// Do the authentification if not done by now
 					if (!isset($_SESSION) || !isset($_SESSION['authenticated'])) {
-						Authentication::setAuthenticatedSessionForUser($user);
+						Session::setAuthenticatedForUser($a, $user);
 
 						if (Config::get('system', 'paranoia')) {
 							$_SESSION['addr'] = $data->ip;
@@ -263,7 +265,8 @@ class Login extends BaseModule
 					$_SESSION['last_login_date'] = DateTimeFormat::utcNow();
 					$login_refresh = true;
 				}
-				Authentication::setAuthenticatedSessionForUser($user, false, false, $login_refresh);
+
+				Session::setAuthenticatedForUser($a, $user, false, false, $login_refresh);
 			}
 		}
 	}

From c2062fe594e73c8c617fbfb458993a2e3adcbd90 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 00:55:49 -0400
Subject: [PATCH 02/13] Fix undefined $a variable in Module\Help

---
 src/Module/Help.php | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/Module/Help.php b/src/Module/Help.php
index 04c482852..ddf5b06d8 100644
--- a/src/Module/Help.php
+++ b/src/Module/Help.php
@@ -21,35 +21,35 @@ class Help extends BaseModule
 		$text = '';
 		$filename = '';
 
-		$app = self::getApp();
-		$config = $app->getConfig();
+		$a = self::getApp();
+		$config = $a->getConfig();
 		$lang = $config->get('system', 'language');
 
 		// @TODO: Replace with parameter from router
-		if ($app->argc > 1) {
+		if ($a->argc > 1) {
 			$path = '';
 			// looping through the argv keys bigger than 0 to build
 			// a path relative to /help
-			for ($x = 1; $x < $app->argc; $x ++) {
+			for ($x = 1; $x < $a->argc; $x ++) {
 				if (strlen($path)) {
 					$path .= '/';
 				}
 
-				$path .= $app->getArgumentValue($x);
+				$path .= $a->getArgumentValue($x);
 			}
 			$title = basename($path);
 			$filename = $path;
 			$text = self::loadDocFile('doc/' . $path . '.md', $lang);
-			$app->page['title'] = L10n::t('Help:') . ' ' . str_replace('-', ' ', Strings::escapeTags($title));
+			$a->page['title'] = L10n::t('Help:') . ' ' . str_replace('-', ' ', Strings::escapeTags($title));
 		}
 
 		$home = self::loadDocFile('doc/Home.md', $lang);
 		if (!$text) {
 			$text = $home;
 			$filename = "Home";
-			$app->page['title'] = L10n::t('Help');
+			$a->page['title'] = L10n::t('Help');
 		} else {
-			$app->page['aside'] = Markdown::convert($home, false);
+			$a->page['aside'] = Markdown::convert($home, false);
 		}
 
 		if (!strlen($text)) {
@@ -85,7 +85,7 @@ class Help extends BaseModule
 
 						$idNum[$level] ++;
 						$id = implode("_", array_slice($idNum, 1, $level));
-						$href = $app->getBaseURL() . "/help/{$filename}#{$id}";
+						$href = $a->getBaseURL() . "/help/{$filename}#{$id}";
 						$toc .= "<li><a href='{$href}'>" . strip_tags($line) . "</a></li>";
 						$line = "<a name='{$id}'></a>" . $line;
 						$lastLevel = $level;

From f2e5b29974dad10ac3c00f6b39682dc9a50a1957 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 00:58:02 -0400
Subject: [PATCH 03/13] [Composer] Bump minimum PHP version to 7

- Remove paragonie/random_compat dependency
---
 INSTALL.md        | 2 +-
 composer.json     | 3 +--
 doc/Install.md    | 2 +-
 doc/de/Install.md | 2 +-
 4 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/INSTALL.md b/INSTALL.md
index b6107e006..50e86e24c 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -29,7 +29,7 @@ is self-signed).
 ## 1. Requirements
 
 - Apache with mod-rewrite enabled and "Options All" so you can use a local .htaccess file
-- PHP 5.6.1+ (PHP 7.1+ recommended for performance and official support).
+- PHP 7+ (PHP 7.1+ recommended for performance and official support).
 	- PHP *command line* with `register_argc_argv = true` in php.ini
 	- curl, gd (with at least jpeg support), mysql, mbstring, xml, zip and openssl extensions
 	- Some form of email server or email gateway such that PHP mail() works
diff --git a/composer.json b/composer.json
index b0c51f9bf..56955daa3 100644
--- a/composer.json
+++ b/composer.json
@@ -13,7 +13,7 @@
 		"issues": "https://github.com/friendica/friendica/issues"
 	},
 	"require": {
-		"php": ">=5.6.1",
+		"php": ">=7.0",
 		"ext-ctype": "*",
 		"ext-curl": "*",
 		"ext-dom": "*",
@@ -36,7 +36,6 @@
 		"mobiledetect/mobiledetectlib": "2.8.*",
 		"monolog/monolog": "^1.24",
 		"nikic/fast-route": "^1.3",
-		"paragonie/random_compat": "^2.0",
 		"pear/text_languagedetect": "1.*",
 		"psr/container": "^1.0",
 		"seld/cli-prompt": "^1.0",
diff --git a/doc/Install.md b/doc/Install.md
index 8d7418260..5e9448f76 100644
--- a/doc/Install.md
+++ b/doc/Install.md
@@ -25,7 +25,7 @@ Requirements
 ---
 
 * Apache with mod-rewrite enabled and "Options All" so you can use a local .htaccess file
-* PHP 5.6.1+ (PHP 7.1+ is recommended for performance and official support)
+* PHP 7+ (PHP 7.1+ is recommended for performance and official support)
   * PHP *command line* access with register_argc_argv set to true in the php.ini file
   * Curl, GD, PDO, MySQLi, hash, xml, zip and OpenSSL extensions
   * The POSIX module of PHP needs to be activated (e.g. [RHEL, CentOS](http://www.bigsoft.co.uk/blog/index.php/2014/12/08/posix-php-commands-not-working-under-centos-7) have disabled it)
diff --git a/doc/de/Install.md b/doc/de/Install.md
index 24bd078d9..b8a827ab1 100644
--- a/doc/de/Install.md
+++ b/doc/de/Install.md
@@ -28,7 +28,7 @@ Requirements
 ---
 
 * Apache mit einer aktiverten mod-rewrite-Funktion und dem Eintrag "Options All", so dass du die lokale .htaccess-Datei nutzen kannst
-* PHP  5.6.1+ (PHP 7.1+ wird für Performance und offiziellen Support empfohlen)
+* PHP  7+ (PHP 7.1+ wird für Performance und offiziellen Support empfohlen)
   * PHP *Kommandozeilen*-Zugang mit register_argc_argv auf "true" gesetzt in der php.ini-Datei
   * Curl, GD, PDO, MySQLi, xml, zip und OpenSSL-Erweiterung
   * Das POSIX Modul muss aktiviert sein ([CentOS, RHEL](http://www.bigsoft.co.uk/blog/index.php/2014/12/08/posix-php-commands-not-working-under-centos-7http://www.bigsoft.co.uk/blog/index.php/2014/12/08/posix-php-commands-not-working-under-centos-7) haben dies z.B. deaktiviert)

From c2b7ccb5b04761d02f46b422c28c29fe22161a54 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 01:07:38 -0400
Subject: [PATCH 04/13] [Composer} Add two-factor authentication dependencies

- Add bacon/bacon-qr-code dependency
- Add pragmarx/google2fa dependency
- Add pragmarx/recovery dependency
---
 composer.json | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/composer.json b/composer.json
index 56955daa3..c1366c677 100644
--- a/composer.json
+++ b/composer.json
@@ -27,6 +27,7 @@
 		"ext-simplexml": "*",
 		"ext-xml": "*",
 		"asika/simple-console": "^1.0",
+		"bacon/bacon-qr-code": "^1.0",
 		"divineomega/password_exposed": "^2.4",
 		"ezyang/htmlpurifier": "~4.7.0",
 		"friendica/json-ld": "^1.0",
@@ -37,6 +38,8 @@
 		"monolog/monolog": "^1.24",
 		"nikic/fast-route": "^1.3",
 		"pear/text_languagedetect": "1.*",
+		"pragmarx/google2fa": "^5.0",
+		"pragmarx/recovery": "^0.1.0",
 		"psr/container": "^1.0",
 		"seld/cli-prompt": "^1.0",
 		"smarty/smarty": "^3.1",

From f4f5f56ec398411c31bb7e4fc6414d364b372f46 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 01:18:09 -0400
Subject: [PATCH 05/13] [Composer] Update composer.lock

---
 composer.lock | 473 ++++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 396 insertions(+), 77 deletions(-)

diff --git a/composer.lock b/composer.lock
index 06952e05e..2fe210f5d 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "7fc5e358b089ca47cdb5cac0e22d15d8",
+    "content-hash": "d7302553201de079b72871c0b2922ce7",
     "packages": [
         {
             "name": "asika/simple-console",
@@ -39,6 +39,52 @@
             "description": "One file console framework to help you write build scripts.",
             "time": "2018-03-08T12:05:40+00:00"
         },
+        {
+            "name": "bacon/bacon-qr-code",
+            "version": "1.0.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Bacon/BaconQrCode.git",
+                "reference": "5a91b62b9d37cee635bbf8d553f4546057250bee"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Bacon/BaconQrCode/zipball/5a91b62b9d37cee635bbf8d553f4546057250bee",
+                "reference": "5a91b62b9d37cee635bbf8d553f4546057250bee",
+                "shasum": ""
+            },
+            "require": {
+                "ext-iconv": "*",
+                "php": "^5.4|^7.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^4.8"
+            },
+            "suggest": {
+                "ext-gd": "to generate QR code images"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-0": {
+                    "BaconQrCode": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-2-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Ben Scholzen 'DASPRiD'",
+                    "email": "mail@dasprids.de",
+                    "homepage": "http://www.dasprids.de",
+                    "role": "Developer"
+                }
+            ],
+            "description": "BaconQrCode is a QR code generator for PHP.",
+            "homepage": "https://github.com/Bacon/BaconQrCode",
+            "time": "2017-10-17T09:59:25+00:00"
+        },
         {
             "name": "bower-asset/Chart-js",
             "version": "v2.7.2",
@@ -1129,22 +1175,6 @@
             "require": {
                 "npm-asset/ev-emitter": ">=1.0.0,<2.0.0"
             },
-            "require-dev": {
-                "npm-asset/chalk": ">=1.1.1,<2.0.0",
-                "npm-asset/cheerio": ">=0.19.0,<0.20.0",
-                "npm-asset/gulp": ">=3.9.0,<4.0.0",
-                "npm-asset/gulp-jshint": ">=1.11.2,<2.0.0",
-                "npm-asset/gulp-json-lint": ">=0.1.0,<0.2.0",
-                "npm-asset/gulp-rename": ">=1.2.2,<2.0.0",
-                "npm-asset/gulp-replace": ">=0.5.4,<0.6.0",
-                "npm-asset/gulp-requirejs-optimize": "dev-github:metafizzy/gulp-requirejs-optimize",
-                "npm-asset/gulp-uglify": ">=1.4.2,<2.0.0",
-                "npm-asset/gulp-util": ">=3.0.7,<4.0.0",
-                "npm-asset/highlight.js": ">=8.9.1,<9.0.0",
-                "npm-asset/marked": ">=0.3.5,<0.4.0",
-                "npm-asset/minimist": ">=1.2.0,<2.0.0",
-                "npm-asset/transfob": ">=1.0.0,<2.0.0"
-            },
             "type": "npm-asset-library",
             "extra": {
                 "npm-asset-bugs": {
@@ -1190,14 +1220,6 @@
                 "reference": null,
                 "shasum": "2736e332aaee73ccf0a14a5f0066391a0a13f4a3"
             },
-            "require-dev": {
-                "npm-asset/grunt": "~0.4.2",
-                "npm-asset/grunt-contrib-cssmin": "~0.9.0",
-                "npm-asset/grunt-contrib-jshint": "~0.6.3",
-                "npm-asset/grunt-contrib-less": "~0.11.0",
-                "npm-asset/grunt-contrib-uglify": "~0.4.0",
-                "npm-asset/grunt-contrib-watch": "~0.6.1"
-            },
             "type": "npm-asset-library",
             "extra": {
                 "npm-asset-bugs": {
@@ -1231,32 +1253,6 @@
                 "reference": null,
                 "shasum": "2c89d6889b5eac522a7eea32c14521559c6cbf02"
             },
-            "require-dev": {
-                "npm-asset/commitplease": "2.0.0",
-                "npm-asset/core-js": "0.9.17",
-                "npm-asset/grunt": "0.4.5",
-                "npm-asset/grunt-babel": "5.0.1",
-                "npm-asset/grunt-cli": "0.1.13",
-                "npm-asset/grunt-compare-size": "0.4.0",
-                "npm-asset/grunt-contrib-jshint": "0.11.2",
-                "npm-asset/grunt-contrib-uglify": "0.9.2",
-                "npm-asset/grunt-contrib-watch": "0.6.1",
-                "npm-asset/grunt-git-authors": "2.0.1",
-                "npm-asset/grunt-jscs": "2.1.0",
-                "npm-asset/grunt-jsonlint": "1.0.4",
-                "npm-asset/grunt-npmcopy": "0.1.0",
-                "npm-asset/gzip-js": "0.3.2",
-                "npm-asset/jsdom": "5.6.1",
-                "npm-asset/load-grunt-tasks": "1.0.0",
-                "npm-asset/qunit-assert-step": "1.0.3",
-                "npm-asset/qunitjs": "1.17.1",
-                "npm-asset/requirejs": "2.1.17",
-                "npm-asset/sinon": "1.10.3",
-                "npm-asset/sizzle": "2.2.1",
-                "npm-asset/strip-json-comments": "1.0.3",
-                "npm-asset/testswarm": "1.1.0",
-                "npm-asset/win-spawn": "2.0.0"
-            },
             "type": "npm-asset-library",
             "extra": {
                 "npm-asset-bugs": {
@@ -1407,12 +1403,6 @@
                 "reference": null,
                 "shasum": "06f0335f16e353a695e7206bf50503cb523a6ee5"
             },
-            "require-dev": {
-                "npm-asset/grunt": "~0.4.1",
-                "npm-asset/grunt-contrib-connect": "~0.5.0",
-                "npm-asset/grunt-contrib-jshint": "~0.7.1",
-                "npm-asset/grunt-contrib-uglify": "~0.2.7"
-            },
             "type": "npm-asset-library",
             "extra": {
                 "npm-asset-bugs": {
@@ -1695,33 +1685,29 @@
         },
         {
             "name": "paragonie/random_compat",
-            "version": "v2.0.17",
+            "version": "v9.99.99",
             "source": {
                 "type": "git",
                 "url": "https://github.com/paragonie/random_compat.git",
-                "reference": "29af24f25bab834fcbb38ad2a69fa93b867e070d"
+                "reference": "84b4dfb120c6f9b4ff7b3685f9b8f1aa365a0c95"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/paragonie/random_compat/zipball/29af24f25bab834fcbb38ad2a69fa93b867e070d",
-                "reference": "29af24f25bab834fcbb38ad2a69fa93b867e070d",
+                "url": "https://api.github.com/repos/paragonie/random_compat/zipball/84b4dfb120c6f9b4ff7b3685f9b8f1aa365a0c95",
+                "reference": "84b4dfb120c6f9b4ff7b3685f9b8f1aa365a0c95",
                 "shasum": ""
             },
             "require": {
-                "php": ">=5.2.0"
+                "php": "^7"
             },
             "require-dev": {
-                "phpunit/phpunit": "4.*|5.*"
+                "phpunit/phpunit": "4.*|5.*",
+                "vimeo/psalm": "^1"
             },
             "suggest": {
                 "ext-libsodium": "Provides a modern crypto API that can be used to generate random bytes."
             },
             "type": "library",
-            "autoload": {
-                "files": [
-                    "lib/random.php"
-                ]
-            },
             "notification-url": "https://packagist.org/downloads/",
             "license": [
                 "MIT"
@@ -1740,7 +1726,7 @@
                 "pseudorandom",
                 "random"
             ],
-            "time": "2018-07-04T16:31:37+00:00"
+            "time": "2018-07-02T15:55:56+00:00"
         },
         {
             "name": "paragonie/sodium_compat",
@@ -1923,6 +1909,189 @@
             "homepage": "http://pear.php.net/package/Text_LanguageDetect",
             "time": "2017-03-02T16:14:08+00:00"
         },
+        {
+            "name": "pragmarx/google2fa",
+            "version": "v5.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/antonioribeiro/google2fa.git",
+                "reference": "17c969c82f427dd916afe4be50bafc6299aef1b4"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/antonioribeiro/google2fa/zipball/17c969c82f427dd916afe4be50bafc6299aef1b4",
+                "reference": "17c969c82f427dd916afe4be50bafc6299aef1b4",
+                "shasum": ""
+            },
+            "require": {
+                "paragonie/constant_time_encoding": "~1.0|~2.0",
+                "paragonie/random_compat": ">=1",
+                "php": ">=5.4",
+                "symfony/polyfill-php56": "~1.2"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "~4|~5|~6"
+            },
+            "type": "library",
+            "extra": {
+                "component": "package",
+                "branch-alias": {
+                    "dev-master": "2.0-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "PragmaRX\\Google2FA\\": "src/",
+                    "PragmaRX\\Google2FA\\Tests\\": "tests/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Antonio Carlos Ribeiro",
+                    "email": "acr@antoniocarlosribeiro.com",
+                    "role": "Creator & Designer"
+                }
+            ],
+            "description": "A One Time Password Authentication package, compatible with Google Authenticator.",
+            "keywords": [
+                "2fa",
+                "Authentication",
+                "Two Factor Authentication",
+                "google2fa"
+            ],
+            "time": "2019-03-19T22:44:16+00:00"
+        },
+        {
+            "name": "pragmarx/random",
+            "version": "v0.2.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/antonioribeiro/random.git",
+                "reference": "daf08a189c5d2d40d1a827db46364d3a741a51b7"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/antonioribeiro/random/zipball/daf08a189c5d2d40d1a827db46364d3a741a51b7",
+                "reference": "daf08a189c5d2d40d1a827db46364d3a741a51b7",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.0"
+            },
+            "require-dev": {
+                "fzaninotto/faker": "~1.7",
+                "phpunit/phpunit": "~6.4",
+                "pragmarx/trivia": "~0.1",
+                "squizlabs/php_codesniffer": "^2.3"
+            },
+            "suggest": {
+                "fzaninotto/faker": "Allows you to get dozens of randomized types",
+                "pragmarx/trivia": "For the trivia database"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.0-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "PragmaRX\\Random\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Antonio Carlos Ribeiro",
+                    "email": "acr@antoniocarlosribeiro.com",
+                    "homepage": "https://antoniocarlosribeiro.com",
+                    "role": "Developer"
+                }
+            ],
+            "description": "Create random chars, numbers, strings",
+            "homepage": "https://github.com/antonioribeiro/random",
+            "keywords": [
+                "Randomize",
+                "faker",
+                "pragmarx",
+                "random",
+                "random number",
+                "random pattern",
+                "random string"
+            ],
+            "time": "2017-11-21T05:26:22+00:00"
+        },
+        {
+            "name": "pragmarx/recovery",
+            "version": "v0.1.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/antonioribeiro/recovery.git",
+                "reference": "e16573a1ae5345cc3b100eec6d0296a1a15a90fe"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/antonioribeiro/recovery/zipball/e16573a1ae5345cc3b100eec6d0296a1a15a90fe",
+                "reference": "e16573a1ae5345cc3b100eec6d0296a1a15a90fe",
+                "shasum": ""
+            },
+            "require": {
+                "php": "~7.0",
+                "pragmarx/random": "~0.1"
+            },
+            "require-dev": {
+                "phpunit/phpunit": ">=5.4.3",
+                "squizlabs/php_codesniffer": "^2.3",
+                "tightenco/collect": "^5"
+            },
+            "suggest": {
+                "tightenco/collect": "Allows to generate recovery codes as collections"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.0-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "PragmaRX\\Recovery\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Antonio Carlos Ribeiro",
+                    "email": "acr@antoniocarlosribeiro.com",
+                    "homepage": "https://antoniocarlosribeiro.com",
+                    "role": "Developer"
+                }
+            ],
+            "description": "Create recovery codes for two factor auth",
+            "homepage": "https://github.com/antonioribeiro/recovery",
+            "keywords": [
+                "2fa",
+                "account recovery",
+                "auth",
+                "backup codes",
+                "google2fa",
+                "pragmarx",
+                "recovery",
+                "recovery codes",
+                "two factor auth"
+            ],
+            "time": "2017-09-19T16:58:00+00:00"
+        },
         {
             "name": "psr/cache",
             "version": "1.0.1",
@@ -2215,9 +2384,159 @@
                 "templating"
             ],
             "time": "2018-09-12T20:54:16+00:00"
+        },
+        {
+            "name": "symfony/polyfill-php56",
+            "version": "v1.11.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/polyfill-php56.git",
+                "reference": "f4dddbc5c3471e1b700a147a20ae17cdb72dbe42"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/polyfill-php56/zipball/f4dddbc5c3471e1b700a147a20ae17cdb72dbe42",
+                "reference": "f4dddbc5c3471e1b700a147a20ae17cdb72dbe42",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=5.3.3",
+                "symfony/polyfill-util": "~1.0"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.11-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Polyfill\\Php56\\": ""
+                },
+                "files": [
+                    "bootstrap.php"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Symfony polyfill backporting some PHP 5.6+ features to lower PHP versions",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "compatibility",
+                "polyfill",
+                "portable",
+                "shim"
+            ],
+            "time": "2019-02-06T07:57:58+00:00"
+        },
+        {
+            "name": "symfony/polyfill-util",
+            "version": "v1.11.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/polyfill-util.git",
+                "reference": "b46c6cae28a3106735323f00a0c38eccf2328897"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/polyfill-util/zipball/b46c6cae28a3106735323f00a0c38eccf2328897",
+                "reference": "b46c6cae28a3106735323f00a0c38eccf2328897",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=5.3.3"
+            },
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.11-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Polyfill\\Util\\": ""
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Symfony utilities for portability of PHP codes",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "compat",
+                "compatibility",
+                "polyfill",
+                "shim"
+            ],
+            "time": "2019-02-08T14:16:39+00:00"
         }
     ],
     "packages-dev": [
+        {
+            "name": "dasprid/enum",
+            "version": "1.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/DASPRiD/Enum.git",
+                "reference": "631ef6e638e9494b0310837fa531bedd908fc22b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/DASPRiD/Enum/zipball/631ef6e638e9494b0310837fa531bedd908fc22b",
+                "reference": "631ef6e638e9494b0310837fa531bedd908fc22b",
+                "shasum": ""
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^6.4",
+                "squizlabs/php_codesniffer": "^3.1"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "DASPRiD\\Enum\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-2-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Ben Scholzen 'DASPRiD'",
+                    "email": "mail@dasprids.de",
+                    "homepage": "https://dasprids.de/"
+                }
+            ],
+            "description": "PHP 7.1 enum implementation",
+            "keywords": [
+                "enum",
+                "map"
+            ],
+            "time": "2017-10-25T22:45:27+00:00"
+        },
         {
             "name": "doctrine/instantiator",
             "version": "1.0.5",
@@ -2373,12 +2692,12 @@
             "version": "v1.6.5",
             "source": {
                 "type": "git",
-                "url": "https://github.com/mikey179/vfsStream.git",
+                "url": "https://github.com/bovigo/vfsStream.git",
                 "reference": "d5fec95f541d4d71c4823bb5e30cf9b9e5b96145"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/mikey179/vfsStream/zipball/d5fec95f541d4d71c4823bb5e30cf9b9e5b96145",
+                "url": "https://api.github.com/repos/bovigo/vfsStream/zipball/d5fec95f541d4d71c4823bb5e30cf9b9e5b96145",
                 "reference": "d5fec95f541d4d71c4823bb5e30cf9b9e5b96145",
                 "shasum": ""
             },
@@ -3281,7 +3600,7 @@
                 }
             ],
             "description": "Provides the functionality to compare PHP values for equality",
-            "homepage": "https://github.com/sebastianbergmann/comparator",
+            "homepage": "http://www.github.com/sebastianbergmann/comparator",
             "keywords": [
                 "comparator",
                 "compare",
@@ -3383,7 +3702,7 @@
                 }
             ],
             "description": "Provides functionality to handle HHVM/PHP environments",
-            "homepage": "https://github.com/sebastianbergmann/environment",
+            "homepage": "http://www.github.com/sebastianbergmann/environment",
             "keywords": [
                 "Xdebug",
                 "environment",
@@ -3451,7 +3770,7 @@
                 }
             ],
             "description": "Provides the functionality to export PHP variables for visualization",
-            "homepage": "https://github.com/sebastianbergmann/exporter",
+            "homepage": "http://www.github.com/sebastianbergmann/exporter",
             "keywords": [
                 "export",
                 "exporter"
@@ -3503,7 +3822,7 @@
                 }
             ],
             "description": "Snapshotting of global state",
-            "homepage": "https://github.com/sebastianbergmann/global-state",
+            "homepage": "http://www.github.com/sebastianbergmann/global-state",
             "keywords": [
                 "global state"
             ],
@@ -3605,7 +3924,7 @@
                 }
             ],
             "description": "Provides functionality to recursively process PHP variables",
-            "homepage": "https://github.com/sebastianbergmann/recursion-context",
+            "homepage": "http://www.github.com/sebastianbergmann/recursion-context",
             "time": "2016-11-19T07:33:16+00:00"
         },
         {
@@ -3869,7 +4188,7 @@
     "prefer-stable": false,
     "prefer-lowest": false,
     "platform": {
-        "php": ">=5.6.1",
+        "php": ">=7.0",
         "ext-ctype": "*",
         "ext-curl": "*",
         "ext-dom": "*",

From c6ef7f596557b87da7e221220a5b927de8826992 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 01:19:05 -0400
Subject: [PATCH 06/13] Database Structure version 1312

- Add "2fa_recovery_codes" table
---
 config/dbstructure.config.php | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/config/dbstructure.config.php b/config/dbstructure.config.php
index 86965a201..38723ddc1 100755
--- a/config/dbstructure.config.php
+++ b/config/dbstructure.config.php
@@ -34,10 +34,22 @@
 use Friendica\Database\DBA;
 
 if (!defined('DB_UPDATE_VERSION')) {
-	define('DB_UPDATE_VERSION', 1311);
+	define('DB_UPDATE_VERSION', 1312);
 }
 
 return [
+	"2fa_recovery_codes" => [
+		"comment" => "Two-factor authentication recovery codes",
+		"fields" => [
+			"uid" => ["type" => "int unsigned", "not null" => "1", "comment" => "User ID"],
+			"code" => ["type" => "varchar(50)", "not null" => "1", "comment" => "Recovery code string"],
+			"generated" => ["type" => "datetime", "not null" => "1", "comment" => "Datetime the code was generated"],
+			"used" => ["type" => "datetime", "comment" => "Datetime the code was used"],
+		],
+		"indexes" => [
+			"PRIMARY" => ["uid", "code"]
+		]
+	],
 	"addon" => [
 		"comment" => "registered addons",
 		"fields" => [

From a7feb4bf9faaada78c4861dd4fa52f5390b95fbf Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 01:34:40 -0400
Subject: [PATCH 07/13] Add Two-factor recovery code model

- [DBA] Add NULL value handling in condition array
---
 src/Database/DBA.php                |  2 +
 src/Model/TwoFactorRecoveryCode.php | 70 +++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+)
 create mode 100644 src/Model/TwoFactorRecoveryCode.php

diff --git a/src/Database/DBA.php b/src/Database/DBA.php
index bbf134e8a..228565f94 100644
--- a/src/Database/DBA.php
+++ b/src/Database/DBA.php
@@ -1484,6 +1484,8 @@ class DBA
 						$new_values = array_merge($new_values, array_values($value));
 						$placeholders = substr(str_repeat("?, ", count($value)), 0, -2);
 						$condition_string .= "`" . $field . "` IN (" . $placeholders . ")";
+					} elseif (is_null($value)) {
+						$condition_string .= "`" . $field . "` IS NULL";
 					} else {
 						$new_values[$field] = $value;
 						$condition_string .= "`" . $field . "` = ?";
diff --git a/src/Model/TwoFactorRecoveryCode.php b/src/Model/TwoFactorRecoveryCode.php
new file mode 100644
index 000000000..82740d3b3
--- /dev/null
+++ b/src/Model/TwoFactorRecoveryCode.php
@@ -0,0 +1,70 @@
+<?php
+
+namespace Friendica\Model;
+
+use Friendica\BaseObject;
+use Friendica\Database\DBA;
+use Friendica\Util\DateTimeFormat;
+use PragmaRX\Random\Random;
+use PragmaRX\Recovery\Recovery;
+
+class TwoFactorRecoveryCode extends BaseObject
+{
+	public static function countValidForUser($uid)
+	{
+		return DBA::count('2fa_recovery_codes', ['uid' => $uid, 'used' => null]);
+	}
+
+	public static function existsForUser($uid, $code)
+	{
+		return DBA::exists('2fa_recovery_codes', ['uid' => $uid, 'code' => $code, 'used' => null]);
+	}
+
+	public static function getListForUser($uid)
+	{
+		$codesStmt = DBA::select('2fa_recovery_codes', ['code', 'used'], ['uid' => $uid]);
+
+		return DBA::toArray($codesStmt);
+	}
+
+	public static function markUsedForUser($uid, $code)
+	{
+		DBA::update('2fa_recovery_codes', ['used' => DateTimeFormat::utcNow()], ['uid' => $uid, 'code' => $code]);
+
+		return DBA::affectedRows() > 0;
+	}
+
+	public static function generateForUser($uid)
+	{
+		$Random = (new Random())->pattern('[a-z0-9]');
+
+		$RecoveryGenerator = new Recovery($Random);
+
+		$codes = $RecoveryGenerator
+			->setCount(12)
+			->setBlocks(2)
+			->setChars(6)
+			->lowercase(true)
+			->toArray();
+
+		$generated = DateTimeFormat::utcNow();
+		foreach ($codes as $code) {
+			DBA::insert('2fa_recovery_codes', [
+				'uid' => $uid,
+				'code' => $code,
+				'generated' => $generated
+			]);
+		}
+	}
+
+	public static function deleteForUser($uid)
+	{
+		DBA::delete('2fa_recovery_codes', ['uid' => $uid]);
+	}
+
+	public static function regenerateForUser($uid)
+	{
+		self::deleteForUser($uid);
+		self::generateForUser($uid);
+	}
+}

From d7e9b91181733ec8f84231fb9e05a890e8f60291 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 01:36:09 -0400
Subject: [PATCH 08/13] Add two-factor authentication

- Add 2FA login interception in Session::setAuthenticatedForUser
- Add 2fa session variable holding the last auth code
---
 src/App/Router.php                    |  4 ++
 src/Core/Authentication.php           | 22 +++++++++
 src/Core/Session.php                  |  2 +
 src/Module/TwoFactor/Recovery.php     | 71 +++++++++++++++++++++++++++
 src/Module/TwoFactor/Verify.php       | 66 +++++++++++++++++++++++++
 view/templates/twofactor/recovery.tpl | 14 ++++++
 view/templates/twofactor/verify.tpl   | 15 ++++++
 7 files changed, 194 insertions(+)
 create mode 100644 src/Module/TwoFactor/Recovery.php
 create mode 100644 src/Module/TwoFactor/Verify.php
 create mode 100644 view/templates/twofactor/recovery.tpl
 create mode 100644 view/templates/twofactor/verify.tpl

diff --git a/src/App/Router.php b/src/App/Router.php
index afea901cf..0a500b884 100644
--- a/src/App/Router.php
+++ b/src/App/Router.php
@@ -47,6 +47,10 @@ class Router
 			$collector->addRoute(['GET'], '/webfinger'       , Module\Xrd::class);
 			$collector->addRoute(['GET'], '/x-social-relay'  , Module\WellKnown\XSocialRelay::class);
 		});
+		$this->routeCollector->addGroup('/2fa', function (RouteCollector $collector) {
+			$collector->addRoute(['GET', 'POST'], '[/]'                     , Module\TwoFactor\Verify::class);
+			$collector->addRoute(['GET', 'POST'], '/recovery'               , Module\TwoFactor\Recovery::class);
+		});
 		$this->routeCollector->addGroup('/admin', function (RouteCollector $collector) {
 			$collector->addRoute(['GET']        , '[/]'                     , Module\Admin\Summary::class);
 
diff --git a/src/Core/Authentication.php b/src/Core/Authentication.php
index 1826602df..bf7a9eb76 100644
--- a/src/Core/Authentication.php
+++ b/src/Core/Authentication.php
@@ -5,6 +5,7 @@
 
 namespace Friendica\Core;
 
+use Friendica\App;
 use Friendica\BaseObject;
 use Friendica\Util\BaseURL;
 
@@ -61,5 +62,26 @@ class Authentication extends BaseObject
 		session_unset();
 		session_destroy();
 	}
+
+	public static function twoFactorCheck($uid, App $a)
+	{
+		// Check user setting, if 2FA disabled return
+		if (!PConfig::get($uid, '2fa', 'verified')) {
+			return;
+		}
+
+		// Check current path, if 2fa authentication module return
+		if ($a->argc > 0 && in_array($a->argv[0], ['ping', '2fa', 'view', 'help', 'logout'])) {
+			return;
+		}
+
+		// Case 1: 2FA session present and valid: return
+		if (Session::get('2fa')) {
+			return;
+		}
+
+		// Case 2: No valid 2FA session: redirect to code verification page
+		$a->internalRedirect('2fa');
+	}
 }
 
diff --git a/src/Core/Session.php b/src/Core/Session.php
index 9dadbb168..5ef77094c 100644
--- a/src/Core/Session.php
+++ b/src/Core/Session.php
@@ -186,6 +186,8 @@ class Session
 			}
 		}
 
+		Authentication::twoFactorCheck($user_record['uid'], $a);
+
 		if ($interactive) {
 			if ($user_record['login_date'] <= DBA::NULL_DATETIME) {
 				info(L10n::t('Welcome %s', $user_record['username']));
diff --git a/src/Module/TwoFactor/Recovery.php b/src/Module/TwoFactor/Recovery.php
new file mode 100644
index 000000000..cd197e030
--- /dev/null
+++ b/src/Module/TwoFactor/Recovery.php
@@ -0,0 +1,71 @@
+<?php
+
+namespace Friendica\Module\TwoFactor;
+
+use Friendica\BaseModule;
+use Friendica\Core\L10n;
+use Friendica\Core\Renderer;
+use Friendica\Core\Session;
+use Friendica\Model\TwoFactorRecoveryCode;
+
+/**
+ * // Page 1a: Recovery code verification
+ *
+ * @package Friendica\Module\TwoFactor
+ */
+class Recovery extends BaseModule
+{
+	public static function init()
+	{
+		if (!local_user()) {
+			return;
+		}
+	}
+
+	public static function post()
+	{
+		if (!local_user()) {
+			return;
+		}
+
+		if (defaults($_POST, 'action', null) == 'recover') {
+			self::checkFormSecurityTokenRedirectOnError('2fa', 'twofactor_recovery');
+
+			$a = self::getApp();
+
+			$recovery_code = defaults($_POST, 'recovery_code', '');
+
+			if (TwoFactorRecoveryCode::existsForUser(local_user(), $recovery_code)) {
+				TwoFactorRecoveryCode::markUsedForUser(local_user(), $recovery_code);
+				Session::set('2fa', true);
+				notice(L10n::t('Remaining recovery codes: %d', TwoFactorRecoveryCode::countValidForUser(local_user())));
+
+				// Resume normal login workflow
+				Session::setAuthenticatedForUser($a, $a->user, true, true);
+			} else {
+				notice(L10n::t('Invalid code, please retry.'));
+			}
+		}
+	}
+
+	public static function content()
+	{
+		if (!local_user()) {
+			self::getApp()->internalRedirect();
+		}
+
+		// Already authenticated with 2FA token
+		if (Session::get('2fa')) {
+			self::getApp()->internalRedirect();
+		}
+
+		return Renderer::replaceMacros(Renderer::getMarkupTemplate('twofactor/recovery.tpl'), [
+			'$form_security_token' => self::getFormSecurityToken('twofactor_recovery'),
+			'$title' => L10n::t('Two-factor recovery'),
+			'$message' => L10n::t('<p>You can enter one of your one-time recovery codes in case you lost access to your mobile device.</p>'),
+			'$recovery_message' => L10n::t('Don’t have your phone? <a href="%s">Enter a two-factor recovery code</a>', '2fa/recovery'),
+			'$recovery_code' => ['recovery_code', L10n::t('Please enter a recovery code'), '', '', '', 'placeholder="000000-000000"'],
+			'$recovery_label' => L10n::t('Submit recovery code and complete login'),
+		]);
+	}
+}
diff --git a/src/Module/TwoFactor/Verify.php b/src/Module/TwoFactor/Verify.php
new file mode 100644
index 000000000..b27c982bd
--- /dev/null
+++ b/src/Module/TwoFactor/Verify.php
@@ -0,0 +1,66 @@
+<?php
+
+namespace Friendica\Module\TwoFactor;
+
+use Friendica\BaseModule;
+use Friendica\Core\L10n;
+use Friendica\Core\PConfig;
+use Friendica\Core\Renderer;
+use Friendica\Core\Session;
+use PragmaRX\Google2FA\Google2FA;
+
+/**
+ * Page 1: Authenticator code verification
+ *
+ * @package Friendica\Module\TwoFactor
+ */
+class Verify extends BaseModule
+{
+	public static function post()
+	{
+		if (!local_user()) {
+			return;
+		}
+
+		if (defaults($_POST, 'action', null) == 'verify') {
+			self::checkFormSecurityTokenRedirectOnError('2fa', 'twofactor_verify');
+
+			$a = self::getApp();
+
+			$code = defaults($_POST, 'verify_code', '');
+
+			$valid = (new Google2FA())->verifyKey(PConfig::get(local_user(), '2fa', 'secret'), $code);
+
+			// The same code can't be used twice even if it's valid
+			if ($valid && Session::get('2fa') !== $code) {
+				Session::set('2fa', $code);
+
+				// Resume normal login workflow
+				Session::setAuthenticatedForUser($a, $a->user, true, true);
+			} else {
+				notice(L10n::t('Invalid code, please retry.'));
+			}
+		}
+	}
+
+	public static function content()
+	{
+		if (!local_user()) {
+			self::getApp()->internalRedirect();
+		}
+
+		// Already authenticated with 2FA token
+		if (Session::get('2fa')) {
+			self::getApp()->internalRedirect();
+		}
+
+		return Renderer::replaceMacros(Renderer::getMarkupTemplate('twofactor/verify.tpl'), [
+			'$form_security_token' => self::getFormSecurityToken('twofactor_verify'),
+			'$title' => L10n::t('Two-factor authentication'),
+			'$message' => L10n::t('<p>Open the two-factor authentication app on your device to get an authentication code and verify your identity.</p>'),
+			'$recovery_message' => L10n::t('Don’t have your phone? <a href="%s">Enter a two-factor recovery code</a>', '2fa/recovery'),
+			'$verify_code' => ['verify_code', L10n::t('Please enter a code from your authentication app'), '', '', 'required', 'autofocus placeholder="000000"'],
+			'$verify_label' => L10n::t('Verify code and complete login'),
+		]);
+	}
+}
diff --git a/view/templates/twofactor/recovery.tpl b/view/templates/twofactor/recovery.tpl
new file mode 100644
index 000000000..c32c8d2d8
--- /dev/null
+++ b/view/templates/twofactor/recovery.tpl
@@ -0,0 +1,14 @@
+<div class="generic-page-wrapper">
+	<h1>{{$title}}</h1>
+	<div>{{$message nofilter}}</div>
+
+	<form action="" method="post">
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+
+		{{include file="field_input.tpl" field=$recovery_code}}
+
+		<div class="form-group settings-submit-wrapper">
+			<button type="submit" name="action" id="confirm-submit-button" class="btn btn-primary confirm-button" value="recover">{{$recovery_label}}</button>
+		</div>
+	</form>
+</div>
diff --git a/view/templates/twofactor/verify.tpl b/view/templates/twofactor/verify.tpl
new file mode 100644
index 000000000..d75d6291a
--- /dev/null
+++ b/view/templates/twofactor/verify.tpl
@@ -0,0 +1,15 @@
+<div class="generic-page-wrapper">
+	<h1>{{$title}}</h1>
+	<div>{{$message nofilter}}</div>
+
+	<form action="" method="post">
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+
+		{{include file="field_input.tpl" field=$verify_code}}
+
+		<div class="form-group settings-submit-wrapper">
+			<button type="submit" name="action" id="confirm-submit-button" class="btn btn-primary confirm-button" value="verify">{{$verify_label}}</button>
+		</div>
+	</form>
+	<div>{{$recovery_message nofilter}}</div>
+</div>

From 8e885f5b971320c1f86075f86ce085cf39c4bd13 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 01:38:15 -0400
Subject: [PATCH 09/13] Add two-factor authentication settings

- Add settings aside menu entry
- Add two-factor authentication documentation
---
 doc/Two-Factor-Authentication.md              |  60 ++++++++
 mod/settings.php                              |   7 +
 src/App/Router.php                            |   8 ++
 src/Module/BaseSettingsModule.php             | 110 +++++++++++++++
 src/Module/Settings/TwoFactor/Index.php       | 111 +++++++++++++++
 src/Module/Settings/TwoFactor/Recovery.php    |  86 ++++++++++++
 src/Module/Settings/TwoFactor/Verify.php      | 129 ++++++++++++++++++
 view/templates/settings/twofactor/index.tpl   |  39 ++++++
 .../templates/settings/twofactor/recovery.tpl |  28 ++++
 view/templates/settings/twofactor/verify.tpl  |  22 +++
 10 files changed, 600 insertions(+)
 create mode 100644 doc/Two-Factor-Authentication.md
 create mode 100644 src/Module/BaseSettingsModule.php
 create mode 100644 src/Module/Settings/TwoFactor/Index.php
 create mode 100644 src/Module/Settings/TwoFactor/Recovery.php
 create mode 100644 src/Module/Settings/TwoFactor/Verify.php
 create mode 100644 view/templates/settings/twofactor/index.tpl
 create mode 100644 view/templates/settings/twofactor/recovery.tpl
 create mode 100644 view/templates/settings/twofactor/verify.tpl

diff --git a/doc/Two-Factor-Authentication.md b/doc/Two-Factor-Authentication.md
new file mode 100644
index 000000000..32aa7308a
--- /dev/null
+++ b/doc/Two-Factor-Authentication.md
@@ -0,0 +1,60 @@
+# Configuring two-factor authentication
+
+* [Home](help)
+
+You can configure two-factor authentication using a mobile app.
+A time-based one-time password (TOTP) application automatically generates an authentication code that changes after a certain period of time.
+
+**Tip**: To configure authentication via TOTP on multiple devices, during setup, scan the QR code using each device at the same time.
+If 2FA is already enabled and you want to add another device, you must re-configure 2FA from your security settings.
+
+## Enabling two-factor authentication
+
+### 1. Download an authenticator app
+
+Any authenticator app should work with Friendica.
+Notheless, we recommend:
+
+ - For iOS, [Matt Rubin's MIT-licensed Authenticator app](https://mattrubin.me/authenticator).
+ - For Android, [andOTP](https://github.com/andOTP/andOTP).
+ 
+### 2. Record your one-use recovery codes
+
+From your [two-factor authentication user settings](/settings/2fa), enter your password and click on "Enable two-factor authentication".
+
+You will be presented with a list of one-use recovery codes.
+Please save those in the same place you are saving your Friendica password (ideally, in a password manager like [KeePass](https://keepass.info)).
+
+When you're done, click on "Next".
+
+### 3. Setup your authenticator app
+
+You have three methods to setup your authenticator app:
+
+1. Scan the QR Code with your device camera.
+   This will automatically configure your account on the app.
+2. Click/tap on the provided **totp://** URl.
+   Ideally your authenticator app should be called with this URL and set up your account.
+3. Enter your account settings manually.
+   Friendica is using default settings for token type, code digit count and hashing algorithm but you may be required to enter them in your app.
+
+**Tip**: If you have multiple devices, configure them all at this point.
+
+Then verify your app is correctly configured by submitting a code provided by your app.
+This will conclude two-factor authentication configuration.
+
+**Note:** If you leave this screen at any point without having submitted a verification code, two-factor authentication won't be enabled on your account.
+To complete the configuration, just come back to your [two-factor authentication user settings](/settings/2fa) and click on "Finish configuration" after entering your current password.
+
+## Disabling two-factor authentication
+
+You can disable two-factor authentication at any time by going to your [two-factor authentication user settings](/settings/2fa) and click on "Disable two-factor authentication" after entering your current password.
+
+You should remove your Friendica account from your authenticator app as it won't work again even if you reenable two-factor authentication.
+In this case you will have to configure your authenticator app again using the process above.
+
+## Managing your one-time recovery codes
+
+When two-factor authentication is enabled, you can show your recovery codes, including the ones you've already used.
+
+You can freely regenerate a new set of fresh recovery codes, just be sure to replace the previous ones where you saved them as they won't be active anymore.
diff --git a/mod/settings.php b/mod/settings.php
index 536c83354..45f11cdb6 100644
--- a/mod/settings.php
+++ b/mod/settings.php
@@ -67,6 +67,13 @@ function settings_init(App $a)
 		],
 	];
 
+	$tabs[] = [
+		'label' => L10n::t('Two-factor authentication'),
+		'url' => 'settings/2fa',
+		'selected' => (($a->argc > 1) && ($a->argv[1] === '2fa') ? 'active' : ''),
+		'accesskey' => 'o',
+	];
+
 	$tabs[] =	[
 		'label'	=> L10n::t('Profiles'),
 		'url' 	=> 'profiles',
diff --git a/src/App/Router.php b/src/App/Router.php
index 0a500b884..cd59c3dd9 100644
--- a/src/App/Router.php
+++ b/src/App/Router.php
@@ -188,6 +188,14 @@ class Router
 			$collector->addRoute(['GET'], '/{sub1}/{url}'                      , Module\Proxy::class);
 			$collector->addRoute(['GET'], '/{sub1}/{sub2}/{url}'               , Module\Proxy::class);
 		});
+
+		$this->routeCollector->addGroup('/settings', function (RouteCollector $collector) {
+			$collector->addGroup('/2fa', function (RouteCollector $collector) {
+				$collector->addRoute(['GET', 'POST'], '[/]'                    , Module\Settings\TwoFactor\Index::class);
+				$collector->addRoute(['GET', 'POST'], '/recovery'              , Module\Settings\TwoFactor\Recovery::class);
+				$collector->addRoute(['GET', 'POST'], '/verify'                , Module\Settings\TwoFactor\Verify::class);
+			});
+		});
 		$this->routeCollector->addRoute(['GET', 'POST'], '/register',            Module\Register::class);
 		$this->routeCollector->addRoute(['GET'],         '/robots.txt',          Module\RobotsTxt::class);
 		$this->routeCollector->addRoute(['GET'],         '/rsd.xml',             Module\ReallySimpleDiscovery::class);
diff --git a/src/Module/BaseSettingsModule.php b/src/Module/BaseSettingsModule.php
new file mode 100644
index 000000000..fdf3c8166
--- /dev/null
+++ b/src/Module/BaseSettingsModule.php
@@ -0,0 +1,110 @@
+<?php
+
+namespace Friendica\Module;
+
+use Friendica\BaseModule;
+use Friendica\Content\Feature;
+use Friendica\Core\L10n;
+use Friendica\Core\Renderer;
+
+class BaseSettingsModule extends BaseModule
+{
+	public static function content()
+	{
+		$a = self::getApp();
+
+		$tpl = Renderer::getMarkupTemplate('settings/head.tpl');
+		$a->page['htmlhead'] .= Renderer::replaceMacros($tpl, [
+			'$ispublic' => L10n::t('everybody')
+		]);
+
+		$tabs = [];
+
+		$tabs[] = [
+			'label' => L10n::t('Account'),
+			'url' => 'settings',
+			'selected' => (($a->argc == 1) && ($a->argv[0] === 'settings') ? 'active' : ''),
+			'accesskey' => 'o',
+		];
+
+		$tabs[] = [
+			'label' => L10n::t('Two-factor authentication'),
+			'url' => 'settings/2fa',
+			'selected' => (($a->argc > 1) && ($a->argv[1] === '2fa') ? 'active' : ''),
+			'accesskey' => 'o',
+		];
+
+		$tabs[] = [
+			'label' => L10n::t('Profiles'),
+			'url' => 'profiles',
+			'selected' => (($a->argc == 1) && ($a->argv[0] === 'profiles') ? 'active' : ''),
+			'accesskey' => 'p',
+		];
+
+		if (Feature::get()) {
+			$tabs[] = [
+				'label' => L10n::t('Additional features'),
+				'url' => 'settings/features',
+				'selected' => (($a->argc > 1) && ($a->argv[1] === 'features') ? 'active' : ''),
+				'accesskey' => 't',
+			];
+		}
+
+		$tabs[] = [
+			'label' => L10n::t('Display'),
+			'url' => 'settings/display',
+			'selected' => (($a->argc > 1) && ($a->argv[1] === 'display') ? 'active' : ''),
+			'accesskey' => 'i',
+		];
+
+		$tabs[] = [
+			'label' => L10n::t('Social Networks'),
+			'url' => 'settings/connectors',
+			'selected' => (($a->argc > 1) && ($a->argv[1] === 'connectors') ? 'active' : ''),
+			'accesskey' => 'w',
+		];
+
+		$tabs[] = [
+			'label' => L10n::t('Addons'),
+			'url' => 'settings/addon',
+			'selected' => (($a->argc > 1) && ($a->argv[1] === 'addon') ? 'active' : ''),
+			'accesskey' => 'l',
+		];
+
+		$tabs[] = [
+			'label' => L10n::t('Delegations'),
+			'url' => 'delegate',
+			'selected' => (($a->argc == 1) && ($a->argv[0] === 'delegate') ? 'active' : ''),
+			'accesskey' => 'd',
+		];
+
+		$tabs[] = [
+			'label' => L10n::t('Connected apps'),
+			'url' => 'settings/oauth',
+			'selected' => (($a->argc > 1) && ($a->argv[1] === 'oauth') ? 'active' : ''),
+			'accesskey' => 'b',
+		];
+
+		$tabs[] = [
+			'label' => L10n::t('Export personal data'),
+			'url' => 'uexport',
+			'selected' => (($a->argc == 1) && ($a->argv[0] === 'uexport') ? 'active' : ''),
+			'accesskey' => 'e',
+		];
+
+		$tabs[] = [
+			'label' => L10n::t('Remove account'),
+			'url' => 'removeme',
+			'selected' => (($a->argc == 1) && ($a->argv[0] === 'removeme') ? 'active' : ''),
+			'accesskey' => 'r',
+		];
+
+
+		$tabtpl = Renderer::getMarkupTemplate("generic_links_widget.tpl");
+		$a->page['aside'] = Renderer::replaceMacros($tabtpl, [
+			'$title' => L10n::t('Settings'),
+			'$class' => 'settings-widget',
+			'$items' => $tabs,
+		]);
+	}
+}
diff --git a/src/Module/Settings/TwoFactor/Index.php b/src/Module/Settings/TwoFactor/Index.php
new file mode 100644
index 000000000..7b8031272
--- /dev/null
+++ b/src/Module/Settings/TwoFactor/Index.php
@@ -0,0 +1,111 @@
+<?php
+
+
+namespace Friendica\Module\Settings\TwoFactor;
+
+
+use Friendica\Core\L10n;
+use Friendica\Core\PConfig;
+use Friendica\Core\Renderer;
+use Friendica\Core\Session;
+use Friendica\Model\TwoFactorRecoveryCode;
+use Friendica\Model\User;
+use Friendica\Module\BaseSettingsModule;
+use Friendica\Module\Login;
+use PragmaRX\Google2FA\Google2FA;
+
+class Index extends BaseSettingsModule
+{
+	public static function post()
+	{
+		if (!local_user()) {
+			return;
+		}
+
+		self::checkFormSecurityTokenRedirectOnError('settings/2fa', 'settings_2fa');
+
+		try {
+			User::getIdFromPasswordAuthentication(local_user(), defaults($_POST, 'password', ''));
+
+			$has_secret = (bool) PConfig::get(local_user(), '2fa', 'secret');
+			$verified = PConfig::get(local_user(), '2fa', 'verified');
+
+			switch (defaults($_POST, 'action', '')) {
+				case 'enable':
+					if (!$has_secret && !$verified) {
+						$Google2FA = new Google2FA();
+
+						PConfig::set(local_user(), '2fa', 'secret', $Google2FA->generateSecretKey(32));
+
+						self::getApp()->internalRedirect('settings/2fa/recovery?t=' . self::getFormSecurityToken('settings_2fa_password'));
+					}
+					break;
+				case 'disable':
+					if ($has_secret) {
+						TwoFactorRecoveryCode::deleteForUser(local_user());
+						PConfig::delete(local_user(), '2fa', 'secret');
+						PConfig::delete(local_user(), '2fa', 'verified');
+						Session::remove('2fa');
+
+						notice(L10n::t('Two-factor authentication successfully disabled.'));
+						self::getApp()->internalRedirect('settings/2fa');
+					}
+					break;
+				case 'recovery':
+					if ($has_secret) {
+						self::getApp()->internalRedirect('settings/2fa/recovery?t=' . self::getFormSecurityToken('settings_2fa_password'));
+					}
+					break;
+				case 'configure':
+					if (!$verified) {
+						self::getApp()->internalRedirect('settings/2fa/verify?t=' . self::getFormSecurityToken('settings_2fa_password'));
+					}
+					break;
+			}
+		} catch (\Exception $e) {
+			notice(L10n::t('Wrong Password'));
+		}
+	}
+
+	public static function content()
+	{
+		if (!local_user()) {
+			return Login::form('settings/2fa');
+		}
+
+		parent::content();
+
+		$has_secret = (bool) PConfig::get(local_user(), '2fa', 'secret');
+		$verified = PConfig::get(local_user(), '2fa', 'verified');
+
+		return Renderer::replaceMacros(Renderer::getMarkupTemplate('settings/twofactor/index.tpl'), [
+			'$form_security_token' => self::getFormSecurityToken('settings_2fa'),
+			'$title' => L10n::t('Two-factor authentication'),
+			'$help_label' => L10n::t('Help'),
+
+			'$status_title' => L10n::t('Status'),
+			'$message' => L10n::t('<p>Use an application on a mobile device to get two-factor authentication codes when prompted on login.</p>'),
+
+			'$has_secret' => $has_secret,
+			'$verified' => $verified,
+
+			'$auth_app_label' => L10n::t('Authenticator app'),
+			'$app_status' => $has_secret ? $verified ? L10n::t('Configured') : L10n::t('Not Configured') : L10n::t('Disabled'),
+			'$not_configured_message' => L10n::t('<p>You haven\'t finished configuring your authenticator app.</p>'),
+			'$configured_message' => L10n::t('<p>Your authenticator app is correctly configured.</p>'),
+
+			'$recovery_codes_title' => L10n::t('Recovery codes'),
+			'$recovery_codes_remaining' => L10n::t('Remaining valid codes'),
+			'$recovery_codes_count' => TwoFactorRecoveryCode::countValidForUser(local_user()),
+			'$recovery_codes_message' => L10n::t('<p>These one-use codes can replace an authenticator app code in case you have lost access to it.</p>'),
+
+			'$action_title' => L10n::t('Actions'),
+			'$password' => ['password', L10n::t('Current password:'), '', L10n::t('You need to provide your current password to change two-factor authentication settings.'), 'required', 'autofocus'],
+
+			'$enable_label' => L10n::t('Enable two-factor authentication'),
+			'$disable_label' => L10n::t('Disable two-factor authentication'),
+			'$recovery_codes_label' => L10n::t('Show recovery codes'),
+			'$configure_label' => L10n::t('Finish app configuration'),
+		]);
+	}
+}
diff --git a/src/Module/Settings/TwoFactor/Recovery.php b/src/Module/Settings/TwoFactor/Recovery.php
new file mode 100644
index 000000000..9f0e74832
--- /dev/null
+++ b/src/Module/Settings/TwoFactor/Recovery.php
@@ -0,0 +1,86 @@
+<?php
+
+
+namespace Friendica\Module\Settings\TwoFactor;
+
+
+use Friendica\Core\L10n;
+use Friendica\Core\PConfig;
+use Friendica\Core\Renderer;
+use Friendica\Model\TwoFactorRecoveryCode;
+use Friendica\Module\BaseSettingsModule;
+use Friendica\Module\Login;
+
+/**
+ * // Page 3: 2FA enabled but not verified, show recovery codes
+ *
+ * @package Friendica\Module\TwoFactor
+ */
+class Recovery extends BaseSettingsModule
+{
+	public static function init()
+	{
+		if (!local_user()) {
+			return;
+		}
+
+		$secret = PConfig::get(local_user(), '2fa', 'secret');
+
+		if (!$secret) {
+			self::getApp()->internalRedirect('settings/2fa');
+		}
+
+		if (!self::checkFormSecurityToken('settings_2fa_password', 't')) {
+			notice(L10n::t('Please enter your password to access this page.'));
+			self::getApp()->internalRedirect('settings/2fa');
+		}
+	}
+
+	public static function post()
+	{
+		if (!local_user()) {
+			return;
+		}
+
+		if (!empty($_POST['action'])) {
+			self::checkFormSecurityTokenRedirectOnError('settings/2fa/recovery', 'settings_2fa_recovery');
+
+			if ($_POST['action'] == 'regenerate') {
+				TwoFactorRecoveryCode::regenerateForUser(local_user());
+				notice(L10n::t('New recovery codes successfully generated.'));
+				self::getApp()->internalRedirect('settings/2fa/recovery?t=' . self::getFormSecurityToken('settings_2fa_password'));
+			}
+		}
+	}
+
+	public static function content()
+	{
+		if (!local_user()) {
+			return Login::form('settings/2fa/recovery');
+		}
+
+		parent::content();
+
+		if (!TwoFactorRecoveryCode::countValidForUser(local_user())) {
+			TwoFactorRecoveryCode::generateForUser(local_user());
+		}
+
+		$recoveryCodes = TwoFactorRecoveryCode::getListForUser(local_user());
+
+		$verified = PConfig::get(local_user(), '2fa', 'verified');
+		
+		return Renderer::replaceMacros(Renderer::getMarkupTemplate('settings/twofactor/recovery.tpl'), [
+			'$form_security_token' => self::getFormSecurityToken('settings_2fa_recovery'),
+			'$password_security_token' => self::getFormSecurityToken('settings_2fa_password'),
+			'$title' => L10n::t('Two-factor recovery codes'),
+			'$help_label' => L10n::t('Help'),
+			'$message' => L10n::t('<p>Recovery codes can be used to access your account in the event you lose access to your device and cannot receive two-factor authentication codes.</p><p><strong>Put these in a safe spot!</strong> If you lose your device and don’t have the recovery codes you will lose access to your account.</p>'),
+			'$recovery_codes' => $recoveryCodes,
+			'$password' => ['password', L10n::t('Please enter your password for verification:'), '', L10n::t('You need to provide your current password to enable or disable two-factor authentication.'), 'required', 'autofocus'],
+			'$regenerate_message' => L10n::t('When you generate new recovery codes, you must copy the new codes. Your old codes won’t work anymore.'),
+			'$regenerate_label' => L10n::t('Generate new recovery codes'),
+			'$verified' => $verified,
+			'$verify_label' => L10n::t('Next: Verification'),
+		]);
+	}
+}
diff --git a/src/Module/Settings/TwoFactor/Verify.php b/src/Module/Settings/TwoFactor/Verify.php
new file mode 100644
index 000000000..57995cd75
--- /dev/null
+++ b/src/Module/Settings/TwoFactor/Verify.php
@@ -0,0 +1,129 @@
+<?php
+
+
+namespace Friendica\Module\Settings\TwoFactor;
+
+
+use BaconQrCode\Renderer\Image\SvgImageBackEnd;
+use BaconQrCode\Renderer\ImageRenderer;
+use BaconQrCode\Renderer\RendererStyle\RendererStyle;
+use BaconQrCode\Writer;
+use Friendica\BaseModule;
+use Friendica\Core\L10n;
+use Friendica\Core\PConfig;
+use Friendica\Core\Renderer;
+use Friendica\Core\Session;
+use Friendica\Module\BaseSettingsModule;
+use Friendica\Module\Login;
+use PragmaRX\Google2FA\Google2FA;
+
+/**
+ * // Page 4: 2FA enabled but not verified, QR code and verification
+ *
+ * @package Friendica\Module\TwoFactor\Settings
+ */
+class Verify extends BaseSettingsModule
+{
+	public static function init()
+	{
+		if (!local_user()) {
+			return;
+		}
+
+		$secret = PConfig::get(local_user(), '2fa', 'secret');
+		$verified = PConfig::get(local_user(), '2fa', 'verified');
+
+		if ($secret && $verified) {
+			self::getApp()->internalRedirect('settings/2fa');
+		}
+
+		if (!self::checkFormSecurityToken('settings_2fa_password', 't')) {
+			notice(L10n::t('Please enter your password to access this page.'));
+			self::getApp()->internalRedirect('settings/2fa');
+		}
+	}
+
+	public static function post()
+	{
+		if (!local_user()) {
+			return;
+		}
+
+		if (defaults($_POST, 'action', null) == 'verify') {
+			self::checkFormSecurityTokenRedirectOnError('settings/2fa/verify', 'settings_2fa_verify');
+
+			$google2fa = new Google2FA();
+
+			$valid = $google2fa->verifyKey(PConfig::get(local_user(), '2fa', 'secret'), defaults($_POST, 'verify_code', ''));
+
+			if ($valid) {
+				PConfig::set(local_user(), '2fa', 'verified', true);
+				Session::set('2fa', true);
+
+				notice(L10n::t('Two-factor authentication successfully activated.'));
+
+				self::getApp()->internalRedirect('settings/2fa');
+			} else {
+				notice(L10n::t('Invalid code, please retry.'));
+			}
+		}
+	}
+
+	public static function content()
+	{
+		if (!local_user()) {
+			return Login::form('settings/2fa/verify');
+		}
+
+		parent::content();
+
+		$company = 'Friendica';
+		$holder = Session::get('my_address');
+		$secret = PConfig::get(local_user(), '2fa', 'secret');
+
+		$otpauthUrl = (new Google2FA())->getQRCodeUrl($company, $holder, $secret);
+
+		$renderer = (new \BaconQrCode\Renderer\Image\Svg())
+			->setHeight(256)
+			->setWidth(256);
+
+		$writer = new Writer($renderer);
+
+		$qrcode_image = str_replace('<?xml version="1.0" encoding="UTF-8"?>', '', $writer->writeString($otpauthUrl));
+
+		$shortOtpauthUrl = explode('?', $otpauthUrl)[0];
+
+		$manual_message = L10n::t('<p>Or you can submit the authentication settings manually:</p>
+<dl>
+	<dt>Issuer</dt>
+	<dd>%s</dd>
+	<dt>Account Name</dt>
+	<dd>%s</dd>
+	<dt>Secret Key</dt>
+	<dd>%s</dd>
+	<dt>Type</dt>
+	<dd>Time-based</dd>
+	<dt>Number of digits</dt>
+	<dd>6</dd>
+	<dt>Hashing algorithm</dt>
+	<dd>SHA-1</dd>
+</dl>', $company, $holder, $secret);
+
+		return Renderer::replaceMacros(Renderer::getMarkupTemplate('settings/twofactor/verify.tpl'), [
+			'$form_security_token' => self::getFormSecurityToken('settings_2fa_verify'),
+			'$password_security_token' => self::getFormSecurityToken('settings_2fa_password'),
+			'$title' => L10n::t('Two-factor code verification'),
+			'$help_label' => L10n::t('Help'),
+			'$message' => L10n::t('<p>Please scan this QR Code with your authenticator app and submit the provided code.</p>'),
+			'$qrcode_image' => $qrcode_image,
+			'$qrcode_url_message' => L10n::t('<p>Or you can open the following URL in your mobile devicde:</p><p><a href="%s">%s</a></p>', $otpauthUrl, $shortOtpauthUrl),
+			'$manual_message' => $manual_message,
+			'$company' => $company,
+			'$holder' => $holder,
+			'$secret' => $secret,
+
+			'$verify_code' => ['verify_code', L10n::t('Please enter a code from your authentication app'), '', '', 'required', 'autofocus placeholder="000000"'],
+			'$verify_label' => L10n::t('Verify code and enable two-factor authentication'),
+		]);
+	}
+}
diff --git a/view/templates/settings/twofactor/index.tpl b/view/templates/settings/twofactor/index.tpl
new file mode 100644
index 000000000..57bcab19e
--- /dev/null
+++ b/view/templates/settings/twofactor/index.tpl
@@ -0,0 +1,39 @@
+<div class="generic-page-wrapper">
+	<h1>{{$title}} <a href="help/Two-Factor-Authentication" title="{{$help_label}}" class="btn btn-default btn-sm"><i aria-hidden="true" class="fa fa-question fa-2x"></i></a></h1>
+	<div>{{$message nofilter}}</div>
+	<h2>{{$status_title}}</h2>
+	<p><strong>{{$auth_app_label}}</strong>: {{$app_status}} </p>
+{{if $has_secret && $verified}}
+	<div>{{$configured_message nofilter}}</div>
+{{/if}}
+{{if $has_secret && !$verified}}
+	<div>{{$not_configured_message nofilter}}</div>
+{{/if}}
+
+{{if $has_secret && $verified}}
+	<h2>{{$recovery_codes_title}}</h2>
+	<p><strong>{{$recovery_codes_remaining}}</strong>: {{$recovery_codes_count}}</p>
+	<div>{{$recovery_codes_message nofilter}}</div>
+{{/if}}
+
+	<form action="settings/2fa" method="post">
+		<h2>{{$action_title}}</h2>
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+
+		{{include file="field_password.tpl" field=$password}}
+
+		<div class="form-group settings-submit-wrapper" >
+{{if !$has_secret}}
+			<button type="submit" name="action" id="confirm-submit-button" class="btn btn-primary confirm-button" value="enable">{{$enable_label}}</button>
+{{else}}
+			<button type="submit" name="action" id="confirm-submit-button" class="btn btn-primary confirm-button" value="disable">{{$disable_label}}</button>
+{{/if}}
+{{if $has_secret && $verified}}
+			<button type="submit" name="action" id="confirm-submit-button" class="btn btn-primary confirm-button" value="recovery">{{$recovery_codes_label}}</button>
+{{/if}}
+{{if $has_secret && !$verified}}
+			<button type="submit" name="action" id="confirm-submit-button" class="btn btn-primary confirm-button" value="configure">{{$configure_label}}</button>
+{{/if}}
+		</div>
+	</form>
+</div>
diff --git a/view/templates/settings/twofactor/recovery.tpl b/view/templates/settings/twofactor/recovery.tpl
new file mode 100644
index 000000000..8ecd0198d
--- /dev/null
+++ b/view/templates/settings/twofactor/recovery.tpl
@@ -0,0 +1,28 @@
+<div class="generic-page-wrapper">
+	<h1>{{$title}} <a href="help/Two-Factor-Authentication" title="{{$help_label}}" class="btn btn-default btn-sm"><i aria-hidden="true" class="fa fa-question fa-2x"></i></a></h1>
+	<div>{{$message nofilter}}</div>
+
+	<ul class="recovery-codes">
+{{foreach $recovery_codes as $recovery_code}}
+		<li>
+			{{if $recovery_code.used}}<s>{{/if}}
+				{{$recovery_code.code}}
+			{{if $recovery_code.used}}</s>{{/if}}
+		</li>
+{{/foreach}}
+	</ul>
+
+{{if $verified}}
+	<form action="settings/2fa/recovery?t={{$password_security_token}}" method="post">
+		<h2>{{$regenerate_label}}</h2>
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+		<div>{{$regenerate_message}}</div>
+
+		<div class="form-group pull-right settings-submit-wrapper" >
+			<button type="submit" name="action" id="confirm-submit-button" class="btn btn-primary confirm-button" value="regenerate">{{$regenerate_label}}</button>
+		</div>
+	</form>
+{{else}}
+	<p class="text-right"><a href="settings/2fa/verify?t={{$password_security_token}}" class="btn btn-primary">{{$verify_label}}</a></p>
+{{/if}}
+</div>
diff --git a/view/templates/settings/twofactor/verify.tpl b/view/templates/settings/twofactor/verify.tpl
new file mode 100644
index 000000000..03138659e
--- /dev/null
+++ b/view/templates/settings/twofactor/verify.tpl
@@ -0,0 +1,22 @@
+<div class="generic-page-wrapper">
+	<h1>{{$title}} <a href="help/Two-Factor-Authentication" title="{{$help_label}}" class="btn btn-default btn-sm"><i aria-hidden="true" class="fa fa-question fa-2x"></i></a></h1>
+	<div>{{$message nofilter}}</div>
+
+	<div class="text-center">
+		{{$qrcode_image nofilter}}
+	</div>
+
+	<form action="settings/2fa/verify?t={{$password_security_token}}" method="post">
+		<input type="hidden" name="form_security_token" value="{{$form_security_token}}">
+
+		{{include file="field_input.tpl" field=$verify_code}}
+
+		<div class="form-group settings-submit-wrapper" >
+			<button type="submit" name="action" id="confirm-submit-button" class="btn btn-primary confirm-button" value="verify">{{$verify_label}}</button>
+		</div>
+	</form>
+
+	<div>{{$qrcode_url_message nofilter}}</div>
+
+	<div>{{$manual_message nofilter}}</div>
+</div>

From 5c59c57b14a0d413af5c3f6afdb9b87e60580475 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 13:31:08 -0400
Subject: [PATCH 10/13] Improve template args visual alignment in two-factor
 modules

---
 src/Module/Settings/TwoFactor/Index.php    | 37 ++++++++++------------
 src/Module/Settings/TwoFactor/Recovery.php | 18 +++++------
 src/Module/Settings/TwoFactor/Verify.php   | 23 +++++++-------
 src/Module/TwoFactor/Recovery.php          |  9 +++---
 src/Module/TwoFactor/Verify.php            |  9 +++---
 5 files changed, 48 insertions(+), 48 deletions(-)

diff --git a/src/Module/Settings/TwoFactor/Index.php b/src/Module/Settings/TwoFactor/Index.php
index 7b8031272..9f0269270 100644
--- a/src/Module/Settings/TwoFactor/Index.php
+++ b/src/Module/Settings/TwoFactor/Index.php
@@ -80,32 +80,29 @@ class Index extends BaseSettingsModule
 
 		return Renderer::replaceMacros(Renderer::getMarkupTemplate('settings/twofactor/index.tpl'), [
 			'$form_security_token' => self::getFormSecurityToken('settings_2fa'),
-			'$title' => L10n::t('Two-factor authentication'),
-			'$help_label' => L10n::t('Help'),
+			'$title'               => L10n::t('Two-factor authentication'),
+			'$help_label'          => L10n::t('Help'),
+			'$status_title'        => L10n::t('Status'),
+			'$message'             => L10n::t('<p>Use an application on a mobile device to get two-factor authentication codes when prompted on login.</p>'),
+			'$has_secret'          => $has_secret,
+			'$verified'            => $verified,
 
-			'$status_title' => L10n::t('Status'),
-			'$message' => L10n::t('<p>Use an application on a mobile device to get two-factor authentication codes when prompted on login.</p>'),
-
-			'$has_secret' => $has_secret,
-			'$verified' => $verified,
-
-			'$auth_app_label' => L10n::t('Authenticator app'),
-			'$app_status' => $has_secret ? $verified ? L10n::t('Configured') : L10n::t('Not Configured') : L10n::t('Disabled'),
+			'$auth_app_label'         => L10n::t('Authenticator app'),
+			'$app_status'             => $has_secret ? $verified ? L10n::t('Configured') : L10n::t('Not Configured') : L10n::t('Disabled'),
 			'$not_configured_message' => L10n::t('<p>You haven\'t finished configuring your authenticator app.</p>'),
-			'$configured_message' => L10n::t('<p>Your authenticator app is correctly configured.</p>'),
+			'$configured_message'     => L10n::t('<p>Your authenticator app is correctly configured.</p>'),
 
-			'$recovery_codes_title' => L10n::t('Recovery codes'),
+			'$recovery_codes_title'     => L10n::t('Recovery codes'),
 			'$recovery_codes_remaining' => L10n::t('Remaining valid codes'),
-			'$recovery_codes_count' => TwoFactorRecoveryCode::countValidForUser(local_user()),
-			'$recovery_codes_message' => L10n::t('<p>These one-use codes can replace an authenticator app code in case you have lost access to it.</p>'),
+			'$recovery_codes_count'     => TwoFactorRecoveryCode::countValidForUser(local_user()),
+			'$recovery_codes_message'   => L10n::t('<p>These one-use codes can replace an authenticator app code in case you have lost access to it.</p>'),
 
-			'$action_title' => L10n::t('Actions'),
-			'$password' => ['password', L10n::t('Current password:'), '', L10n::t('You need to provide your current password to change two-factor authentication settings.'), 'required', 'autofocus'],
-
-			'$enable_label' => L10n::t('Enable two-factor authentication'),
-			'$disable_label' => L10n::t('Disable two-factor authentication'),
+			'$action_title'         => L10n::t('Actions'),
+			'$password'             => ['password', L10n::t('Current password:'), '', L10n::t('You need to provide your current password to change two-factor authentication settings.'), 'required', 'autofocus'],
+			'$enable_label'         => L10n::t('Enable two-factor authentication'),
+			'$disable_label'        => L10n::t('Disable two-factor authentication'),
 			'$recovery_codes_label' => L10n::t('Show recovery codes'),
-			'$configure_label' => L10n::t('Finish app configuration'),
+			'$configure_label'      => L10n::t('Finish app configuration'),
 		]);
 	}
 }
diff --git a/src/Module/Settings/TwoFactor/Recovery.php b/src/Module/Settings/TwoFactor/Recovery.php
index 9f0e74832..a2d08cda8 100644
--- a/src/Module/Settings/TwoFactor/Recovery.php
+++ b/src/Module/Settings/TwoFactor/Recovery.php
@@ -70,17 +70,17 @@ class Recovery extends BaseSettingsModule
 		$verified = PConfig::get(local_user(), '2fa', 'verified');
 		
 		return Renderer::replaceMacros(Renderer::getMarkupTemplate('settings/twofactor/recovery.tpl'), [
-			'$form_security_token' => self::getFormSecurityToken('settings_2fa_recovery'),
+			'$form_security_token'     => self::getFormSecurityToken('settings_2fa_recovery'),
 			'$password_security_token' => self::getFormSecurityToken('settings_2fa_password'),
-			'$title' => L10n::t('Two-factor recovery codes'),
-			'$help_label' => L10n::t('Help'),
-			'$message' => L10n::t('<p>Recovery codes can be used to access your account in the event you lose access to your device and cannot receive two-factor authentication codes.</p><p><strong>Put these in a safe spot!</strong> If you lose your device and don’t have the recovery codes you will lose access to your account.</p>'),
-			'$recovery_codes' => $recoveryCodes,
-			'$password' => ['password', L10n::t('Please enter your password for verification:'), '', L10n::t('You need to provide your current password to enable or disable two-factor authentication.'), 'required', 'autofocus'],
+
+			'$title'              => L10n::t('Two-factor recovery codes'),
+			'$help_label'         => L10n::t('Help'),
+			'$message'            => L10n::t('<p>Recovery codes can be used to access your account in the event you lose access to your device and cannot receive two-factor authentication codes.</p><p><strong>Put these in a safe spot!</strong> If you lose your device and don’t have the recovery codes you will lose access to your account.</p>'),
+			'$recovery_codes'     => $recoveryCodes,
 			'$regenerate_message' => L10n::t('When you generate new recovery codes, you must copy the new codes. Your old codes won’t work anymore.'),
-			'$regenerate_label' => L10n::t('Generate new recovery codes'),
-			'$verified' => $verified,
-			'$verify_label' => L10n::t('Next: Verification'),
+			'$regenerate_label'   => L10n::t('Generate new recovery codes'),
+			'$verified'           => $verified,
+			'$verify_label'       => L10n::t('Next: Verification'),
 		]);
 	}
 }
diff --git a/src/Module/Settings/TwoFactor/Verify.php b/src/Module/Settings/TwoFactor/Verify.php
index 57995cd75..caed464ec 100644
--- a/src/Module/Settings/TwoFactor/Verify.php
+++ b/src/Module/Settings/TwoFactor/Verify.php
@@ -110,19 +110,20 @@ class Verify extends BaseSettingsModule
 </dl>', $company, $holder, $secret);
 
 		return Renderer::replaceMacros(Renderer::getMarkupTemplate('settings/twofactor/verify.tpl'), [
-			'$form_security_token' => self::getFormSecurityToken('settings_2fa_verify'),
+			'$form_security_token'     => self::getFormSecurityToken('settings_2fa_verify'),
 			'$password_security_token' => self::getFormSecurityToken('settings_2fa_password'),
-			'$title' => L10n::t('Two-factor code verification'),
-			'$help_label' => L10n::t('Help'),
-			'$message' => L10n::t('<p>Please scan this QR Code with your authenticator app and submit the provided code.</p>'),
-			'$qrcode_image' => $qrcode_image,
-			'$qrcode_url_message' => L10n::t('<p>Or you can open the following URL in your mobile devicde:</p><p><a href="%s">%s</a></p>', $otpauthUrl, $shortOtpauthUrl),
-			'$manual_message' => $manual_message,
-			'$company' => $company,
-			'$holder' => $holder,
-			'$secret' => $secret,
 
-			'$verify_code' => ['verify_code', L10n::t('Please enter a code from your authentication app'), '', '', 'required', 'autofocus placeholder="000000"'],
+			'$title'              => L10n::t('Two-factor code verification'),
+			'$help_label'         => L10n::t('Help'),
+			'$message'            => L10n::t('<p>Please scan this QR Code with your authenticator app and submit the provided code.</p>'),
+			'$qrcode_image'       => $qrcode_image,
+			'$qrcode_url_message' => L10n::t('<p>Or you can open the following URL in your mobile devicde:</p><p><a href="%s">%s</a></p>', $otpauthUrl, $shortOtpauthUrl),
+			'$manual_message'     => $manual_message,
+			'$company'            => $company,
+			'$holder'             => $holder,
+			'$secret'             => $secret,
+
+			'$verify_code'  => ['verify_code', L10n::t('Please enter a code from your authentication app'), '', '', 'required', 'autofocus placeholder="000000"'],
 			'$verify_label' => L10n::t('Verify code and enable two-factor authentication'),
 		]);
 	}
diff --git a/src/Module/TwoFactor/Recovery.php b/src/Module/TwoFactor/Recovery.php
index cd197e030..4952d220b 100644
--- a/src/Module/TwoFactor/Recovery.php
+++ b/src/Module/TwoFactor/Recovery.php
@@ -61,11 +61,12 @@ class Recovery extends BaseModule
 
 		return Renderer::replaceMacros(Renderer::getMarkupTemplate('twofactor/recovery.tpl'), [
 			'$form_security_token' => self::getFormSecurityToken('twofactor_recovery'),
-			'$title' => L10n::t('Two-factor recovery'),
-			'$message' => L10n::t('<p>You can enter one of your one-time recovery codes in case you lost access to your mobile device.</p>'),
+
+			'$title'            => L10n::t('Two-factor recovery'),
+			'$message'          => L10n::t('<p>You can enter one of your one-time recovery codes in case you lost access to your mobile device.</p>'),
 			'$recovery_message' => L10n::t('Don’t have your phone? <a href="%s">Enter a two-factor recovery code</a>', '2fa/recovery'),
-			'$recovery_code' => ['recovery_code', L10n::t('Please enter a recovery code'), '', '', '', 'placeholder="000000-000000"'],
-			'$recovery_label' => L10n::t('Submit recovery code and complete login'),
+			'$recovery_code'    => ['recovery_code', L10n::t('Please enter a recovery code'), '', '', '', 'placeholder="000000-000000"'],
+			'$recovery_label'   => L10n::t('Submit recovery code and complete login'),
 		]);
 	}
 }
diff --git a/src/Module/TwoFactor/Verify.php b/src/Module/TwoFactor/Verify.php
index b27c982bd..abe6077c6 100644
--- a/src/Module/TwoFactor/Verify.php
+++ b/src/Module/TwoFactor/Verify.php
@@ -56,11 +56,12 @@ class Verify extends BaseModule
 
 		return Renderer::replaceMacros(Renderer::getMarkupTemplate('twofactor/verify.tpl'), [
 			'$form_security_token' => self::getFormSecurityToken('twofactor_verify'),
-			'$title' => L10n::t('Two-factor authentication'),
-			'$message' => L10n::t('<p>Open the two-factor authentication app on your device to get an authentication code and verify your identity.</p>'),
+
+			'$title'            => L10n::t('Two-factor authentication'),
+			'$message'          => L10n::t('<p>Open the two-factor authentication app on your device to get an authentication code and verify your identity.</p>'),
 			'$recovery_message' => L10n::t('Don’t have your phone? <a href="%s">Enter a two-factor recovery code</a>', '2fa/recovery'),
-			'$verify_code' => ['verify_code', L10n::t('Please enter a code from your authentication app'), '', '', 'required', 'autofocus placeholder="000000"'],
-			'$verify_label' => L10n::t('Verify code and complete login'),
+			'$verify_code'      => ['verify_code', L10n::t('Please enter a code from your authentication app'), '', '', 'required', 'autofocus placeholder="000000"'],
+			'$verify_label'     => L10n::t('Verify code and complete login'),
 		]);
 	}
 }

From a14f868134cca1e9cc8f6f0e57ba61fafcca89e3 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 13:32:21 -0400
Subject: [PATCH 11/13] Make Module\TwoFactorRecoveryCode::markUsedForUser
 return false for already used code

- Add PHP Doc in Module\TwoFactorRecoveryCode
---
 src/Model/TwoFactorRecoveryCode.php | 59 ++++++++++++++++++++++++++++-
 1 file changed, 57 insertions(+), 2 deletions(-)

diff --git a/src/Model/TwoFactorRecoveryCode.php b/src/Model/TwoFactorRecoveryCode.php
index 82740d3b3..74dead32d 100644
--- a/src/Model/TwoFactorRecoveryCode.php
+++ b/src/Model/TwoFactorRecoveryCode.php
@@ -8,18 +8,45 @@ use Friendica\Util\DateTimeFormat;
 use PragmaRX\Random\Random;
 use PragmaRX\Recovery\Recovery;
 
+/**
+ * Manages users' two-factor recovery codes in the 2fa_recovery_codes table
+ *
+ * @package Friendica\Model
+ */
 class TwoFactorRecoveryCode extends BaseObject
 {
-	public static function countValidForUser($uid)
+    /**
+     * Returns the number of code the provided users can still use to replace a TOTP code
+     *
+     * @param int $uid User ID
+     * @return int
+     * @throws \Exception
+     */
+    public static function countValidForUser($uid)
 	{
 		return DBA::count('2fa_recovery_codes', ['uid' => $uid, 'used' => null]);
 	}
 
+    /**
+     * Checks the provided code is available to use for login by the provided user
+     *
+     * @param  int $uid User ID
+     * @param string $code
+     * @return bool
+     * @throws \Exception
+     */
 	public static function existsForUser($uid, $code)
 	{
 		return DBA::exists('2fa_recovery_codes', ['uid' => $uid, 'code' => $code, 'used' => null]);
 	}
 
+    /**
+     * Returns a complete list of all recovery codes for the provided user, including the used status
+     *
+     * @param  int $uid User ID
+     * @return array
+     * @throws \Exception
+     */
 	public static function getListForUser($uid)
 	{
 		$codesStmt = DBA::select('2fa_recovery_codes', ['code', 'used'], ['uid' => $uid]);
@@ -27,13 +54,29 @@ class TwoFactorRecoveryCode extends BaseObject
 		return DBA::toArray($codesStmt);
 	}
 
+    /**
+     * Marks the provided code as used for the provided user.
+     * Returns false if the code doesn't exist for the user or it has been used already.
+     *
+     * @param  int $uid User ID
+     * @param string $code
+     * @return bool
+     * @throws \Exception
+     */
 	public static function markUsedForUser($uid, $code)
 	{
-		DBA::update('2fa_recovery_codes', ['used' => DateTimeFormat::utcNow()], ['uid' => $uid, 'code' => $code]);
+		DBA::update('2fa_recovery_codes', ['used' => DateTimeFormat::utcNow()], ['uid' => $uid, 'code' => $code, 'used' => null]);
 
 		return DBA::affectedRows() > 0;
 	}
 
+    /**
+     * Generates a fresh set of recovery codes for the provided user.
+     * Generates 12 codes constituted of 2 blocks of 6 characters separated by a dash.
+     *
+     * @param  int $uid User ID
+     * @throws \Exception
+     */
 	public static function generateForUser($uid)
 	{
 		$Random = (new Random())->pattern('[a-z0-9]');
@@ -57,11 +100,23 @@ class TwoFactorRecoveryCode extends BaseObject
 		}
 	}
 
+    /**
+     * Deletes all the recovery codes for the provided user.
+     *
+     * @param  int $uid User ID
+     * @throws \Exception
+     */
 	public static function deleteForUser($uid)
 	{
 		DBA::delete('2fa_recovery_codes', ['uid' => $uid]);
 	}
 
+    /**
+     * Replaces the existing recovery codes for the provided user by a freshly generated set.
+     *
+     * @param  int $uid User ID
+     * @throws \Exception
+     */
 	public static function regenerateForUser($uid)
 	{
 		self::deleteForUser($uid);

From e077f30d51659f8da1df72e64c9978d21ba350c3 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 13:33:20 -0400
Subject: [PATCH 12/13] =?UTF-8?q?Use=20Contact::select()=20instead=20of=20?=
 =?UTF-8?q?DBA::select(=E2=80=98contact)=20in=20Core\Session?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Replace remaining occurrences of $_SESSION with Session methods
---
 src/Core/Session.php | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/Core/Session.php b/src/Core/Session.php
index 5ef77094c..e3768cbef 100644
--- a/src/Core/Session.php
+++ b/src/Core/Session.php
@@ -9,6 +9,7 @@ use Friendica\App;
 use Friendica\Core\Session\CacheSessionHandler;
 use Friendica\Core\Session\DatabaseSessionHandler;
 use Friendica\Database\DBA;
+use Friendica\Model\Contact;
 use Friendica\Model\User;
 use Friendica\Util\BaseURL;
 use Friendica\Util\DateTimeFormat;
@@ -137,8 +138,8 @@ class Session
 
 		$masterUid = $user_record['uid'];
 
-		if (!empty($_SESSION['submanage'])) {
-			$user = DBA::selectFirst('user', ['uid'], ['uid' => $_SESSION['submanage']]);
+		if (self::get('submanage')) {
+			$user = DBA::selectFirst('user', ['uid'], ['uid' => self::get('submanage')]);
 			if (DBA::isResult($user)) {
 				$masterUid = $user['uid'];
 			}
@@ -154,7 +155,7 @@ class Session
 			$a->getLogger()->info('auth_identities refresh: ' . print_r($a->identities, true));
 		}
 
-		$contact = DBA::selectFirst('contact', [], ['uid' => $_SESSION['uid'], 'self' => true]);
+		$contact = Contact::select([], ['uid' => $user_record['uid'], 'self' => true]);
 		if (DBA::isResult($contact)) {
 			$a->contact = $contact;
 			$a->cid = $contact['id'];
@@ -164,7 +165,7 @@ class Session
 		header('X-Account-Management-Status: active; name="' . $user_record['username'] . '"; id="' . $user_record['nickname'] . '"');
 
 		if ($login_initial || $login_refresh) {
-			DBA::update('user', ['login_date' => DateTimeFormat::utcNow()], ['uid' => $_SESSION['uid']]);
+			DBA::update('user', ['login_date' => DateTimeFormat::utcNow()], ['uid' => $user_record['uid']]);
 
 			// Set the login date for all identities of the user
 			DBA::update('user', ['login_date' => DateTimeFormat::utcNow()],

From 78b651d2e89e85af21edc973ca09afa036fc1de6 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Mon, 13 May 2019 14:07:02 -0400
Subject: [PATCH 13/13] =?UTF-8?q?Revert=20Use=20Contact::select()=20instea?=
 =?UTF-8?q?d=20of=20DBA::select(=E2=80=98contact)=20in=20Core\Session?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/Core/Session.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Core/Session.php b/src/Core/Session.php
index e3768cbef..8b6c26bc5 100644
--- a/src/Core/Session.php
+++ b/src/Core/Session.php
@@ -155,7 +155,7 @@ class Session
 			$a->getLogger()->info('auth_identities refresh: ' . print_r($a->identities, true));
 		}
 
-		$contact = Contact::select([], ['uid' => $user_record['uid'], 'self' => true]);
+		$contact = DBA::selectFirst('contact', [], ['uid' => $user_record['uid'], 'self' => true]);
 		if (DBA::isResult($contact)) {
 			$a->contact = $contact;
 			$a->cid = $contact['id'];