Use an application on a mobile device to get two-factor authentication codes when prompted on login.
'), + '$has_secret' => $has_secret, + '$verified' => $verified, + + '$auth_app_label' => L10n::t('Authenticator app'), + '$app_status' => $has_secret ? $verified ? L10n::t('Configured') : L10n::t('Not Configured') : L10n::t('Disabled'), + '$not_configured_message' => L10n::t('You haven\'t finished configuring your authenticator app.
'), + '$configured_message' => L10n::t('Your authenticator app is correctly configured.
'), + + '$recovery_codes_title' => L10n::t('Recovery codes'), + '$recovery_codes_remaining' => L10n::t('Remaining valid codes'), + '$recovery_codes_count' => TwoFactorRecoveryCode::countValidForUser(local_user()), + '$recovery_codes_message' => L10n::t('These one-use codes can replace an authenticator app code in case you have lost access to it.
'), + + '$action_title' => L10n::t('Actions'), + '$password' => ['password', L10n::t('Current password:'), '', L10n::t('You need to provide your current password to change two-factor authentication settings.'), 'required', 'autofocus'], + '$enable_label' => L10n::t('Enable two-factor authentication'), + '$disable_label' => L10n::t('Disable two-factor authentication'), + '$recovery_codes_label' => L10n::t('Show recovery codes'), + '$configure_label' => L10n::t('Finish app configuration'), + ]); + } +} diff --git a/src/Module/Settings/TwoFactor/Recovery.php b/src/Module/Settings/TwoFactor/Recovery.php new file mode 100644 index 000000000..a2d08cda8 --- /dev/null +++ b/src/Module/Settings/TwoFactor/Recovery.php @@ -0,0 +1,86 @@ +internalRedirect('settings/2fa'); + } + + if (!self::checkFormSecurityToken('settings_2fa_password', 't')) { + notice(L10n::t('Please enter your password to access this page.')); + self::getApp()->internalRedirect('settings/2fa'); + } + } + + public static function post() + { + if (!local_user()) { + return; + } + + if (!empty($_POST['action'])) { + self::checkFormSecurityTokenRedirectOnError('settings/2fa/recovery', 'settings_2fa_recovery'); + + if ($_POST['action'] == 'regenerate') { + TwoFactorRecoveryCode::regenerateForUser(local_user()); + notice(L10n::t('New recovery codes successfully generated.')); + self::getApp()->internalRedirect('settings/2fa/recovery?t=' . self::getFormSecurityToken('settings_2fa_password')); + } + } + } + + public static function content() + { + if (!local_user()) { + return Login::form('settings/2fa/recovery'); + } + + parent::content(); + + if (!TwoFactorRecoveryCode::countValidForUser(local_user())) { + TwoFactorRecoveryCode::generateForUser(local_user()); + } + + $recoveryCodes = TwoFactorRecoveryCode::getListForUser(local_user()); + + $verified = PConfig::get(local_user(), '2fa', 'verified'); + + return Renderer::replaceMacros(Renderer::getMarkupTemplate('settings/twofactor/recovery.tpl'), [ + '$form_security_token' => self::getFormSecurityToken('settings_2fa_recovery'), + '$password_security_token' => self::getFormSecurityToken('settings_2fa_password'), + + '$title' => L10n::t('Two-factor recovery codes'), + '$help_label' => L10n::t('Help'), + '$message' => L10n::t('Recovery codes can be used to access your account in the event you lose access to your device and cannot receive two-factor authentication codes.
Put these in a safe spot! If you lose your device and don’t have the recovery codes you will lose access to your account.
'), + '$recovery_codes' => $recoveryCodes, + '$regenerate_message' => L10n::t('When you generate new recovery codes, you must copy the new codes. Your old codes won’t work anymore.'), + '$regenerate_label' => L10n::t('Generate new recovery codes'), + '$verified' => $verified, + '$verify_label' => L10n::t('Next: Verification'), + ]); + } +} diff --git a/src/Module/Settings/TwoFactor/Verify.php b/src/Module/Settings/TwoFactor/Verify.php new file mode 100644 index 000000000..caed464ec --- /dev/null +++ b/src/Module/Settings/TwoFactor/Verify.php @@ -0,0 +1,130 @@ +internalRedirect('settings/2fa'); + } + + if (!self::checkFormSecurityToken('settings_2fa_password', 't')) { + notice(L10n::t('Please enter your password to access this page.')); + self::getApp()->internalRedirect('settings/2fa'); + } + } + + public static function post() + { + if (!local_user()) { + return; + } + + if (defaults($_POST, 'action', null) == 'verify') { + self::checkFormSecurityTokenRedirectOnError('settings/2fa/verify', 'settings_2fa_verify'); + + $google2fa = new Google2FA(); + + $valid = $google2fa->verifyKey(PConfig::get(local_user(), '2fa', 'secret'), defaults($_POST, 'verify_code', '')); + + if ($valid) { + PConfig::set(local_user(), '2fa', 'verified', true); + Session::set('2fa', true); + + notice(L10n::t('Two-factor authentication successfully activated.')); + + self::getApp()->internalRedirect('settings/2fa'); + } else { + notice(L10n::t('Invalid code, please retry.')); + } + } + } + + public static function content() + { + if (!local_user()) { + return Login::form('settings/2fa/verify'); + } + + parent::content(); + + $company = 'Friendica'; + $holder = Session::get('my_address'); + $secret = PConfig::get(local_user(), '2fa', 'secret'); + + $otpauthUrl = (new Google2FA())->getQRCodeUrl($company, $holder, $secret); + + $renderer = (new \BaconQrCode\Renderer\Image\Svg()) + ->setHeight(256) + ->setWidth(256); + + $writer = new Writer($renderer); + + $qrcode_image = str_replace('', '', $writer->writeString($otpauthUrl)); + + $shortOtpauthUrl = explode('?', $otpauthUrl)[0]; + + $manual_message = L10n::t('Or you can submit the authentication settings manually:
+Please scan this QR Code with your authenticator app and submit the provided code.
'), + '$qrcode_image' => $qrcode_image, + '$qrcode_url_message' => L10n::t('Or you can open the following URL in your mobile devicde:
', $otpauthUrl, $shortOtpauthUrl), + '$manual_message' => $manual_message, + '$company' => $company, + '$holder' => $holder, + '$secret' => $secret, + + '$verify_code' => ['verify_code', L10n::t('Please enter a code from your authentication app'), '', '', 'required', 'autofocus placeholder="000000"'], + '$verify_label' => L10n::t('Verify code and enable two-factor authentication'), + ]); + } +} diff --git a/src/Module/TwoFactor/Recovery.php b/src/Module/TwoFactor/Recovery.php new file mode 100644 index 000000000..4952d220b --- /dev/null +++ b/src/Module/TwoFactor/Recovery.php @@ -0,0 +1,72 @@ +user, true, true); + } else { + notice(L10n::t('Invalid code, please retry.')); + } + } + } + + public static function content() + { + if (!local_user()) { + self::getApp()->internalRedirect(); + } + + // Already authenticated with 2FA token + if (Session::get('2fa')) { + self::getApp()->internalRedirect(); + } + + return Renderer::replaceMacros(Renderer::getMarkupTemplate('twofactor/recovery.tpl'), [ + '$form_security_token' => self::getFormSecurityToken('twofactor_recovery'), + + '$title' => L10n::t('Two-factor recovery'), + '$message' => L10n::t('You can enter one of your one-time recovery codes in case you lost access to your mobile device.
'), + '$recovery_message' => L10n::t('Don’t have your phone? Enter a two-factor recovery code', '2fa/recovery'), + '$recovery_code' => ['recovery_code', L10n::t('Please enter a recovery code'), '', '', '', 'placeholder="000000-000000"'], + '$recovery_label' => L10n::t('Submit recovery code and complete login'), + ]); + } +} diff --git a/src/Module/TwoFactor/Verify.php b/src/Module/TwoFactor/Verify.php new file mode 100644 index 000000000..abe6077c6 --- /dev/null +++ b/src/Module/TwoFactor/Verify.php @@ -0,0 +1,67 @@ +verifyKey(PConfig::get(local_user(), '2fa', 'secret'), $code); + + // The same code can't be used twice even if it's valid + if ($valid && Session::get('2fa') !== $code) { + Session::set('2fa', $code); + + // Resume normal login workflow + Session::setAuthenticatedForUser($a, $a->user, true, true); + } else { + notice(L10n::t('Invalid code, please retry.')); + } + } + } + + public static function content() + { + if (!local_user()) { + self::getApp()->internalRedirect(); + } + + // Already authenticated with 2FA token + if (Session::get('2fa')) { + self::getApp()->internalRedirect(); + } + + return Renderer::replaceMacros(Renderer::getMarkupTemplate('twofactor/verify.tpl'), [ + '$form_security_token' => self::getFormSecurityToken('twofactor_verify'), + + '$title' => L10n::t('Two-factor authentication'), + '$message' => L10n::t('Open the two-factor authentication app on your device to get an authentication code and verify your identity.
'), + '$recovery_message' => L10n::t('Don’t have your phone? Enter a two-factor recovery code', '2fa/recovery'), + '$verify_code' => ['verify_code', L10n::t('Please enter a code from your authentication app'), '', '', 'required', 'autofocus placeholder="000000"'], + '$verify_label' => L10n::t('Verify code and complete login'), + ]); + } +} diff --git a/view/templates/settings/twofactor/index.tpl b/view/templates/settings/twofactor/index.tpl new file mode 100644 index 000000000..57bcab19e --- /dev/null +++ b/view/templates/settings/twofactor/index.tpl @@ -0,0 +1,39 @@ +{{$auth_app_label}}: {{$app_status}}
+{{if $has_secret && $verified}} +{{$recovery_codes_remaining}}: {{$recovery_codes_count}}
+