mdaniels5757 / waca

redir.php

Indentation +28 added lines, -28 removed lines

@@ -7,46 +7,46 @@
  ******************************************************************************/
 
 $toolList = array(
-    'tparis-pcount'      => '//tools.wmflabs.org/supercount/index.php?user=%DATA%&project=en.wikipedia',
-    'guc'                => '//tools.wmflabs.org/guc/?by=date&user=%DATA%',
-    'oq-whois'           => 'https://whois.domaintools.com/%DATA%',
-    'tl-whois'           => 'https://tools.wmflabs.org/whois/gateway.py?lookup=true&ip=%DATA%',
-    'honeypot'           => 'https://www.projecthoneypot.org/ip_%DATA%',
-    'stopforumspam'      => 'https://www.stopforumspam.com/ipcheck/%DATA%',
-    'google'             => 'https://www.google.com/search?q=%DATA%',
-    'domain'             => 'http://%DATA%/',
-    'rangefinder'        => 'https://tools.wmflabs.org/rangeblockfinder/?ip=%DATA%',
+	'tparis-pcount'      => '//tools.wmflabs.org/supercount/index.php?user=%DATA%&project=en.wikipedia',
+	'guc'                => '//tools.wmflabs.org/guc/?by=date&user=%DATA%',
+	'oq-whois'           => 'https://whois.domaintools.com/%DATA%',
+	'tl-whois'           => 'https://tools.wmflabs.org/whois/gateway.py?lookup=true&ip=%DATA%',
+	'honeypot'           => 'https://www.projecthoneypot.org/ip_%DATA%',
+	'stopforumspam'      => 'https://www.stopforumspam.com/ipcheck/%DATA%',
+	'google'             => 'https://www.google.com/search?q=%DATA%',
+	'domain'             => 'http://%DATA%/',
+	'rangefinder'        => 'https://tools.wmflabs.org/rangeblockfinder/?ip=%DATA%',
 	'ipcheck'            => 'https://ipcheck.toolforge.org/index.php?ip=%DATA%',
 	'bgpview'            => 'https://bgpview.io/ip/%DATA%'
 );
 
 if (!isset($_GET['tool'])
-    || !isset($toolList[$_GET['tool']])
-    || !isset($_GET['data'])
+	|| !isset($toolList[$_GET['tool']])
+	|| !isset($_GET['data'])
 ) {
-    header("HTTP/1.1 403 Forbidden");
+	header("HTTP/1.1 403 Forbidden");
 
-    return;
+	return;
 }
 
 if (isset($_GET['round2'])) {
-    $data = $_GET['data'];
-    $tool = $_GET['tool'];
+	$data = $_GET['data'];
+	$tool = $_GET['tool'];
 
-    if ($tool === 'domain') {
-        // quick security check - if you want to exploit something, you better be sure your exploit resolves via dns.
-        // this is not intended to catch everything, just as a quick sanity check.
-        if (gethostbyname($data) == $data) {
-            echo 'Error resolving hostname, it doesn\'t look like this domain exists.';
-            die();
-        }
-    }
-    else {
-        $data = urlencode($data);
-    }
+	if ($tool === 'domain') {
+		// quick security check - if you want to exploit something, you better be sure your exploit resolves via dns.
+		// this is not intended to catch everything, just as a quick sanity check.
+		if (gethostbyname($data) == $data) {
+			echo 'Error resolving hostname, it doesn\'t look like this domain exists.';
+			die();
+		}
+	}
+	else {
+		$data = urlencode($data);
+	}
 
-    echo '<script>window.location.href=' . json_encode(str_replace("%DATA%", $data, $toolList[$tool])) . '</script>';
+	echo '<script>window.location.href=' . json_encode(str_replace("%DATA%", $data, $toolList[$tool])) . '</script>';
 }
 else {
-    header("Location: " . $_SERVER["REQUEST_URI"] . "&round2=true");
+	header("Location: " . $_SERVER["REQUEST_URI"] . "&round2=true");
 }

Braces +2 added lines, -4 removed lines

@@ -40,13 +40,11 @@
             echo 'Error resolving hostname, it doesn\'t look like this domain exists.';
             die();
         }
-    }
-    else {
+    } else {
         $data = urlencode($data);
     }
 
     echo '<script>window.location.href=' . json_encode(str_replace("%DATA%", $data, $toolList[$tool])) . '</script>';
-}
-else {
+} else {
     header("Location: " . $_SERVER["REQUEST_URI"] . "&round2=true");
 }

smarty-plugins/modifier.iphex.php

Indentation +10 added lines, -10 removed lines

@@ -13,17 +13,17 @@
  */
 function smarty_modifier_iphex($input)
 {
-    $output = $input;
+	$output = $input;
 
-    if (filter_var($input, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false) {
-        $octets = explode('.', $input);
-        $output = '';
-        foreach ($octets as $octet) {
-            $output .= str_pad(dechex($octet), 2, '0', STR_PAD_LEFT);
-        }
+	if (filter_var($input, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false) {
+		$octets = explode('.', $input);
+		$output = '';
+		foreach ($octets as $octet) {
+			$output .= str_pad(dechex($octet), 2, '0', STR_PAD_LEFT);
+		}
 
-        $output = str_pad($output, 32, '0', STR_PAD_LEFT);
-    }
+		$output = str_pad($output, 32, '0', STR_PAD_LEFT);
+	}
 
-    return $output;
+	return $output;
 }

smarty-plugins/modifier.nlimplode.php

Indentation +5 added lines, -5 removed lines

@@ -14,9 +14,9 @@
 
 function smarty_modifier_nlimplode($list, $conjunction = 'or')
 {
-    $last = array_pop($list);
-    if ($list) {
-        return implode(', ', $list) . ', ' . $conjunction . ' ' . $last;
-    }
-    return $last;
+	$last = array_pop($list);
+	if ($list) {
+		return implode(', ', $list) . ', ' . $conjunction . ' ' . $last;
+	}
+	return $last;
 }
\ No newline at end of file

smarty-plugins/modifier.relativedate.php

Indentation +62 added lines, -62 removed lines

@@ -16,73 +16,73 @@
  */
 function smarty_modifier_relativedate($input)
 {
-    $now = new DateTime();
+	$now = new DateTime();
 
-    if (gettype($input) === 'object'
-        && (get_class($input) === DateTime::class || get_class($input) === DateTimeImmutable::class)
-    ) {
-        $then = $input;
-    }
-    else {
-        try {
-            $then = new DateTime($input);
-        }
-        catch(Exception $ex) {
-            return $input;
-        }
-    }
+	if (gettype($input) === 'object'
+		&& (get_class($input) === DateTime::class || get_class($input) === DateTimeImmutable::class)
+	) {
+		$then = $input;
+	}
+	else {
+		try {
+			$then = new DateTime($input);
+		}
+		catch(Exception $ex) {
+			return $input;
+		}
+	}
 
-    $secs = $now->getTimestamp() - $then->getTimestamp();
+	$secs = $now->getTimestamp() - $then->getTimestamp();
 
-    $second = 1;
-    $minute = 60 * $second;
-    $minuteCut = 60 * $second;
-    $hour = 60 * $minute;
-    $hourCut = 90 * $minute;
-    $day = 24 * $hour;
-    $dayCut = 48 * $hour;
-    $week = 7 * $day;
-    $weekCut = 14 * $day;
-    $month = 30 * $day;
-    $monthCut = 60 * $day;
-    $year = 365 * $day;
-    $yearCut = $year * 2;
+	$second = 1;
+	$minute = 60 * $second;
+	$minuteCut = 60 * $second;
+	$hour = 60 * $minute;
+	$hourCut = 90 * $minute;
+	$day = 24 * $hour;
+	$dayCut = 48 * $hour;
+	$week = 7 * $day;
+	$weekCut = 14 * $day;
+	$month = 30 * $day;
+	$monthCut = 60 * $day;
+	$year = 365 * $day;
+	$yearCut = $year * 2;
 
-    $pluralise = true;
+	$pluralise = true;
 
-    if ($secs <= 10) {
-        $output = "just now";
-        $pluralise = false;
-    }
-    elseif ($secs > 10 && $secs < $minuteCut) {
-        $output = round($secs / $second) . " second";
-    }
-    elseif ($secs >= $minuteCut && $secs < $hourCut) {
-        $output = round($secs / $minute) . " minute";
-    }
-    elseif ($secs >= $hourCut && $secs < $dayCut) {
-        $output = round($secs / $hour) . " hour";
-    }
-    elseif ($secs >= $dayCut && $secs < $weekCut) {
-        $output = round($secs / $day) . " day";
-    }
-    elseif ($secs >= $weekCut && $secs < $monthCut) {
-        $output = round($secs / $week) . " week";
-    }
-    elseif ($secs >= $monthCut && $secs < $yearCut) {
-        $output = round($secs / $month) . " month";
-    }
-    elseif ($secs >= $yearCut && $secs < $year * 10) {
-        $output = round($secs / $year) . " year";
-    }
-    else {
-        $output = "a long time ago";
-        $pluralise = false;
-    }
+	if ($secs <= 10) {
+		$output = "just now";
+		$pluralise = false;
+	}
+	elseif ($secs > 10 && $secs < $minuteCut) {
+		$output = round($secs / $second) . " second";
+	}
+	elseif ($secs >= $minuteCut && $secs < $hourCut) {
+		$output = round($secs / $minute) . " minute";
+	}
+	elseif ($secs >= $hourCut && $secs < $dayCut) {
+		$output = round($secs / $hour) . " hour";
+	}
+	elseif ($secs >= $dayCut && $secs < $weekCut) {
+		$output = round($secs / $day) . " day";
+	}
+	elseif ($secs >= $weekCut && $secs < $monthCut) {
+		$output = round($secs / $week) . " week";
+	}
+	elseif ($secs >= $monthCut && $secs < $yearCut) {
+		$output = round($secs / $month) . " month";
+	}
+	elseif ($secs >= $yearCut && $secs < $year * 10) {
+		$output = round($secs / $year) . " year";
+	}
+	else {
+		$output = "a long time ago";
+		$pluralise = false;
+	}
 
-    if ($pluralise) {
-        $output = (substr($output, 0, 2) <> "1 ") ? $output . "s ago" : $output . " ago";
-    }
+	if ($pluralise) {
+		$output = (substr($output, 0, 2) <> "1 ") ? $output . "s ago" : $output . " ago";
+	}
 
-    return $output;
+	return $output;
 }

Spacing +1 added lines, -1 removed lines

@@ -27,7 +27,7 @@
         try {
             $then = new DateTime($input);
         }
-        catch(Exception $ex) {
+        catch (Exception $ex) {
             return $input;
         }
     }

Braces +9 added lines, -18 removed lines

@@ -22,8 +22,7 @@ 
         && (get_class($input) === DateTime::class || get_class($input) === DateTimeImmutable::class)
     ) {
         $then = $input;
-    }
-    else {
+    } else {
         try {
             $then = new DateTime($input);
         }
@@ -53,29 +52,21 @@ 
     if ($secs <= 10) {
         $output = "just now";
         $pluralise = false;
-    }
-    elseif ($secs > 10 && $secs < $minuteCut) {
+    } elseif ($secs > 10 && $secs < $minuteCut) {
         $output = round($secs / $second) . " second";
-    }
-    elseif ($secs >= $minuteCut && $secs < $hourCut) {
+    } elseif ($secs >= $minuteCut && $secs < $hourCut) {
         $output = round($secs / $minute) . " minute";
-    }
-    elseif ($secs >= $hourCut && $secs < $dayCut) {
+    } elseif ($secs >= $hourCut && $secs < $dayCut) {
         $output = round($secs / $hour) . " hour";
-    }
-    elseif ($secs >= $dayCut && $secs < $weekCut) {
+    } elseif ($secs >= $dayCut && $secs < $weekCut) {
         $output = round($secs / $day) . " day";
-    }
-    elseif ($secs >= $weekCut && $secs < $monthCut) {
+    } elseif ($secs >= $weekCut && $secs < $monthCut) {
         $output = round($secs / $week) . " week";
-    }
-    elseif ($secs >= $monthCut && $secs < $yearCut) {
+    } elseif ($secs >= $monthCut && $secs < $yearCut) {
         $output = round($secs / $month) . " month";
-    }
-    elseif ($secs >= $yearCut && $secs < $year * 10) {
+    } elseif ($secs >= $yearCut && $secs < $year * 10) {
         $output = round($secs / $year) . " year";
-    }
-    else {
+    } else {
         $output = "a long time ago";
         $pluralise = false;
     }

smarty-plugins/modifier.demodhex.php

Indentation +5 added lines, -5 removed lines

@@ -13,10 +13,10 @@
  */
 function smarty_modifier_demodhex($input)
 {
-    $hex = preg_replace(
-        array('/c/', '/b/', '/d/', '/e/', '/f/', '/g/', '/h/', '/i/', '/j/', '/k/', '/l/', '/n/', '/r/', '/t/', '/u/', '/v/'),
-        array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'),
-        $input);
+	$hex = preg_replace(
+		array('/c/', '/b/', '/d/', '/e/', '/f/', '/g/', '/h/', '/i/', '/j/', '/k/', '/l/', '/n/', '/r/', '/t/', '/u/', '/v/'),
+		array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'),
+		$input);
 
-    return hexdec($hex);
+	return hexdec($hex);
 }
\ No newline at end of file

includes/Security/EncryptionHelper.php

Indentation +44 added lines, -44 removed lines

@@ -12,48 +12,48 @@
 
 class EncryptionHelper
 {
-    /**
-     * @var SiteConfiguration
-     */
-    private $configuration;
-
-    /**
-     * EncryptionHelper constructor.
-     *
-     * @param SiteConfiguration $configuration
-     */
-    public function __construct(SiteConfiguration $configuration)
-    {
-        $this->configuration = $configuration;
-    }
-
-    public function encryptData($secret)
-    {
-        $iv = openssl_random_pseudo_bytes(16);
-        $password = $this->getEncryptionKey();
-        $encryptedKey = openssl_encrypt($secret, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv);
-
-        $data = base64_encode($iv) . '|' . base64_encode($encryptedKey);
-
-        return $data;
-    }
-
-    public function decryptData($data)
-    {
-        list($iv, $encryptedKey) = array_map('base64_decode', explode('|', $data));
-
-        $password = $this->getEncryptionKey();
-
-        $secret = openssl_decrypt($encryptedKey, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv);
-
-        return $secret;
-    }
-
-    /**
-     * @return string
-     */
-    private function getEncryptionKey()
-    {
-        return openssl_digest($this->configuration->getTotpEncryptionKey(), 'sha256');
-    }
+	/**
+	 * @var SiteConfiguration
+	 */
+	private $configuration;
+
+	/**
+	 * EncryptionHelper constructor.
+	 *
+	 * @param SiteConfiguration $configuration
+	 */
+	public function __construct(SiteConfiguration $configuration)
+	{
+		$this->configuration = $configuration;
+	}
+
+	public function encryptData($secret)
+	{
+		$iv = openssl_random_pseudo_bytes(16);
+		$password = $this->getEncryptionKey();
+		$encryptedKey = openssl_encrypt($secret, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv);
+
+		$data = base64_encode($iv) . '|' . base64_encode($encryptedKey);
+
+		return $data;
+	}
+
+	public function decryptData($data)
+	{
+		list($iv, $encryptedKey) = array_map('base64_decode', explode('|', $data));
+
+		$password = $this->getEncryptionKey();
+
+		$secret = openssl_decrypt($encryptedKey, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv);
+
+		return $secret;
+	}
+
+	/**
+	 * @return string
+	 */
+	private function getEncryptionKey()
+	{
+		return openssl_digest($this->configuration->getTotpEncryptionKey(), 'sha256');
+	}
 }
\ No newline at end of file

includes/Security/ContentSecurityPolicyManager.php

Indentation +85 added lines, -85 removed lines

@@ -12,100 +12,100 @@
 
 class ContentSecurityPolicyManager
 {
-    private $policy = [
-        'default-src'     => [],
-        'script-src'      => ['self', 'nonce'],
-        'script-src-elem' => ['self', 'nonce'],
-        'script-src-attr' => [],
-        'connect-src'     => ['self'],
-        'style-src'       => ['self'],
-        'style-src-elem'  => ['self'],
-        'style-src-attr'  => [],
-        'img-src'         => ['self', 'data:', 'https://upload.wikimedia.org', 'https://accounts-dev.wmflabs.org/'],
-        'font-src'        => ['self'],
-        'form-action'     => ['self', 'oauth'],
-        'frame-ancestors' => [],
-    ];
-    private $nonce = null;
-    private $reportOnly = false;
-    /**
-     * @var SiteConfiguration
-     */
-    private $configuration;
+	private $policy = [
+		'default-src'     => [],
+		'script-src'      => ['self', 'nonce'],
+		'script-src-elem' => ['self', 'nonce'],
+		'script-src-attr' => [],
+		'connect-src'     => ['self'],
+		'style-src'       => ['self'],
+		'style-src-elem'  => ['self'],
+		'style-src-attr'  => [],
+		'img-src'         => ['self', 'data:', 'https://upload.wikimedia.org', 'https://accounts-dev.wmflabs.org/'],
+		'font-src'        => ['self'],
+		'form-action'     => ['self', 'oauth'],
+		'frame-ancestors' => [],
+	];
+	private $nonce = null;
+	private $reportOnly = false;
+	/**
+	 * @var SiteConfiguration
+	 */
+	private $configuration;
 
-    /**
-     * ContentSecurityPolicyManager constructor.
-     *
-     * @param SiteConfiguration $configuration
-     */
-    public function __construct(SiteConfiguration $configuration)
-    {
-        $this->configuration = $configuration;
-    }
+	/**
+	 * ContentSecurityPolicyManager constructor.
+	 *
+	 * @param SiteConfiguration $configuration
+	 */
+	public function __construct(SiteConfiguration $configuration)
+	{
+		$this->configuration = $configuration;
+	}
 
-    public function getNonce()
-    {
-        if ($this->nonce === null) {
-            $this->nonce = base64_encode(openssl_random_pseudo_bytes(32));
-        }
+	public function getNonce()
+	{
+		if ($this->nonce === null) {
+			$this->nonce = base64_encode(openssl_random_pseudo_bytes(32));
+		}
 
-        return $this->nonce;
-    }
+		return $this->nonce;
+	}
 
-    public function getHeader(): string
-    {
-        $reportOnly = '';
-        if ($this->reportOnly) {
-            $reportOnly = '-Report-Only';
-        }
+	public function getHeader(): string
+	{
+		$reportOnly = '';
+		if ($this->reportOnly) {
+			$reportOnly = '-Report-Only';
+		}
 
-        $constructedPolicy = "Content-Security-Policy{$reportOnly}: ";
+		$constructedPolicy = "Content-Security-Policy{$reportOnly}: ";
 
-        foreach ($this->policy as $item => $values) {
-            $constructedPolicy .= $item . ' ';
-            $policyIsSet = false;
+		foreach ($this->policy as $item => $values) {
+			$constructedPolicy .= $item . ' ';
+			$policyIsSet = false;
 
-            if (count($values) > 0) {
-                foreach ($values as $value) {
-                    switch ($value) {
-                        case 'none':
-                        case 'self':
-                        case 'strict-dynamic':
-                            $policyIsSet = true;
-                            $constructedPolicy .= "'{$value}' ";
-                            break;
-                        case 'nonce':
-                            if ($this->nonce !== null) {
-                                $policyIsSet = true;
-                                $constructedPolicy .= "'nonce-{$this->nonce}' ";
-                            }
-                            break;
-                        case 'oauth':
-                            $policyIsSet = true;
-                            $constructedPolicy .= "{$this->configuration->getOauthMediaWikiCanonicalServer()} ";
-                            break;
-                        default:
-                            $policyIsSet = true;
-                            $constructedPolicy .= $value . ' ';
-                            break;
-                    }
-                }
+			if (count($values) > 0) {
+				foreach ($values as $value) {
+					switch ($value) {
+						case 'none':
+						case 'self':
+						case 'strict-dynamic':
+							$policyIsSet = true;
+							$constructedPolicy .= "'{$value}' ";
+							break;
+						case 'nonce':
+							if ($this->nonce !== null) {
+								$policyIsSet = true;
+								$constructedPolicy .= "'nonce-{$this->nonce}' ";
+							}
+							break;
+						case 'oauth':
+							$policyIsSet = true;
+							$constructedPolicy .= "{$this->configuration->getOauthMediaWikiCanonicalServer()} ";
+							break;
+						default:
+							$policyIsSet = true;
+							$constructedPolicy .= $value . ' ';
+							break;
+					}
+				}
 
-                if (!$policyIsSet) {
-                    $constructedPolicy .= "'none' ";
-                }
-            }
-            else {
-                $constructedPolicy .= "'none' ";
-            }
+				if (!$policyIsSet) {
+					$constructedPolicy .= "'none' ";
+				}
+			}
+			else {
+				$constructedPolicy .= "'none' ";
+			}
 
-            $constructedPolicy .= '; ';
-        }
+			$constructedPolicy .= '; ';
+		}
 
-        if ($this->configuration->getCspReportUri() !== null) {
-            $constructedPolicy .= 'report-uri ' . $this->configuration->getCspReportUri();
-        }
+		if ($this->configuration->getCspReportUri() !== null) {
+			$constructedPolicy .= 'report-uri ' . $this->configuration->getCspReportUri();
+		}
 
-        return $constructedPolicy;
-    }
+		return $constructedPolicy;
+	}
 }

Braces +1 added lines, -2 removed lines

@@ -94,8 +94,7 @@
                 if (!$policyIsSet) {
                     $constructedPolicy .= "'none' ";
                 }
-            }
-            else {
+            } else {
                 $constructedPolicy .= "'none' ";
             }
 

includes/Security/CredentialProviders/ScratchTokenCredentialProvider.php

Indentation +132 added lines, -132 removed lines

@@ -20,136 +20,136 @@
 
 class ScratchTokenCredentialProvider extends CredentialProviderBase
 {
-    /** @var EncryptionHelper */
-    private $encryptionHelper;
-    /** @var array the tokens generated in the last generation round. */
-    private $generatedTokens;
-
-    /**
-     * ScratchTokenCredentialProvider constructor.
-     *
-     * @param PdoDatabase       $database
-     * @param SiteConfiguration $configuration
-     */
-    public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
-    {
-        parent::__construct($database, $configuration, 'scratch');
-        $this->encryptionHelper = new EncryptionHelper($configuration);
-    }
-
-    /**
-     * Validates a user-provided credential
-     *
-     * @param User   $user The user to test the authentication against
-     * @param string $data The raw credential data to be validated
-     *
-     * @return bool
-     * @throws ApplicationLogicException|OptimisticLockFailedException
-     */
-    public function authenticate(User $user, $data)
-    {
-        if (is_array($data)) {
-            return false;
-        }
-
-        $storedData = $this->getCredentialData($user->getId());
-
-        if ($storedData === null) {
-            throw new ApplicationLogicException('Credential data not found');
-        }
-
-        $scratchTokens = unserialize($this->encryptionHelper->decryptData($storedData->getData()));
-
-        $usedToken = null;
-        foreach ($scratchTokens as $scratchToken) {
-            if (password_verify($data, $scratchToken)){
-                $usedToken = $scratchToken;
-                SessionAlert::quick("Hey, it looks like you used a scratch token to log in. Would you like to change your multi-factor authentication configuration?", 'alert-warning');
-                WebRequest::setPostLoginRedirect($this->getConfiguration()->getBaseUrl() . "/internal.php/multiFactor");
-                break;
-            }
-        }
-
-        if($usedToken === null) {
-            return false;
-        }
-
-        $scratchTokens = array_diff($scratchTokens, [$usedToken]);
-
-        $storedData->setData($this->encryptionHelper->encryptData(serialize($scratchTokens)));
-        $storedData->save();
-
-        return true;
-    }
-
-    /**
-     * @param User   $user   The user the credential belongs to
-     * @param int    $factor The factor this credential provides
-     * @param string $data   Unused.
-     *
-     * @throws OptimisticLockFailedException
-     */
-    public function setCredential(User $user, $factor, $data)
-    {
-        $plaintextScratch = array();
-        $storedScratch = array();
-        for ($i = 0; $i < 5; $i++) {
-            $token = Base32::encodeUpper(openssl_random_pseudo_bytes(10));
-            $plaintextScratch[] = $token;
-
-            $storedScratch[] = password_hash(
-                $token,
-                PasswordCredentialProvider::PASSWORD_ALGO,
-                array('cost' => PasswordCredentialProvider::PASSWORD_COST)
-            );
-        }
-
-        $storedData = $this->getCredentialData($user->getId(), null);
-
-        if ($storedData !== null) {
-            $storedData->delete();
-        }
-
-        $storedData = $this->createNewCredential($user);
-
-        $storedData->setData($this->encryptionHelper->encryptData(serialize($storedScratch)));
-        $storedData->setFactor($factor);
-        $storedData->setVersion(1);
-        $storedData->setPriority(9);
-
-        $storedData->save();
-        $this->generatedTokens = $plaintextScratch;
-    }
-
-    /**
-     * Gets the count of remaining valid tokens
-     *
-     * @param int $userId
-     *
-     * @return int
-     */
-    public function getRemaining($userId)
-    {
-        $storedData = $this->getCredentialData($userId);
-
-        if ($storedData === null) {
-            return 0;
-        }
-
-        $scratchTokens = unserialize($this->encryptionHelper->decryptData($storedData->getData()));
-
-        return count($scratchTokens);
-    }
-
-    /**
-     * @return array
-     */
-    public function getTokens()
-    {
-        if ($this->generatedTokens != null) {
-            return $this->generatedTokens;
-        }
-
-        return array();
-    }
+	/** @var EncryptionHelper */
+	private $encryptionHelper;
+	/** @var array the tokens generated in the last generation round. */
+	private $generatedTokens;
+
+	/**
+	 * ScratchTokenCredentialProvider constructor.
+	 *
+	 * @param PdoDatabase       $database
+	 * @param SiteConfiguration $configuration
+	 */
+	public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
+	{
+		parent::__construct($database, $configuration, 'scratch');
+		$this->encryptionHelper = new EncryptionHelper($configuration);
+	}
+
+	/**
+	 * Validates a user-provided credential
+	 *
+	 * @param User   $user The user to test the authentication against
+	 * @param string $data The raw credential data to be validated
+	 *
+	 * @return bool
+	 * @throws ApplicationLogicException|OptimisticLockFailedException
+	 */
+	public function authenticate(User $user, $data)
+	{
+		if (is_array($data)) {
+			return false;
+		}
+
+		$storedData = $this->getCredentialData($user->getId());
+
+		if ($storedData === null) {
+			throw new ApplicationLogicException('Credential data not found');
+		}
+
+		$scratchTokens = unserialize($this->encryptionHelper->decryptData($storedData->getData()));
+
+		$usedToken = null;
+		foreach ($scratchTokens as $scratchToken) {
+			if (password_verify($data, $scratchToken)){
+				$usedToken = $scratchToken;
+				SessionAlert::quick("Hey, it looks like you used a scratch token to log in. Would you like to change your multi-factor authentication configuration?", 'alert-warning');
+				WebRequest::setPostLoginRedirect($this->getConfiguration()->getBaseUrl() . "/internal.php/multiFactor");
+				break;
+			}
+		}
+
+		if($usedToken === null) {
+			return false;
+		}
+
+		$scratchTokens = array_diff($scratchTokens, [$usedToken]);
+
+		$storedData->setData($this->encryptionHelper->encryptData(serialize($scratchTokens)));
+		$storedData->save();
+
+		return true;
+	}
+
+	/**
+	 * @param User   $user   The user the credential belongs to
+	 * @param int    $factor The factor this credential provides
+	 * @param string $data   Unused.
+	 *
+	 * @throws OptimisticLockFailedException
+	 */
+	public function setCredential(User $user, $factor, $data)
+	{
+		$plaintextScratch = array();
+		$storedScratch = array();
+		for ($i = 0; $i < 5; $i++) {
+			$token = Base32::encodeUpper(openssl_random_pseudo_bytes(10));
+			$plaintextScratch[] = $token;
+
+			$storedScratch[] = password_hash(
+				$token,
+				PasswordCredentialProvider::PASSWORD_ALGO,
+				array('cost' => PasswordCredentialProvider::PASSWORD_COST)
+			);
+		}
+
+		$storedData = $this->getCredentialData($user->getId(), null);
+
+		if ($storedData !== null) {
+			$storedData->delete();
+		}
+
+		$storedData = $this->createNewCredential($user);
+
+		$storedData->setData($this->encryptionHelper->encryptData(serialize($storedScratch)));
+		$storedData->setFactor($factor);
+		$storedData->setVersion(1);
+		$storedData->setPriority(9);
+
+		$storedData->save();
+		$this->generatedTokens = $plaintextScratch;
+	}
+
+	/**
+	 * Gets the count of remaining valid tokens
+	 *
+	 * @param int $userId
+	 *
+	 * @return int
+	 */
+	public function getRemaining($userId)
+	{
+		$storedData = $this->getCredentialData($userId);
+
+		if ($storedData === null) {
+			return 0;
+		}
+
+		$scratchTokens = unserialize($this->encryptionHelper->decryptData($storedData->getData()));
+
+		return count($scratchTokens);
+	}
+
+	/**
+	 * @return array
+	 */
+	public function getTokens()
+	{
+		if ($this->generatedTokens != null) {
+			return $this->generatedTokens;
+		}
+
+		return array();
+	}
 }

Spacing +2 added lines, -2 removed lines

@@ -62,7 +62,7 @@ 
 
         $usedToken = null;
         foreach ($scratchTokens as $scratchToken) {
-            if (password_verify($data, $scratchToken)){
+            if (password_verify($data, $scratchToken)) {
                 $usedToken = $scratchToken;
                 SessionAlert::quick("Hey, it looks like you used a scratch token to log in. Would you like to change your multi-factor authentication configuration?", 'alert-warning');
                 WebRequest::setPostLoginRedirect($this->getConfiguration()->getBaseUrl() . "/internal.php/multiFactor");
@@ -70,7 +70,7 @@ 
             }
         }
 
-        if($usedToken === null) {
+        if ($usedToken === null) {
             return false;
         }
 

Braces +1 added lines, -1 removed lines

@@ -62,7 +62,7 @@
 
         $usedToken = null;
         foreach ($scratchTokens as $scratchToken) {
-            if (password_verify($data, $scratchToken)){
+            if (password_verify($data, $scratchToken)) {
                 $usedToken = $scratchToken;
                 SessionAlert::quick("Hey, it looks like you used a scratch token to log in. Would you like to change your multi-factor authentication configuration?", 'alert-warning');
                 WebRequest::setPostLoginRedirect($this->getConfiguration()->getBaseUrl() . "/internal.php/multiFactor");

includes/Security/CredentialProviders/U2FCredentialProvider.php

Indentation +127 added lines, -127 removed lines

@@ -20,131 +20,131 @@
 
 class U2FCredentialProvider extends CredentialProviderBase
 {
-    /** @var U2F */
-    private $u2f;
-
-    /**
-     * U2FCredentialProvider constructor.
-     *
-     * @param PdoDatabase       $database
-     * @param SiteConfiguration $configuration
-     */
-    public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
-    {
-        parent::__construct($database, $configuration, 'u2f');
-
-        $appId = 'https://' . WebRequest::httpHost();
-        $this->u2f = new U2F($appId);
-    }
-
-    /**
-     * Validates a user-provided credential
-     *
-     * @param User   $user The user to test the authentication against
-     * @param string $data The raw credential data to be validated
-     *
-     * @return bool
-     * @throws OptimisticLockFailedException
-     */
-    public function authenticate(User $user, $data)
-    {
-        if (!is_array($data)) {
-            return false;
-        }
-
-        list($authenticate, $request, $isU2F) = $data;
-
-        if ($isU2F !== 'u2f') {
-            return false;
-        }
-
-        $storedData = $this->getCredentialData($user->getId(), false);
-        $registrations = json_decode($storedData->getData());
-
-        try {
-            $updatedRegistration = $this->u2f->doAuthenticate($request, array($registrations), $authenticate);
-            $storedData->setData(json_encode($updatedRegistration));
-            $storedData->save();
-        }
-        catch (Error $ex) {
-            return false;
-        }
-
-        return true;
-    }
-
-    public function enable(User $user, $request, $u2fData)
-    {
-        $registrationData = $this->u2f->doRegister($request, $u2fData);
-
-        $storedData = $this->getCredentialData($user->getId(), true);
-
-        if ($storedData === null) {
-            throw new ApplicationLogicException('Credential data not found');
-        }
-
-        if ($storedData->getTimeout() > new DateTimeImmutable()) {
-            $storedData->setData(json_encode($registrationData));
-            $storedData->setDisabled(0);
-            $storedData->setTimeout(null);
-            $storedData->save();
-        }
-    }
-
-    /**
-     * @param User   $user   The user the credential belongs to
-     * @param int    $factor The factor this credential provides
-     * @param string $data   Unused here, due to multi-stage enrollment
-     */
-    public function setCredential(User $user, $factor, $data)
-    {
-        $storedData = $this->getCredentialData($user->getId(), null);
-
-        if ($storedData !== null) {
-            $storedData->delete();
-        }
-
-        $storedData = $this->createNewCredential($user);
-
-        $storedData->setData(null);
-        $storedData->setFactor($factor);
-        $storedData->setTimeout(new DateTimeImmutable('+ 1 hour'));
-        $storedData->setDisabled(1);
-        $storedData->setPriority(4);
-        $storedData->setVersion(1);
-
-        $storedData->save();
-    }
-
-    public function isPartiallyEnrolled(User $user)
-    {
-        $storedData = $this->getCredentialData($user->getId(), true);
-
-        if ($storedData->getTimeout() < new DateTimeImmutable()) {
-            $storedData->delete();
-
-            return false;
-        }
-
-        if ($storedData === null) {
-            return false;
-        }
-
-        return true;
-    }
-
-    public function getRegistrationData()
-    {
-        return $this->u2f->getRegisterData();
-    }
-
-    public function getAuthenticationData(User $user)
-    {
-        $storedData = $this->getCredentialData($user->getId(), false);
-        $registrations = json_decode($storedData->getData());
-
-        $authenticateData = $this->u2f->getAuthenticateData(array($registrations));
-
-        return $authenticateData;
-    }
+	/** @var U2F */
+	private $u2f;
+
+	/**
+	 * U2FCredentialProvider constructor.
+	 *
+	 * @param PdoDatabase       $database
+	 * @param SiteConfiguration $configuration
+	 */
+	public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
+	{
+		parent::__construct($database, $configuration, 'u2f');
+
+		$appId = 'https://' . WebRequest::httpHost();
+		$this->u2f = new U2F($appId);
+	}
+
+	/**
+	 * Validates a user-provided credential
+	 *
+	 * @param User   $user The user to test the authentication against
+	 * @param string $data The raw credential data to be validated
+	 *
+	 * @return bool
+	 * @throws OptimisticLockFailedException
+	 */
+	public function authenticate(User $user, $data)
+	{
+		if (!is_array($data)) {
+			return false;
+		}
+
+		list($authenticate, $request, $isU2F) = $data;
+
+		if ($isU2F !== 'u2f') {
+			return false;
+		}
+
+		$storedData = $this->getCredentialData($user->getId(), false);
+		$registrations = json_decode($storedData->getData());
+
+		try {
+			$updatedRegistration = $this->u2f->doAuthenticate($request, array($registrations), $authenticate);
+			$storedData->setData(json_encode($updatedRegistration));
+			$storedData->save();
+		}
+		catch (Error $ex) {
+			return false;
+		}
+
+		return true;
+	}
+
+	public function enable(User $user, $request, $u2fData)
+	{
+		$registrationData = $this->u2f->doRegister($request, $u2fData);
+
+		$storedData = $this->getCredentialData($user->getId(), true);
+
+		if ($storedData === null) {
+			throw new ApplicationLogicException('Credential data not found');
+		}
+
+		if ($storedData->getTimeout() > new DateTimeImmutable()) {
+			$storedData->setData(json_encode($registrationData));
+			$storedData->setDisabled(0);
+			$storedData->setTimeout(null);
+			$storedData->save();
+		}
+	}
+
+	/**
+	 * @param User   $user   The user the credential belongs to
+	 * @param int    $factor The factor this credential provides
+	 * @param string $data   Unused here, due to multi-stage enrollment
+	 */
+	public function setCredential(User $user, $factor, $data)
+	{
+		$storedData = $this->getCredentialData($user->getId(), null);
+
+		if ($storedData !== null) {
+			$storedData->delete();
+		}
+
+		$storedData = $this->createNewCredential($user);
+
+		$storedData->setData(null);
+		$storedData->setFactor($factor);
+		$storedData->setTimeout(new DateTimeImmutable('+ 1 hour'));
+		$storedData->setDisabled(1);
+		$storedData->setPriority(4);
+		$storedData->setVersion(1);
+
+		$storedData->save();
+	}
+
+	public function isPartiallyEnrolled(User $user)
+	{
+		$storedData = $this->getCredentialData($user->getId(), true);
+
+		if ($storedData->getTimeout() < new DateTimeImmutable()) {
+			$storedData->delete();
+
+			return false;
+		}
+
+		if ($storedData === null) {
+			return false;
+		}
+
+		return true;
+	}
+
+	public function getRegistrationData()
+	{
+		return $this->u2f->getRegisterData();
+	}
+
+	public function getAuthenticationData(User $user)
+	{
+		$storedData = $this->getCredentialData($user->getId(), false);
+		$registrations = json_decode($storedData->getData());
+
+		$authenticateData = $this->u2f->getAuthenticateData(array($registrations));
+
+		return $authenticateData;
+	}
 }