Passed
Push — dependabot/npm_and_yarn/sass-1... ( dd05dd )
by
unknown
05:21
created
includes/Router/IRequestRouter.php 1 patch
Indentation   +5 added lines, -5 removed lines patch added patch discarded remove patch
@@ -18,9 +18,9 @@
 block discarded – undo
18 18
  */
19 19
 interface IRequestRouter
20 20
 {
21
-    /**
22
-     * @return IRoutedTask
23
-     * @throws Exception
24
-     */
25
-    public function route();
21
+	/**
22
+	 * @return IRoutedTask
23
+	 * @throws Exception
24
+	 */
25
+	public function route();
26 26
 }
27 27
\ No newline at end of file
Please login to merge, or discard this patch.
smarty-plugins/modifier.iphex.php 1 patch
Indentation   +10 added lines, -10 removed lines patch added patch discarded remove patch
@@ -13,17 +13,17 @@
 block discarded – undo
13 13
  */
14 14
 function smarty_modifier_iphex($input)
15 15
 {
16
-    $output = $input;
16
+	$output = $input;
17 17
 
18
-    if (filter_var($input, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false) {
19
-        $octets = explode('.', $input);
20
-        $output = '';
21
-        foreach ($octets as $octet) {
22
-            $output .= str_pad(dechex($octet), 2, '0', STR_PAD_LEFT);
23
-        }
18
+	if (filter_var($input, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false) {
19
+		$octets = explode('.', $input);
20
+		$output = '';
21
+		foreach ($octets as $octet) {
22
+			$output .= str_pad(dechex($octet), 2, '0', STR_PAD_LEFT);
23
+		}
24 24
 
25
-        $output = str_pad($output, 32, '0', STR_PAD_LEFT);
26
-    }
25
+		$output = str_pad($output, 32, '0', STR_PAD_LEFT);
26
+	}
27 27
 
28
-    return $output;
28
+	return $output;
29 29
 }
Please login to merge, or discard this patch.
smarty-plugins/modifier.demodhex.php 1 patch
Indentation   +5 added lines, -5 removed lines patch added patch discarded remove patch
@@ -13,10 +13,10 @@
 block discarded – undo
13 13
  */
14 14
 function smarty_modifier_demodhex($input)
15 15
 {
16
-    $hex = preg_replace(
17
-        array('/c/', '/b/', '/d/', '/e/', '/f/', '/g/', '/h/', '/i/', '/j/', '/k/', '/l/', '/n/', '/r/', '/t/', '/u/', '/v/'),
18
-        array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'),
19
-        $input);
16
+	$hex = preg_replace(
17
+		array('/c/', '/b/', '/d/', '/e/', '/f/', '/g/', '/h/', '/i/', '/j/', '/k/', '/l/', '/n/', '/r/', '/t/', '/u/', '/v/'),
18
+		array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'),
19
+		$input);
20 20
 
21
-    return hexdec($hex);
21
+	return hexdec($hex);
22 22
 }
23 23
\ No newline at end of file
Please login to merge, or discard this patch.
includes/Security/EncryptionHelper.php 1 patch
Indentation   +44 added lines, -44 removed lines patch added patch discarded remove patch
@@ -12,48 +12,48 @@
 block discarded – undo
12 12
 
13 13
 class EncryptionHelper
14 14
 {
15
-    /**
16
-     * @var SiteConfiguration
17
-     */
18
-    private $configuration;
19
-
20
-    /**
21
-     * EncryptionHelper constructor.
22
-     *
23
-     * @param SiteConfiguration $configuration
24
-     */
25
-    public function __construct(SiteConfiguration $configuration)
26
-    {
27
-        $this->configuration = $configuration;
28
-    }
29
-
30
-    public function encryptData($secret)
31
-    {
32
-        $iv = openssl_random_pseudo_bytes(16);
33
-        $password = $this->getEncryptionKey();
34
-        $encryptedKey = openssl_encrypt($secret, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv);
35
-
36
-        $data = base64_encode($iv) . '|' . base64_encode($encryptedKey);
37
-
38
-        return $data;
39
-    }
40
-
41
-    public function decryptData($data)
42
-    {
43
-        list($iv, $encryptedKey) = array_map('base64_decode', explode('|', $data));
44
-
45
-        $password = $this->getEncryptionKey();
46
-
47
-        $secret = openssl_decrypt($encryptedKey, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv);
48
-
49
-        return $secret;
50
-    }
51
-
52
-    /**
53
-     * @return string
54
-     */
55
-    private function getEncryptionKey()
56
-    {
57
-        return openssl_digest($this->configuration->getTotpEncryptionKey(), 'sha256');
58
-    }
15
+	/**
16
+	 * @var SiteConfiguration
17
+	 */
18
+	private $configuration;
19
+
20
+	/**
21
+	 * EncryptionHelper constructor.
22
+	 *
23
+	 * @param SiteConfiguration $configuration
24
+	 */
25
+	public function __construct(SiteConfiguration $configuration)
26
+	{
27
+		$this->configuration = $configuration;
28
+	}
29
+
30
+	public function encryptData($secret)
31
+	{
32
+		$iv = openssl_random_pseudo_bytes(16);
33
+		$password = $this->getEncryptionKey();
34
+		$encryptedKey = openssl_encrypt($secret, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv);
35
+
36
+		$data = base64_encode($iv) . '|' . base64_encode($encryptedKey);
37
+
38
+		return $data;
39
+	}
40
+
41
+	public function decryptData($data)
42
+	{
43
+		list($iv, $encryptedKey) = array_map('base64_decode', explode('|', $data));
44
+
45
+		$password = $this->getEncryptionKey();
46
+
47
+		$secret = openssl_decrypt($encryptedKey, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv);
48
+
49
+		return $secret;
50
+	}
51
+
52
+	/**
53
+	 * @return string
54
+	 */
55
+	private function getEncryptionKey()
56
+	{
57
+		return openssl_digest($this->configuration->getTotpEncryptionKey(), 'sha256');
58
+	}
59 59
 }
60 60
\ No newline at end of file
Please login to merge, or discard this patch.
includes/Security/CredentialProviders/TotpCredentialProvider.php 1 patch
Indentation   +130 added lines, -130 removed lines patch added patch discarded remove patch
@@ -19,137 +19,137 @@
 block discarded – undo
19 19
 
20 20
 class TotpCredentialProvider extends CredentialProviderBase
21 21
 {
22
-    /** @var EncryptionHelper */
23
-    private $encryptionHelper;
24
-
25
-    /**
26
-     * TotpCredentialProvider constructor.
27
-     *
28
-     * @param PdoDatabase       $database
29
-     * @param SiteConfiguration $configuration
30
-     */
31
-    public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
32
-    {
33
-        parent::__construct($database, $configuration, 'totp');
34
-        $this->encryptionHelper = new EncryptionHelper($configuration);
35
-    }
36
-
37
-    /**
38
-     * Validates a user-provided credential
39
-     *
40
-     * @param User   $user The user to test the authentication against
41
-     * @param string $data The raw credential data to be validated
42
-     *
43
-     * @return bool
44
-     * @throws ApplicationLogicException
45
-     */
46
-    public function authenticate(User $user, $data)
47
-    {
48
-        if (is_array($data)) {
49
-            return false;
50
-        }
51
-
52
-        $storedData = $this->getCredentialData($user->getId());
53
-
54
-        if ($storedData === null) {
55
-            throw new ApplicationLogicException('Credential data not found');
56
-        }
57
-
58
-        $provisioningUrl = $this->encryptionHelper->decryptData($storedData->getData());
59
-        $totp = Factory::loadFromProvisioningUri($provisioningUrl);
60
-
61
-        return $totp->verify($data, null, 2);
62
-    }
63
-
64
-    public function verifyEnable(User $user, $data)
65
-    {
66
-        $storedData = $this->getCredentialData($user->getId(), true);
67
-
68
-        if ($storedData === null) {
69
-            throw new ApplicationLogicException('Credential data not found');
70
-        }
71
-
72
-        $provisioningUrl = $this->encryptionHelper->decryptData($storedData->getData());
73
-        $totp = Factory::loadFromProvisioningUri($provisioningUrl);
74
-
75
-        $result = $totp->verify($data, null, 2);
76
-
77
-        if ($result && $storedData->getTimeout() > new DateTimeImmutable()) {
78
-            $storedData->setDisabled(0);
79
-            $storedData->setPriority(5);
80
-            $storedData->setTimeout(null);
81
-            $storedData->save();
82
-        }
83
-
84
-        return $result;
85
-    }
86
-
87
-    /**
88
-     * @param User   $user   The user the credential belongs to
89
-     * @param int    $factor The factor this credential provides
90
-     * @param string $data   Unused here, due to there being no user-provided data. We provide the user with the secret.
91
-     */
92
-    public function setCredential(User $user, $factor, $data)
93
-    {
94
-        $issuer = 'ACC - ' . $this->getConfiguration()->getIrcNotificationsInstance();
95
-        $totp = TOTP::create();
96
-        $totp->setLabel($user->getUsername());
97
-        $totp->setIssuer($issuer);
98
-
99
-        $storedData = $this->getCredentialData($user->getId(), null);
100
-
101
-        if ($storedData !== null) {
102
-            $storedData->delete();
103
-        }
104
-
105
-        $storedData = $this->createNewCredential($user);
106
-
107
-        $storedData->setData($this->encryptionHelper->encryptData($totp->getProvisioningUri()));
108
-        $storedData->setFactor($factor);
109
-        $storedData->setTimeout(new DateTimeImmutable('+ 1 hour'));
110
-        $storedData->setDisabled(1);
111
-        $storedData->setVersion(1);
112
-
113
-        $storedData->save();
114
-    }
115
-
116
-    public function getProvisioningUrl(User $user)
117
-    {
118
-        $storedData = $this->getCredentialData($user->getId(), true);
119
-
120
-        if ($storedData->getTimeout() < new DateTimeImmutable()) {
121
-            $storedData->delete();
122
-            $storedData = null;
123
-        }
124
-
125
-        if ($storedData === null) {
126
-            throw new ApplicationLogicException('Credential data not found');
127
-        }
128
-
129
-        return $this->encryptionHelper->decryptData($storedData->getData());
130
-    }
131
-
132
-    public function isPartiallyEnrolled(User $user)
133
-    {
134
-        $storedData = $this->getCredentialData($user->getId(), true);
135
-
136
-        if ($storedData->getTimeout() < new DateTimeImmutable()) {
137
-            $storedData->delete();
138
-
139
-            return false;
140
-        }
141
-
142
-        if ($storedData === null) {
143
-            return false;
144
-        }
22
+	/** @var EncryptionHelper */
23
+	private $encryptionHelper;
24
+
25
+	/**
26
+	 * TotpCredentialProvider constructor.
27
+	 *
28
+	 * @param PdoDatabase       $database
29
+	 * @param SiteConfiguration $configuration
30
+	 */
31
+	public function __construct(PdoDatabase $database, SiteConfiguration $configuration)
32
+	{
33
+		parent::__construct($database, $configuration, 'totp');
34
+		$this->encryptionHelper = new EncryptionHelper($configuration);
35
+	}
36
+
37
+	/**
38
+	 * Validates a user-provided credential
39
+	 *
40
+	 * @param User   $user The user to test the authentication against
41
+	 * @param string $data The raw credential data to be validated
42
+	 *
43
+	 * @return bool
44
+	 * @throws ApplicationLogicException
45
+	 */
46
+	public function authenticate(User $user, $data)
47
+	{
48
+		if (is_array($data)) {
49
+			return false;
50
+		}
51
+
52
+		$storedData = $this->getCredentialData($user->getId());
53
+
54
+		if ($storedData === null) {
55
+			throw new ApplicationLogicException('Credential data not found');
56
+		}
57
+
58
+		$provisioningUrl = $this->encryptionHelper->decryptData($storedData->getData());
59
+		$totp = Factory::loadFromProvisioningUri($provisioningUrl);
60
+
61
+		return $totp->verify($data, null, 2);
62
+	}
63
+
64
+	public function verifyEnable(User $user, $data)
65
+	{
66
+		$storedData = $this->getCredentialData($user->getId(), true);
67
+
68
+		if ($storedData === null) {
69
+			throw new ApplicationLogicException('Credential data not found');
70
+		}
71
+
72
+		$provisioningUrl = $this->encryptionHelper->decryptData($storedData->getData());
73
+		$totp = Factory::loadFromProvisioningUri($provisioningUrl);
74
+
75
+		$result = $totp->verify($data, null, 2);
76
+
77
+		if ($result && $storedData->getTimeout() > new DateTimeImmutable()) {
78
+			$storedData->setDisabled(0);
79
+			$storedData->setPriority(5);
80
+			$storedData->setTimeout(null);
81
+			$storedData->save();
82
+		}
83
+
84
+		return $result;
85
+	}
86
+
87
+	/**
88
+	 * @param User   $user   The user the credential belongs to
89
+	 * @param int    $factor The factor this credential provides
90
+	 * @param string $data   Unused here, due to there being no user-provided data. We provide the user with the secret.
91
+	 */
92
+	public function setCredential(User $user, $factor, $data)
93
+	{
94
+		$issuer = 'ACC - ' . $this->getConfiguration()->getIrcNotificationsInstance();
95
+		$totp = TOTP::create();
96
+		$totp->setLabel($user->getUsername());
97
+		$totp->setIssuer($issuer);
98
+
99
+		$storedData = $this->getCredentialData($user->getId(), null);
100
+
101
+		if ($storedData !== null) {
102
+			$storedData->delete();
103
+		}
104
+
105
+		$storedData = $this->createNewCredential($user);
106
+
107
+		$storedData->setData($this->encryptionHelper->encryptData($totp->getProvisioningUri()));
108
+		$storedData->setFactor($factor);
109
+		$storedData->setTimeout(new DateTimeImmutable('+ 1 hour'));
110
+		$storedData->setDisabled(1);
111
+		$storedData->setVersion(1);
112
+
113
+		$storedData->save();
114
+	}
115
+
116
+	public function getProvisioningUrl(User $user)
117
+	{
118
+		$storedData = $this->getCredentialData($user->getId(), true);
119
+
120
+		if ($storedData->getTimeout() < new DateTimeImmutable()) {
121
+			$storedData->delete();
122
+			$storedData = null;
123
+		}
124
+
125
+		if ($storedData === null) {
126
+			throw new ApplicationLogicException('Credential data not found');
127
+		}
128
+
129
+		return $this->encryptionHelper->decryptData($storedData->getData());
130
+	}
131
+
132
+	public function isPartiallyEnrolled(User $user)
133
+	{
134
+		$storedData = $this->getCredentialData($user->getId(), true);
135
+
136
+		if ($storedData->getTimeout() < new DateTimeImmutable()) {
137
+			$storedData->delete();
138
+
139
+			return false;
140
+		}
141
+
142
+		if ($storedData === null) {
143
+			return false;
144
+		}
145 145
 
146
-        return true;
147
-    }
146
+		return true;
147
+	}
148 148
 
149
-    public function getSecret(User $user)
150
-    {
151
-        $totp = Factory::loadFromProvisioningUri($this->getProvisioningUrl($user));
149
+	public function getSecret(User $user)
150
+	{
151
+		$totp = Factory::loadFromProvisioningUri($this->getProvisioningUrl($user));
152 152
 
153
-        return $totp->getSecret();
154
-    }
153
+		return $totp->getSecret();
154
+	}
155 155
 }
Please login to merge, or discard this patch.
includes/Security/CredentialProviders/ICredentialProvider.php 1 patch
Indentation   +25 added lines, -25 removed lines patch added patch discarded remove patch
@@ -12,32 +12,32 @@
 block discarded – undo
12 12
 
13 13
 interface ICredentialProvider
14 14
 {
15
-    /**
16
-     * Validates a user-provided credential
17
-     *
18
-     * @param User $user The user to test the authentication against
19
-     * @param string $data The raw credential data to be validated
20
-     *
21
-     * @return bool
22
-     */
23
-    public function authenticate(User $user, $data);
15
+	/**
16
+	 * Validates a user-provided credential
17
+	 *
18
+	 * @param User $user The user to test the authentication against
19
+	 * @param string $data The raw credential data to be validated
20
+	 *
21
+	 * @return bool
22
+	 */
23
+	public function authenticate(User $user, $data);
24 24
 
25
-    /**
26
-     * @param User $user The user the credential belongs to
27
-     * @param int $factor The factor this credential provides
28
-     * @param string $data
29
-     */
30
-    public function setCredential(User $user, $factor, $data);
25
+	/**
26
+	 * @param User $user The user the credential belongs to
27
+	 * @param int $factor The factor this credential provides
28
+	 * @param string $data
29
+	 */
30
+	public function setCredential(User $user, $factor, $data);
31 31
 
32
-    /**
33
-     * @param User $user
34
-     */
35
-    public function deleteCredential(User $user);
32
+	/**
33
+	 * @param User $user
34
+	 */
35
+	public function deleteCredential(User $user);
36 36
 
37
-    /**
38
-     * @param int $userId
39
-     *
40
-     * @return bool
41
-     */
42
-    public function userIsEnrolled($userId);
37
+	/**
38
+	 * @param int $userId
39
+	 *
40
+	 * @return bool
41
+	 */
42
+	public function userIsEnrolled($userId);
43 43
 }
44 44
\ No newline at end of file
Please login to merge, or discard this patch.
includes/Security/CredentialProviders/YubikeyOtpCredentialProvider.php 1 patch
Indentation   +150 added lines, -150 removed lines patch added patch discarded remove patch
@@ -16,154 +16,154 @@
 block discarded – undo
16 16
 
17 17
 class YubikeyOtpCredentialProvider extends CredentialProviderBase
18 18
 {
19
-    /** @var HttpHelper */
20
-    private $httpHelper;
21
-    /**
22
-     * @var SiteConfiguration
23
-     */
24
-    private $configuration;
25
-
26
-    public function __construct(PdoDatabase $database, SiteConfiguration $configuration, HttpHelper $httpHelper)
27
-    {
28
-        parent::__construct($database, $configuration, 'yubikeyotp');
29
-        $this->httpHelper = $httpHelper;
30
-        $this->configuration = $configuration;
31
-    }
32
-
33
-    public function authenticate(User $user, $data)
34
-    {
35
-        if (is_array($data)) {
36
-            return false;
37
-        }
38
-
39
-        $credentialData = $this->getCredentialData($user->getId());
40
-
41
-        if ($credentialData === null) {
42
-            return false;
43
-        }
44
-
45
-        if ($credentialData->getData() !== $this->getYubikeyId($data)) {
46
-            // different device
47
-            return false;
48
-        }
49
-
50
-        return $this->verifyToken($data);
51
-    }
52
-
53
-    public function setCredential(User $user, $factor, $data)
54
-    {
55
-        $keyId = $this->getYubikeyId($data);
56
-        $valid = $this->verifyToken($data);
57
-
58
-        if (!$valid) {
59
-            throw new ApplicationLogicException("Provided token is not valid.");
60
-        }
61
-
62
-        $storedData = $this->getCredentialData($user->getId());
63
-
64
-        if ($storedData === null) {
65
-            $storedData = $this->createNewCredential($user);
66
-        }
67
-
68
-        $storedData->setData($keyId);
69
-        $storedData->setFactor($factor);
70
-        $storedData->setVersion(1);
71
-        $storedData->setPriority(8);
72
-
73
-        $storedData->save();
74
-    }
75
-
76
-    /**
77
-     * Get the Yubikey ID.
78
-     *
79
-     * This looks like it's just dumping the "password" that's stored in the database, but it's actually fine.
80
-     *
81
-     * We only store the "serial number" of the Yubikey - if we get a validated (by webservice) token prefixed with the
82
-     * serial number, that's a successful OTP authentication. Thus, retrieving the stored data is just retrieving the
83
-     * yubikey's serial number (in modhex format), since the actual security credentials are stored on the device.
84
-     *
85
-     * Note that the serial number is actually the credential serial number - it's possible to regenerate the keys on
86
-     * the device, and that will change the serial number too.
87
-     *
88
-     * More information about the structure of OTPs can be found here:
89
-     * https://developers.yubico.com/OTP/OTPs_Explained.html
90
-     *
91
-     * @param int $userId
92
-     *
93
-     * @return null|string
94
-     */
95
-    public function getYubikeyData($userId)
96
-    {
97
-        $credential = $this->getCredentialData($userId);
98
-
99
-        if ($credential === null) {
100
-            return null;
101
-        }
102
-
103
-        return $credential->getData();
104
-    }
105
-
106
-    /**
107
-     * @param $result
108
-     *
109
-     * @return array
110
-     */
111
-    private function parseYubicoApiResult($result)
112
-    {
113
-        $data = array();
114
-        foreach (explode("\r\n", $result) as $line) {
115
-            $pos = strpos($line, '=');
116
-            if ($pos === false) {
117
-                continue;
118
-            }
119
-
120
-            $data[substr($line, 0, $pos)] = substr($line, $pos + 1);
121
-        }
122
-
123
-        return $data;
124
-    }
125
-
126
-    private function getYubikeyId($data)
127
-    {
128
-        return substr($data, 0, -32);
129
-    }
130
-
131
-    private function verifyHmac($apiResponse, $apiKey)
132
-    {
133
-        ksort($apiResponse);
134
-        $signature = $apiResponse['h'];
135
-        unset($apiResponse['h']);
136
-
137
-        $data = array();
138
-        foreach ($apiResponse as $key => $value) {
139
-            $data[] = $key . "=" . $value;
140
-        }
141
-        $dataString = implode('&', $data);
142
-
143
-        $hmac = base64_encode(hash_hmac('sha1', $dataString, base64_decode($apiKey), true));
144
-
145
-        return $hmac === $signature;
146
-    }
147
-
148
-    /**
149
-     * @param $data
150
-     *
151
-     * @return bool
152
-     */
153
-    private function verifyToken($data)
154
-    {
155
-        $result = $this->httpHelper->get('https://api.yubico.com/wsapi/2.0/verify', array(
156
-            'id'    => $this->configuration->getYubicoApiId(),
157
-            'otp'   => $data,
158
-            'nonce' => md5(openssl_random_pseudo_bytes(64)),
159
-        ));
160
-
161
-        $apiResponse = $this->parseYubicoApiResult($result);
162
-
163
-        if (!$this->verifyHmac($apiResponse, $this->configuration->getYubicoApiKey())) {
164
-            return false;
165
-        }
166
-
167
-        return $apiResponse['status'] == 'OK';
168
-    }
19
+	/** @var HttpHelper */
20
+	private $httpHelper;
21
+	/**
22
+	 * @var SiteConfiguration
23
+	 */
24
+	private $configuration;
25
+
26
+	public function __construct(PdoDatabase $database, SiteConfiguration $configuration, HttpHelper $httpHelper)
27
+	{
28
+		parent::__construct($database, $configuration, 'yubikeyotp');
29
+		$this->httpHelper = $httpHelper;
30
+		$this->configuration = $configuration;
31
+	}
32
+
33
+	public function authenticate(User $user, $data)
34
+	{
35
+		if (is_array($data)) {
36
+			return false;
37
+		}
38
+
39
+		$credentialData = $this->getCredentialData($user->getId());
40
+
41
+		if ($credentialData === null) {
42
+			return false;
43
+		}
44
+
45
+		if ($credentialData->getData() !== $this->getYubikeyId($data)) {
46
+			// different device
47
+			return false;
48
+		}
49
+
50
+		return $this->verifyToken($data);
51
+	}
52
+
53
+	public function setCredential(User $user, $factor, $data)
54
+	{
55
+		$keyId = $this->getYubikeyId($data);
56
+		$valid = $this->verifyToken($data);
57
+
58
+		if (!$valid) {
59
+			throw new ApplicationLogicException("Provided token is not valid.");
60
+		}
61
+
62
+		$storedData = $this->getCredentialData($user->getId());
63
+
64
+		if ($storedData === null) {
65
+			$storedData = $this->createNewCredential($user);
66
+		}
67
+
68
+		$storedData->setData($keyId);
69
+		$storedData->setFactor($factor);
70
+		$storedData->setVersion(1);
71
+		$storedData->setPriority(8);
72
+
73
+		$storedData->save();
74
+	}
75
+
76
+	/**
77
+	 * Get the Yubikey ID.
78
+	 *
79
+	 * This looks like it's just dumping the "password" that's stored in the database, but it's actually fine.
80
+	 *
81
+	 * We only store the "serial number" of the Yubikey - if we get a validated (by webservice) token prefixed with the
82
+	 * serial number, that's a successful OTP authentication. Thus, retrieving the stored data is just retrieving the
83
+	 * yubikey's serial number (in modhex format), since the actual security credentials are stored on the device.
84
+	 *
85
+	 * Note that the serial number is actually the credential serial number - it's possible to regenerate the keys on
86
+	 * the device, and that will change the serial number too.
87
+	 *
88
+	 * More information about the structure of OTPs can be found here:
89
+	 * https://developers.yubico.com/OTP/OTPs_Explained.html
90
+	 *
91
+	 * @param int $userId
92
+	 *
93
+	 * @return null|string
94
+	 */
95
+	public function getYubikeyData($userId)
96
+	{
97
+		$credential = $this->getCredentialData($userId);
98
+
99
+		if ($credential === null) {
100
+			return null;
101
+		}
102
+
103
+		return $credential->getData();
104
+	}
105
+
106
+	/**
107
+	 * @param $result
108
+	 *
109
+	 * @return array
110
+	 */
111
+	private function parseYubicoApiResult($result)
112
+	{
113
+		$data = array();
114
+		foreach (explode("\r\n", $result) as $line) {
115
+			$pos = strpos($line, '=');
116
+			if ($pos === false) {
117
+				continue;
118
+			}
119
+
120
+			$data[substr($line, 0, $pos)] = substr($line, $pos + 1);
121
+		}
122
+
123
+		return $data;
124
+	}
125
+
126
+	private function getYubikeyId($data)
127
+	{
128
+		return substr($data, 0, -32);
129
+	}
130
+
131
+	private function verifyHmac($apiResponse, $apiKey)
132
+	{
133
+		ksort($apiResponse);
134
+		$signature = $apiResponse['h'];
135
+		unset($apiResponse['h']);
136
+
137
+		$data = array();
138
+		foreach ($apiResponse as $key => $value) {
139
+			$data[] = $key . "=" . $value;
140
+		}
141
+		$dataString = implode('&', $data);
142
+
143
+		$hmac = base64_encode(hash_hmac('sha1', $dataString, base64_decode($apiKey), true));
144
+
145
+		return $hmac === $signature;
146
+	}
147
+
148
+	/**
149
+	 * @param $data
150
+	 *
151
+	 * @return bool
152
+	 */
153
+	private function verifyToken($data)
154
+	{
155
+		$result = $this->httpHelper->get('https://api.yubico.com/wsapi/2.0/verify', array(
156
+			'id'    => $this->configuration->getYubicoApiId(),
157
+			'otp'   => $data,
158
+			'nonce' => md5(openssl_random_pseudo_bytes(64)),
159
+		));
160
+
161
+		$apiResponse = $this->parseYubicoApiResult($result);
162
+
163
+		if (!$this->verifyHmac($apiResponse, $this->configuration->getYubicoApiKey())) {
164
+			return false;
165
+		}
166
+
167
+		return $apiResponse['status'] == 'OK';
168
+	}
169 169
 }
Please login to merge, or discard this patch.
includes/Providers/GlobalState/GlobalStateProvider.php 1 patch
Indentation   +35 added lines, -35 removed lines patch added patch discarded remove patch
@@ -18,43 +18,43 @@
 block discarded – undo
18 18
  */
19 19
 class GlobalStateProvider implements IGlobalStateProvider
20 20
 {
21
-    /**
22
-     * @return array
23
-     */
24
-    public function &getServerSuperGlobal()
25
-    {
26
-        return $_SERVER;
27
-    }
21
+	/**
22
+	 * @return array
23
+	 */
24
+	public function &getServerSuperGlobal()
25
+	{
26
+		return $_SERVER;
27
+	}
28 28
 
29
-    /**
30
-     * @return array
31
-     */
32
-    public function &getGetSuperGlobal()
33
-    {
34
-        return $_GET;
35
-    }
29
+	/**
30
+	 * @return array
31
+	 */
32
+	public function &getGetSuperGlobal()
33
+	{
34
+		return $_GET;
35
+	}
36 36
 
37
-    /**
38
-     * @return array
39
-     */
40
-    public function &getPostSuperGlobal()
41
-    {
42
-        return $_POST;
43
-    }
37
+	/**
38
+	 * @return array
39
+	 */
40
+	public function &getPostSuperGlobal()
41
+	{
42
+		return $_POST;
43
+	}
44 44
 
45
-    /**
46
-     * @return array
47
-     */
48
-    public function &getSessionSuperGlobal()
49
-    {
50
-        return $_SESSION;
51
-    }
45
+	/**
46
+	 * @return array
47
+	 */
48
+	public function &getSessionSuperGlobal()
49
+	{
50
+		return $_SESSION;
51
+	}
52 52
 
53
-    /**
54
-     * @return array
55
-     */
56
-    public function &getCookieSuperGlobal()
57
-    {
58
-        return $_COOKIE;
59
-    }
53
+	/**
54
+	 * @return array
55
+	 */
56
+	public function &getCookieSuperGlobal()
57
+	{
58
+		return $_COOKIE;
59
+	}
60 60
 }
61 61
\ No newline at end of file
Please login to merge, or discard this patch.
includes/Providers/GlobalState/IGlobalStateProvider.php 1 patch
Indentation   +20 added lines, -20 removed lines patch added patch discarded remove patch
@@ -14,28 +14,28 @@
 block discarded – undo
14 14
  */
15 15
 interface IGlobalStateProvider
16 16
 {
17
-    /**
18
-     * @return array
19
-     */
20
-    public function getServerSuperGlobal();
17
+	/**
18
+	 * @return array
19
+	 */
20
+	public function getServerSuperGlobal();
21 21
 
22
-    /**
23
-     * @return array
24
-     */
25
-    public function getGetSuperGlobal();
22
+	/**
23
+	 * @return array
24
+	 */
25
+	public function getGetSuperGlobal();
26 26
 
27
-    /**
28
-     * @return array
29
-     */
30
-    public function getPostSuperGlobal();
27
+	/**
28
+	 * @return array
29
+	 */
30
+	public function getPostSuperGlobal();
31 31
 
32
-    /**
33
-     * @return array
34
-     */
35
-    public function getSessionSuperGlobal();
32
+	/**
33
+	 * @return array
34
+	 */
35
+	public function getSessionSuperGlobal();
36 36
 
37
-    /**
38
-     * @return array
39
-     */
40
-    public function getCookieSuperGlobal();
37
+	/**
38
+	 * @return array
39
+	 */
40
+	public function getCookieSuperGlobal();
41 41
 }
42 42
\ No newline at end of file
Please login to merge, or discard this patch.