488 lines
13 KiB
PHP
488 lines
13 KiB
PHP
<?php
|
|
/**
|
|
* @brief Abstract Multi Factor Authentication Handler and Factory
|
|
* @author <a href='https://www.invisioncommunity.com'>Invision Power Services, Inc.</a>
|
|
* @copyright (c) Invision Power Services, Inc.
|
|
* @license https://www.invisioncommunity.com/legal/standards/
|
|
* @package Invision Community
|
|
* @since 26 Aug 2016
|
|
*/
|
|
|
|
namespace IPS\MFA;
|
|
|
|
/* To prevent PHP errors (extending class does not exist) revealing path */
|
|
|
|
use DateInterval;
|
|
use IPS\Application;
|
|
use IPS\DateTime;
|
|
use IPS\Db;
|
|
use IPS\Helpers\Form\YesNo;
|
|
use IPS\Http\Url;
|
|
use IPS\Member;
|
|
use IPS\MFA\Verify\Handler;
|
|
use IPS\Output;
|
|
use IPS\Request;
|
|
use IPS\Session;
|
|
use IPS\Settings;
|
|
use IPS\Theme;
|
|
use function count;
|
|
use function defined;
|
|
use function in_array;
|
|
use const IPS\DEV_FORCE_MFA;
|
|
use const IPS\DISABLE_MFA;
|
|
|
|
if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
|
|
{
|
|
header( ( $_SERVER['SERVER_PROTOCOL'] ?? 'HTTP/1.0' ) . ' 403 Forbidden' );
|
|
exit;
|
|
}
|
|
|
|
/**
|
|
* Abstract Multi Factor Authentication Handler and Factory
|
|
*/
|
|
abstract class MFAHandler
|
|
{
|
|
/* !Access Methods */
|
|
|
|
/**
|
|
* Get areas
|
|
*
|
|
* @return array
|
|
*/
|
|
public static function areas(): array
|
|
{
|
|
$return = array();
|
|
foreach ( Application::allExtensions( 'core', 'MFAArea', FALSE, 'core', NULL, FALSE ) as $k => $v )
|
|
{
|
|
$return[ $k ] = "MFA_{$k}";
|
|
}
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Get handlers
|
|
*
|
|
* @return array<MFAHandler>
|
|
*/
|
|
public static function handlers(): array
|
|
{
|
|
$return = array(
|
|
'authy' => new Authy\Handler(),
|
|
'google' => new GoogleAuthenticator\Handler(),
|
|
'questions' => new SecurityQuestions\Handler(),
|
|
'verify' => new Handler()
|
|
);
|
|
|
|
foreach( Application::allExtensions( 'core', 'MFAHandler', null, 'core' ) as $ext )
|
|
{
|
|
$return[ $ext::$key ] = $ext;
|
|
}
|
|
|
|
return $return;
|
|
}
|
|
|
|
/**
|
|
* Removes any previous authentication settings for this user
|
|
*
|
|
* @return void
|
|
*/
|
|
public static function resetAuthentication() : void
|
|
{
|
|
if ( isset( $_SESSION['MFAAuthenticated'] ) )
|
|
{
|
|
unset( $_SESSION['MFAAuthenticated'] );
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Display output when trying to access an area
|
|
*
|
|
* @param string $app The application which owns the MFAArea extension
|
|
* @param string $area The MFAArea key
|
|
* @param Url $url URL for page
|
|
* @param Member|null $member The member, or NULL for currently logged in member
|
|
* @return string|null
|
|
*/
|
|
public static function accessToArea( string $app, string $area, Url $url, ?Member $member = NULL ): ?string
|
|
{
|
|
$member = $member ?: Member::loggedIn();
|
|
|
|
/* Constant to disable MFA for emergency recovery */
|
|
if ( DISABLE_MFA )
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
/* If MFA is not enabled for this area, do nothing */
|
|
if ( !Settings::i()->security_questions_areas or !in_array( "{$app}_{$area}", explode( ',', Settings::i()->security_questions_areas ) ) )
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
/* Are we already authenticated? */
|
|
if ( !DEV_FORCE_MFA and ( isset( $_SESSION['MFAAuthenticated'] ) and ( !Settings::i()->security_questions_timer or ( ( $_SESSION['MFAAuthenticated'] + ( Settings::i()->security_questions_timer * 60 ) ) > time() ) ) ) )
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
/* "Opt Out" */
|
|
if ( Settings::i()->mfa_required_groups != '*' and !$member->inGroup( explode( ',', Settings::i()->mfa_required_groups ) ) )
|
|
{
|
|
if ( $member->members_bitoptions['security_questions_opt_out'] )
|
|
{
|
|
return NULL;
|
|
}
|
|
if ( isset( Request::i()->_mfa ) and Request::i()->_mfa == 'optout' )
|
|
{
|
|
Session::i()->csrfCheck();
|
|
|
|
$member->members_bitoptions['security_questions_opt_out'] = TRUE;
|
|
$member->save();
|
|
|
|
/* Log MFA Optout */
|
|
$member->logHistory( 'core', 'mfa', array( 'handler' => 'questions', 'enable' => FALSE, 'optout' => TRUE ) );
|
|
|
|
return NULL;
|
|
}
|
|
}
|
|
|
|
/* Gather all the one we *can* use */
|
|
$acceptableHandlers = array();
|
|
foreach ( static::handlers() as $key => $handler )
|
|
{
|
|
/* If it's enabled and we can use it... */
|
|
if ( $handler->isEnabled() and $handler->memberCanUseHandler( $member ) )
|
|
{
|
|
$acceptableHandlers[ $key ] = $handler;
|
|
}
|
|
}
|
|
if ( !$acceptableHandlers )
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
/* Locked out? */
|
|
if ( $lockedOutScreen = static::_lockedOutScreen( $member ) )
|
|
{
|
|
Output::i()->cssFiles = array_merge( Output::i()->cssFiles, Theme::i()->css( '2fa.css', 'core', 'global' ) );
|
|
return $lockedOutScreen;
|
|
}
|
|
|
|
/* "Try another way to sign in" */
|
|
if ( isset( Request::i()->_mfa ) )
|
|
{
|
|
Output::i()->cssFiles = array_merge( Output::i()->cssFiles, Theme::i()->css( '2fa.css', 'core', 'global' ) );
|
|
if ( Request::i()->_mfa == 'alt' )
|
|
{
|
|
/* What handlers have we configured? */
|
|
$configuredHandlers = array();
|
|
foreach ( $acceptableHandlers as $key => $handler )
|
|
{
|
|
if ( $handler->memberHasConfiguredHandler( $member ) )
|
|
{
|
|
$configuredHandlers[ $key ] = $handler;
|
|
}
|
|
}
|
|
|
|
if ( isset( Request::i()->_mfaMethod ) and array_key_exists( Request::i()->_mfaMethod, $configuredHandlers ) )
|
|
{
|
|
return static::_showHandlerAuthScreen( $configuredHandlers[ Request::i()->_mfaMethod ], $url->setQueryString( array( '_mfa' => 'alt', '_mfaMethod' => Request::i()->_mfaMethod ) ), $member );
|
|
}
|
|
|
|
/* Display */
|
|
$knownDevicesAvailable = FALSE;
|
|
if ( $app === 'core' and $area === 'AuthenticateFront' and !in_array( "app_AuthenticateFrontKnown", explode( ',', Settings::i()->security_questions_areas ) ) )
|
|
{
|
|
if ( Db::i()->select( 'COUNT(*)', 'core_members_known_devices', array( 'member_id=?', $member->member_id ) )->first() )
|
|
{
|
|
$knownDevicesAvailable = TRUE;
|
|
}
|
|
}
|
|
|
|
return Theme::i()->getTemplate( 'login', 'core', 'global' )->mfaRecovery( $configuredHandlers, $url, $knownDevicesAvailable );
|
|
}
|
|
elseif ( Request::i()->_mfa == 'knownDevice' )
|
|
{
|
|
return Theme::i()->getTemplate( 'system', 'core' )->mfaKnownDeviceInfo( $url );
|
|
}
|
|
}
|
|
|
|
/* Normal authentication form */
|
|
foreach ( $acceptableHandlers as $handler )
|
|
{
|
|
if ( $handler->memberHasConfiguredHandler( $member ) )
|
|
{
|
|
Output::i()->cssFiles = array_merge( Output::i()->cssFiles, Theme::i()->css( '2fa.css', 'core', 'global' ) );
|
|
return static::_showHandlerAuthScreen( $handler, $url, $member );
|
|
}
|
|
}
|
|
|
|
/* Setup form */
|
|
$showSetupForm = ( Settings::i()->mfa_required_groups == '*' or $member->inGroup( explode( ',', Settings::i()->mfa_required_groups ) ) ) ? 'mfa_required_prompt' : 'mfa_optional_prompt';
|
|
if ( Settings::i()->$showSetupForm === 'access' or ( $app === 'core' and $area === 'AuthenticateAdmin' and Settings::i()->$showSetupForm === 'immediate' ) )
|
|
{
|
|
Output::i()->cssFiles = array_merge( Output::i()->cssFiles, Theme::i()->css( '2fa.css', 'core', 'global' ) );
|
|
|
|
/* Did we just submit it? */
|
|
if ( isset( Request::i()->mfa_setup ) and isset( Request::i()->csrfKey ) )
|
|
{
|
|
Session::i()->csrfCheck();
|
|
foreach ( $acceptableHandlers as $key => $handler )
|
|
{
|
|
if ( ( count( $acceptableHandlers ) == 1 ) or $key == Request::i()->mfa_method )
|
|
{
|
|
if ( $handler->configurationScreenSubmit( $member ) )
|
|
{
|
|
$_SESSION['MFAAuthenticated'] = time();
|
|
return NULL;
|
|
}
|
|
elseif ( $lockedOutScreen = static::_lockedOutScreen( $member ) )
|
|
{
|
|
return $lockedOutScreen;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/* No, show it */
|
|
return Theme::i()->getTemplate( 'login', 'core', 'global' )->mfaSetup( $acceptableHandlers, $member, $url );
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
/**
|
|
* Show a handler's authentication screen
|
|
*
|
|
* @param MFAHandler $handler The handler to use
|
|
* @param Url $url URL for page
|
|
* @param Member $member The member
|
|
* @return string|null
|
|
*/
|
|
protected static function _showHandlerAuthScreen( MFAHandler $handler, Url $url, Member $member ): ?string
|
|
{
|
|
/* Did we just submit it? */
|
|
if ( isset( Request::i()->mfa_auth ) )
|
|
{
|
|
Session::i()->csrfCheck();
|
|
if ( $handler->authenticationScreenSubmit( $member ) )
|
|
{
|
|
$member->failed_mfa_attempts = 0;
|
|
$member->save();
|
|
$_SESSION['MFAAuthenticated'] = time();
|
|
return NULL;
|
|
}
|
|
else
|
|
{
|
|
$member->failed_mfa_attempts++;
|
|
$member->save();
|
|
|
|
Request::i()->mfa_auth = NULL;
|
|
}
|
|
}
|
|
|
|
/* No, show it */
|
|
return Theme::i()->getTemplate( 'login', 'core', 'global' )->mfaAuthenticate( $handler->authenticationScreen( $member, $url ), $url );
|
|
}
|
|
|
|
/**
|
|
* Show the locked out screen, if necessary
|
|
*
|
|
* @param Member $member The member
|
|
* @return string|null
|
|
*/
|
|
protected static function _lockedOutScreen( Member $member ): ?string
|
|
{
|
|
if ( $member->failed_mfa_attempts >= Settings::i()->security_questions_tries )
|
|
{
|
|
if ( Settings::i()->mfa_lockout_behaviour == 'lock' )
|
|
{
|
|
$mfaDetails = $member->mfa_details;
|
|
if ( !isset( $mfaDetails['_lockouttime'] ) )
|
|
{
|
|
$mfaDetails['_lockouttime'] = time();
|
|
$member->mfa_details = $mfaDetails;
|
|
$member->save();
|
|
|
|
$member->logHistory( 'core', 'login', array( 'type' => 'mfalock', 'count' => $member->failed_mfa_attempts, 'unlockTime' => DateTime::create()->add( new DateInterval( 'PT' . Settings::i()->mfa_lockout_time . 'M' ) )->getTimestamp() ) );
|
|
}
|
|
|
|
$lockEndTime = DateTime::ts( $mfaDetails['_lockouttime'] )->add( new DateInterval( 'PT' . Settings::i()->mfa_lockout_time . 'M' ) );
|
|
if ( $lockEndTime->getTimestamp() < time() )
|
|
{
|
|
unset( $mfaDetails['_lockouttime'] );
|
|
$member->mfa_details = $mfaDetails;
|
|
$member->failed_mfa_attempts = 0;
|
|
$member->save();
|
|
}
|
|
else
|
|
{
|
|
return Theme::i()->getTemplate( 'login', 'core', 'global' )->mfaLockout( ( Settings::i()->mfa_lockout_time > 1440 ) ? $lockEndTime : $lockEndTime->localeTime( FALSE ) );
|
|
}
|
|
}
|
|
else
|
|
{
|
|
if ( $member->failed_mfa_attempts == Settings::i()->security_questions_tries )
|
|
{
|
|
$member->logHistory( 'core', 'login', array( 'type' => 'mfalock', 'count' => $member->failed_mfa_attempts ) );
|
|
}
|
|
return Theme::i()->getTemplate( 'login', 'core', 'global' )->mfaLockout();
|
|
}
|
|
}
|
|
|
|
return NULL;
|
|
}
|
|
|
|
/* !Setup */
|
|
|
|
/**
|
|
* Handler is enabled
|
|
*
|
|
* @return bool
|
|
*/
|
|
abstract public function isEnabled(): bool;
|
|
|
|
/**
|
|
* Member *can* use this handler (even if they have not yet configured it)
|
|
*
|
|
* @param Member $member The member
|
|
* @return bool
|
|
*/
|
|
abstract public function memberCanUseHandler( Member $member ): bool;
|
|
|
|
/**
|
|
* Member has configured this handler
|
|
*
|
|
* @param Member $member The member
|
|
* @return bool
|
|
*/
|
|
abstract public function memberHasConfiguredHandler( Member $member ): bool;
|
|
|
|
/**
|
|
* Show a setup screen
|
|
*
|
|
* @param Member $member The member
|
|
* @param bool $showingMultipleHandlers Set to TRUE if multiple options are being displayed
|
|
* @param Url $url URL for page
|
|
* @return string
|
|
*/
|
|
abstract public function configurationScreen( Member $member, bool $showingMultipleHandlers, Url $url ): string;
|
|
|
|
/**
|
|
* Submit configuration screen. Return TRUE if was accepted
|
|
*
|
|
* @param Member $member The member
|
|
* @return bool
|
|
*/
|
|
abstract public function configurationScreenSubmit( Member $member ): bool;
|
|
|
|
/* !Authentication */
|
|
|
|
/**
|
|
* Get the form for a member to authenticate
|
|
*
|
|
* @param Member $member The member
|
|
* @param Url $url URL for page
|
|
* @return string
|
|
*/
|
|
abstract public function authenticationScreen( Member $member, Url $url ): string;
|
|
|
|
/**
|
|
* Submit authentication screen. Return TRUE if was accepted
|
|
*
|
|
* @param Member $member The member
|
|
* @return bool
|
|
*/
|
|
abstract public function authenticationScreenSubmit( Member $member ): bool;
|
|
|
|
/* !ACP */
|
|
|
|
/**
|
|
* Toggle
|
|
*
|
|
* @param bool $enabled On/Off
|
|
* @return void
|
|
*/
|
|
abstract public function toggle( bool $enabled ) : void;
|
|
|
|
/**
|
|
* ACP Settings
|
|
*
|
|
* @return string
|
|
*/
|
|
abstract public function acpSettings(): string;
|
|
|
|
/**
|
|
* Configuration options when editing member account in ACP
|
|
*
|
|
* @param Member $member The member
|
|
* @return array
|
|
*/
|
|
public function acpConfiguration( Member $member ): array
|
|
{
|
|
if ( $this->memberHasConfiguredHandler( $member ) )
|
|
{
|
|
return array( new YesNo( "mfa_{$this->key}_title", $this->memberHasConfiguredHandler( $member ), FALSE, array(), NULL, NULL, NULL, "mfa_{$this->key}_title" ) );
|
|
}
|
|
return array();
|
|
}
|
|
|
|
/**
|
|
* Save configuration when editing member account in ACP
|
|
*
|
|
* @param Member $member The member
|
|
* @param array $values Values from form
|
|
* @return void
|
|
*/
|
|
public function acpConfigurationSave(Member $member, array $values ) : void
|
|
{
|
|
if ( isset( $values["mfa_{$this->key}_title"] ) and !$values["mfa_{$this->key}_title"] )
|
|
{
|
|
if ( isset( $member->mfa_details[ $this->key ] ) and $this->memberHasConfiguredHandler( $member ) )
|
|
{
|
|
$this->disableHandlerForMember( $member );
|
|
}
|
|
}
|
|
}
|
|
|
|
/* !Misc */
|
|
|
|
/**
|
|
* If member has configured this handler, disable it
|
|
*
|
|
* @param Member $member The member
|
|
* @return void
|
|
*/
|
|
abstract public function disableHandlerForMember( Member $member ) : void;
|
|
|
|
/**
|
|
* Get title for UCP
|
|
*
|
|
* @return string
|
|
*/
|
|
public function ucpTitle(): string
|
|
{
|
|
return Member::loggedIn()->language()->addToStack("mfa_{$this->key}_title");
|
|
}
|
|
|
|
/**
|
|
* Get description for UCP
|
|
*
|
|
* @return string
|
|
*/
|
|
public function ucpDesc(): string
|
|
{
|
|
return Member::loggedIn()->language()->addToStack("mfa_{$this->key}_desc_user");
|
|
}
|
|
|
|
/**
|
|
* Get label for recovery button
|
|
*
|
|
* @return string
|
|
*/
|
|
public function recoveryButton(): string
|
|
{
|
|
return Member::loggedIn()->language()->addToStack("mfa_recovery_{$this->key}");
|
|
}
|
|
|
|
} |