diff --git a/src/server/cyberhex-code/system/insecure_zone/php/2fa.php b/src/server/cyberhex-code/system/insecure_zone/php/2fa.php new file mode 100644 index 0000000..bb63fab --- /dev/null +++ b/src/server/cyberhex-code/system/insecure_zone/php/2fa.php @@ -0,0 +1,78 @@ + + + + + + + + Cyberhex login page + + + +
+
+
+
+
+
+

Login to Cyberhex using second factor

+
+
+
+
+ + +
+
+ + window.location.href = "/system/secure_zone/php/index.php";'; + } + }else { + echo ''; + } + } + ?> + +
+
+
+
+
+
+ + diff --git a/src/server/cyberhex-code/system/insecure_zone/php/login.php b/src/server/cyberhex-code/system/insecure_zone/php/login.php index 957f0f1..e20f6dd 100644 --- a/src/server/cyberhex-code/system/insecure_zone/php/login.php +++ b/src/server/cyberhex-code/system/insecure_zone/php/login.php @@ -305,6 +305,15 @@ async function checkRegistration() { $_SESSION["allow_pw_login"]=$row["allow_pw_login"]; $_SESSION["send_login_message"]=$row["send_login_message"]; $_SESSION["use_2fa"]=$row["use_2fa"]; + if($_SESSION["use_2fa"]=="1"){ + $_SESSION["login"]=false; //set the login state to false + $_SESSION["2fa_auth"]=true; + $pin=mt_rand(100000, 999999); + $_SESSION["pin"]=$pin; + send_to_user("[2FA-Pin]\nHello $username\nHere is your pin to log into cyberhex: $pin. If you did not try to log in please take steps to secure your account!\nIP: $ip\n",$username); + //send the user to 2fa auth page + echo ''; + } if($_SESSION["send_login_message"]=="1"){ $ip = $_SERVER['REMOTE_ADDR'];