janis/ma
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adding 2fa

Browse Source
This commit is contained in:
jakani24
2024-06-06 16:21:36 +02:00
parent 0ac75a0f45
commit 2fa388d441
2 changed files with 87 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

78
src/server/cyberhex-code/system/insecure_zone/php/2fa.php Normal file
View File

@@ -0,0 +1,78 @@
<?php
session_start();
if(isset($_SESSION["login"])){
header("LOCATION:/system/secure_zone/php/index.php");
}
if(!isset($_SESSION["2fa_auth"])){ //so only someone who has allready confirmed his passwd can get here
header("LOCATION:/system/insecure_zone/php/login.php");
exit();
}
include "../../../api/php/notifications/sendmessage.php"; //to send user notification on login
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">
<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js" integrity="sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM" crossorigin="anonymous"></script>
<title>Cyberhex login page</title>
<style>
.bg-image {
background-image: url('/logo.png');
background-size: contain;
background-repeat: no-repeat;
background-position: center;
height: 100vh; /* Set height to viewport height */
}
</style>
</head>
<body>
<div class="container-fluid bg-image">
<div class="container mt-5">
<div class="row justify-content-center">
<div class="col-md-6">
<div class="card">
<div class="card-header">
<h4>Login to Cyberhex using second factor</h4>
</div>
<div class="card-body">
<form action="login.php" method="post">
<div class="form-group">
<label for="pin">2FA-Pin (sent to you via Telegram):</label>
<input type="text" class="form-control" id="pin" name="pin" required>
</div>
</form>
<!-- php code to verify 2fa pin-->
<?php
// Check if the form is submitted
if ($_SERVER["REQUEST_METHOD"] == "POST") {
//include db pw
include "../../../config.php";
// Retrieve user input
$pin = htmlspecialchars($_POST["pin"]);
if($pin==$_SESSION["pin"])
{
$_SESSION["login"]=true;
if($_SESSION["send_login_message"]=="1"){
$ip = $_SERVER['REMOTE_ADDR'];
$username=$row["username"];
send_to_user("[LOGIN WARNING]\nHello $username\nSomebody has logged into Cyberhex with your account.\nIf this was you, you can ignore this message. Else please take steps to secure your account!\nIP: $ip\n",$username);
echo '<script>window.location.href = "/system/secure_zone/php/index.php";</script>';
}
}else {
echo '<div class="alert alert-danger" role="alert">
Incorrect pin.
</div>';
}
}
?>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>

9
src/server/cyberhex-code/system/insecure_zone/php/login.php
View File

@@ -305,6 +305,15 @@ async function checkRegistration() {
$_SESSION["allow_pw_login"]=$row["allow_pw_login"];
$_SESSION["send_login_message"]=$row["send_login_message"];
$_SESSION["use_2fa"]=$row["use_2fa"];
if($_SESSION["use_2fa"]=="1"){
$_SESSION["login"]=false; //set the login state to false
$_SESSION["2fa_auth"]=true;
$pin=mt_rand(100000, 999999);
$_SESSION["pin"]=$pin;
send_to_user("[2FA-Pin]\nHello $username\nHere is your pin to log into cyberhex: $pin. If you did not try to log in please take steps to secure your account!\nIP: $ip\n",$username);
//send the user to 2fa auth page
echo '<script>window.location.href = "/system/insecure_zone/php/2fa.php";</script>';
}
if($_SESSION["send_login_message"]=="1"){
$ip = $_SERVER['REMOTE_ADDR'];