OneBot: Leantime 改造版源码（BOM/Univer 表格/AI 接管/品牌替换等）

app/Domain/TwoFA/Controllers/Edit.php

@@ -0,0 +1,111 @@
+<?php
+
+namespace Leantime\Domain\TwoFA\Controllers;
+
+use Leantime\Core\Controller\Controller;
+use Leantime\Domain\TwoFA\Services\TwoFA as TwoFAService;
+use RobThree\Auth\TwoFactorAuthException;
+use Symfony\Component\HttpFoundation\Response;
+
+class Edit extends Controller
+{
+    private TwoFAService $twoFAService;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(TwoFAService $twoFAService): void
+    {
+        $this->twoFAService = $twoFAService;
+    }
+
+    /**
+     * Displays the 2FA setup/edit page.
+     *
+     * @param  array  $params  Request parameters
+     *
+     * @throws TwoFactorAuthException
+     */
+    public function get(array $params): Response
+    {
+        $this->assignSetupData();
+        $this->generateFormTokens();
+
+        return $this->tpl->display('twofa.edit');
+    }
+
+    /**
+     * Handles 2FA enable/disable actions.
+     *
+     * @param  array  $params  Request parameters
+     *
+     * @throws TwoFactorAuthException
+     */
+    public function post(array $params): Response
+    {
+        $userId = (int) session('userdata.id');
+
+        if (isset($_POST['disable'])) {
+            if ($this->isValidFormToken()) {
+                $this->twoFAService->disable2FA($userId);
+            } else {
+                $this->tpl->setNotification($this->language->__('notification.form_token_incorrect'), 'error');
+            }
+        }
+
+        if (isset($_POST['save'])) {
+            if (isset($_POST['secret'])) {
+                $this->twoFAService->saveSecret($userId, $_POST['secret']);
+            }
+
+            if (isset($_POST['secret'], $_POST['twoFACode'])) {
+                if ($this->twoFAService->verifyAndEnable($userId, $_POST['secret'], $_POST['twoFACode'])) {
+                    $this->tpl->setNotification($this->language->__('notification.twoFA_enabled_success'), 'success', 'twoFAenabled');
+                } else {
+                    $this->tpl->setNotification($this->language->__('notification.incorrect_twoFA_code'), 'error');
+                }
+            }
+        }
+
+        $this->assignSetupData();
+        $this->generateFormTokens();
+
+        return $this->tpl->display('twofa.edit');
+    }
+
+    /**
+     * Assigns the current 2FA setup state (secret, QR data, enabled flag) to the template.
+     *
+     * @throws TwoFactorAuthException
+     */
+    private function assignSetupData(): void
+    {
+        $setup = $this->twoFAService->getSetupData((int) session('userdata.id'));
+
+        $this->tpl->assign('secret', $setup['secret']);
+        $this->tpl->assign('twoFAEnabled', $setup['twoFAEnabled']);
+
+        if (! $setup['twoFAEnabled']) {
+            $this->tpl->assign('qrData', $setup['qrData']);
+        }
+    }
+
+    /**
+     * Validates the submitted CSRF form token against the session.
+     */
+    private function isValidFormToken(): bool
+    {
+        return isset($_POST[session('formTokenName')])
+            && $_POST[session('formTokenName')] == session('formTokenValue');
+    }
+
+    /**
+     * Generates CSRF form tokens for sensitive forms.
+     */
+    private function generateFormTokens(): void
+    {
+        $permittedChars = '0123456789abcdefghijklmnopqrstuvwxyz';
+        session(['formTokenName' => substr(str_shuffle($permittedChars), 0, 32)]);
+        session(['formTokenValue' => substr(str_shuffle($permittedChars), 0, 32)]);
+    }
+}

app/Domain/TwoFA/Controllers/Verify.php

@@ -0,0 +1,68 @@
+<?php
+
+namespace Leantime\Domain\TwoFA\Controllers;
+
+use Leantime\Core\Controller\Controller;
+use Leantime\Core\Controller\Frontcontroller as FrontcontrollerCore;
+use Leantime\Domain\Auth\Services\Auth as AuthService;
+use Symfony\Component\HttpFoundation\Response;
+
+class Verify extends Controller
+{
+    private AuthService $authService;
+
+    /**
+     * init - initialize private variables
+     *
+     * @params parameters or body of the request
+     */
+    public function init(AuthService $authService)
+    {
+        $this->authService = $authService;
+    }
+
+    /**
+     * get - handle get requests
+     *
+     * @params parameters or body of the request
+     */
+    public function get($params)
+    {
+        $redirectUrl = BASE_URL.'/dashboard/home';
+
+        if (isset($_GET['redirect'])) {
+            $redirectUrl = BASE_URL.urldecode($_GET['redirect']);
+        }
+
+        $this->tpl->assign('redirectUrl', $redirectUrl);
+
+        return $this->tpl->display('twofa.verify', 'entry');
+    }
+
+    public function post($params): Response
+    {
+
+        if (session()->exists('userdata') && $this->authService->use2FA()) {
+            if (isset($params['twoFA_code']) === true) {
+                $redirectUrl = filter_var($params['redirectUrl'], FILTER_SANITIZE_URL);
+
+                if ($this->authService->verify2FA($params['twoFA_code'])) {
+                    $this->authService->set2FAVerified();
+
+                    return FrontcontrollerCore::redirect($redirectUrl);
+                } else {
+                    $this->tpl->setNotification('notification.incorrect_twoFA_code', 'error');
+
+                    return FrontcontrollerCore::redirect(BASE_URL.'/twoFA/verify');
+                }
+            } else {
+                $this->tpl->setNotification('notification.incorrect_twoFA_code', 'error');
+
+                return FrontcontrollerCore::redirect(BASE_URL.'/twoFA/verify');
+            }
+        }
+
+        /** @todo make a 400 response page **/
+        return $this->tpl->display('error.400');
+    }
+}