112 lines
3.3 KiB
PHP
112 lines
3.3 KiB
PHP
<?php
|
|
|
|
namespace Leantime\Domain\TwoFA\Controllers;
|
|
|
|
use Leantime\Core\Controller\Controller;
|
|
use Leantime\Domain\TwoFA\Services\TwoFA as TwoFAService;
|
|
use RobThree\Auth\TwoFactorAuthException;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
class Edit extends Controller
|
|
{
|
|
private TwoFAService $twoFAService;
|
|
|
|
/**
|
|
* Initializes dependencies.
|
|
*/
|
|
public function init(TwoFAService $twoFAService): void
|
|
{
|
|
$this->twoFAService = $twoFAService;
|
|
}
|
|
|
|
/**
|
|
* Displays the 2FA setup/edit page.
|
|
*
|
|
* @param array $params Request parameters
|
|
*
|
|
* @throws TwoFactorAuthException
|
|
*/
|
|
public function get(array $params): Response
|
|
{
|
|
$this->assignSetupData();
|
|
$this->generateFormTokens();
|
|
|
|
return $this->tpl->display('twofa.edit');
|
|
}
|
|
|
|
/**
|
|
* Handles 2FA enable/disable actions.
|
|
*
|
|
* @param array $params Request parameters
|
|
*
|
|
* @throws TwoFactorAuthException
|
|
*/
|
|
public function post(array $params): Response
|
|
{
|
|
$userId = (int) session('userdata.id');
|
|
|
|
if (isset($_POST['disable'])) {
|
|
if ($this->isValidFormToken()) {
|
|
$this->twoFAService->disable2FA($userId);
|
|
} else {
|
|
$this->tpl->setNotification($this->language->__('notification.form_token_incorrect'), 'error');
|
|
}
|
|
}
|
|
|
|
if (isset($_POST['save'])) {
|
|
if (isset($_POST['secret'])) {
|
|
$this->twoFAService->saveSecret($userId, $_POST['secret']);
|
|
}
|
|
|
|
if (isset($_POST['secret'], $_POST['twoFACode'])) {
|
|
if ($this->twoFAService->verifyAndEnable($userId, $_POST['secret'], $_POST['twoFACode'])) {
|
|
$this->tpl->setNotification($this->language->__('notification.twoFA_enabled_success'), 'success', 'twoFAenabled');
|
|
} else {
|
|
$this->tpl->setNotification($this->language->__('notification.incorrect_twoFA_code'), 'error');
|
|
}
|
|
}
|
|
}
|
|
|
|
$this->assignSetupData();
|
|
$this->generateFormTokens();
|
|
|
|
return $this->tpl->display('twofa.edit');
|
|
}
|
|
|
|
/**
|
|
* Assigns the current 2FA setup state (secret, QR data, enabled flag) to the template.
|
|
*
|
|
* @throws TwoFactorAuthException
|
|
*/
|
|
private function assignSetupData(): void
|
|
{
|
|
$setup = $this->twoFAService->getSetupData((int) session('userdata.id'));
|
|
|
|
$this->tpl->assign('secret', $setup['secret']);
|
|
$this->tpl->assign('twoFAEnabled', $setup['twoFAEnabled']);
|
|
|
|
if (! $setup['twoFAEnabled']) {
|
|
$this->tpl->assign('qrData', $setup['qrData']);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Validates the submitted CSRF form token against the session.
|
|
*/
|
|
private function isValidFormToken(): bool
|
|
{
|
|
return isset($_POST[session('formTokenName')])
|
|
&& $_POST[session('formTokenName')] == session('formTokenValue');
|
|
}
|
|
|
|
/**
|
|
* Generates CSRF form tokens for sensitive forms.
|
|
*/
|
|
private function generateFormTokens(): void
|
|
{
|
|
$permittedChars = '0123456789abcdefghijklmnopqrstuvwxyz';
|
|
session(['formTokenName' => substr(str_shuffle($permittedChars), 0, 32)]);
|
|
session(['formTokenValue' => substr(str_shuffle($permittedChars), 0, 32)]);
|
|
}
|
|
}
|