fixed various issues around how google auth'er wants to see urls.

diff --git a/example/index.php b/example/index.php
index 1699691..78caa96 100644 (file)
--- a/example/index.php
+++ b/example/index.php
@@ -1,6 +1,14 @@
 <?php
 
 require_once("../lib/lib.php");
+if(isset($_REQUEST["action"])) {
+       switch($_REQUEST["action"]) {
+               case "destroy":
+                       unlink("/tmp/gaexpage.db");
+                       break;
+       }
+}
+
 
 $ga = new GoogleAuthenticator("/tmp/gaexpage.db");
 ?>
@@ -13,14 +21,17 @@ if(isset($_REQUEST["action"])) {
                case "createuser":
                        $username = $_REQUEST["username"];
                        $pr = preg_match('/^[a-zA-Z0-9@\.]+$/',"$username");
+                       $ttype = $_REQUEST["ttype"];
                        echo "<hr>";
                        if(strlen($username)<3) {
                                echo "<font color=\"red\">Sorry, username must be at least 3 chars</font>";
                        } else if($pr<1) {
                                echo "<font color=\"red\">Sorry, username can only contain a-z, A-Z, 0-9 @ and .</font>";
                        } else {
-                               $url = $ga->setupUser($username);
-                               echo "QRCode for user \"$username\" is <img src=\"http://chart.apis.google.com/chart?cht=qr&chl=$url&chs=120x120\"> or type in $url (actually its just the code on the end of the url)";
+                               $key = $ga->setupUser($username, $ttype);
+                               $keyinhex = $ga->helperb322hex($key);
+                               $url = urlencode($ga->createURL($username, $key, $ttype));
+                               echo "QRCode for user \"$username\" is <img src=\"http://chart.apis.google.com/chart?cht=qr&chl=$url&chs=120x120\"> or type in $key (google authenticator) or $keyinhex (for most other otp's)";
                        }
                        echo "<hr>";
                        break;
@@ -43,9 +54,6 @@ if(isset($_REQUEST["action"])) {
                                echo "<font color=\"red\">Failed!</font>";
                        }
                        break;
-               case "destroy":
-                       unlink("/tmp/gaexpage.db");
-                       break;
                default:
                        // do nothing
        }
@@ -57,7 +65,7 @@ if(isset($_REQUEST["action"])) {
 <h2>Create a User:</h2>
 <form method="post" action="index.php?action=createuser">
 Username: <input type="text" name="username"><br>
-Type (ignored for now): <select name="ttype"><option value="HOTP">HOTP</option><option value="TOTP">TOTP</option></select><br>
+Type: <select name="ttype"><option value="HOTP">HOTP</option><option value="TOTP">TOTP</option></select><br>
 <input type="submit" name="go" value="go"><br>
 </form>
 <hr>

diff --git a/lib/lib.php b/lib/lib.php
index 60ceaa7..8967ffe 100644 (file)
--- a/lib/lib.php
+++ b/lib/lib.php
@@ -43,28 +43,12 @@ class GoogleAuthenticator {
        // creates "user" in the database and returns a url for
        // the phone. If user already exists, this returns false
        // if any error occurs, this returns false
-       function setupUser($username) {
+       function setupUser($username, $tokentype="HOTP") {
                $key = $this->createBase32Key();
                
                // sql for inserting into db
-               $sql = "select * from users where user_name='$username'";
-               $res = $this->dbConnector->query($sql);
-
-               //if($res->fetchCount()>0) {
-                       //$this->errorText = "User Already Exists, $username";
-                       //return false;
-               //}
-               
-               // and finally create 'em
-               $hkey = $this->helperb322hex($key);
-               error_log("key for user $username is $hkey, $key");
-               $this->dbConnector->query("insert into tokens values (NULL, '$hkey', 'HOTP','0')");
-               $id = $this->dbConnector->lastInsertID();
-               $this->dbConnector->query("insert into users values (NULL, '$username', '$id')");
-
-               $url = $this->createURL($username, $key);
-               
-               return $url;
+               $key = $this->createUser($username, $key, $tokentype);
+               return $key;
        }
        
        
@@ -74,7 +58,7 @@ class GoogleAuthenticator {
                $i = 0;
                $ar = array();
                foreach($res as $row) {
-                       error_log("user: ".$row["user_name"]);
+                       //error_log("user: ".$row["user_name"]);
                        $ar[$i] = $row["user_name"];
                        $i++;
                }
@@ -107,7 +91,7 @@ class GoogleAuthenticator {
        
        
        // create "user" with insert
-       function createUser($username, $key) {
+       function createUser($username, $key, $ttype="HOTP") {
                // sql for inserting into db
                $sql = "select * from users where user_name='$username'";
                $res = $this->dbConnector->query($sql);
@@ -119,13 +103,11 @@ class GoogleAuthenticator {
                
                // and finally create 'em
                $hkey = $this->helperb322hex($key);
-               $this->dbConnector->query("insert into tokens values (NULL, '$hkey', 'HOTP', '0')");
+               $this->dbConnector->query("insert into tokens values (NULL, '$hkey', '$ttype', '0')");
                $id = $this->dbConnector->lastInsertID();
                $this->dbConnector->query("insert into users values (NULL, '$username', '$id')");
 
-               $url = $this->createURL($username, $key);
-               
-               return $url;
+               return $key;
        }
        
        // Replcate "user" in the database... All this really
@@ -246,7 +228,7 @@ class GoogleAuthenticator {
                                $en = $tlid+20;
                                for($i=$st; $i<$en; $i++) {
                                        $stest = $this->oath_hotp($tkey, $i);
-                                       //echo "code: $code, $stest, $tkey\n";
+                                       error_log("code: $code, $stest, $tkey, $tid");
                                        if($code == $stest) {
                                                $sql = "update tokens set token_lastid='$i' where token_id='$tid'";
                                                $this->dbConnector->query($sql);
@@ -256,6 +238,19 @@ class GoogleAuthenticator {
                                return false;
                                break;
                        case "TOTP":
+                               $t_now = time();
+                               $t_ear = $t_now - 45;
+                               $t_lat = $t_now + 60;
+                               $t_st = ((int)($t_ear/30));
+                               $t_en = ((int)($t_lat/30));
+                               error_log("kmac: $t_now, $t_ear, $t_lat, $t_st, $t_en");
+                               for($i=$t_st; $i<=$t_en; $i++) {
+                                       $stest = $this->oath_hotp($tkey, $i);
+                                       error_log("code: $code, $stest, $tkey\n");
+                                       if($code == $stest) {
+                                               return true;
+                                       }
+                               }
                                break;
                        default:
                                echo "how the frig did i end up here?";
@@ -332,8 +327,14 @@ class GoogleAuthenticator {
        }
        
        // create a url compatibile with google authenticator.
-       function createURL($user, $key) {
-               $url = "otpauth://hotp/$user?secret=$key";
+       function createURL($user, $key,$toktype = "HOTP") {
+               // oddity in the google authenticator... hotp needs to be lowercase.
+               $toktype = strtolower($toktype);
+               if($toktype == "hotp") {
+                       $url = "otpauth://$toktype/$user?secret=$key&counter=1";
+               } else {
+                       $url = "otpauth://$toktype/$user?secret=$key";
+               }
                //echo "url: $url\n";
                return $url;
        }