From fd26ac6447a5c17ea654dcaa0a80a2a727ea4fe5 Mon Sep 17 00:00:00 2001 From: paulr Date: Tue, 7 Dec 2010 02:17:33 +1100 Subject: [PATCH] changed default token type to totp --- authserver/authd/authd.php | 24 +++++++++++------------- authserver/lib/lib.php | 11 ++++++++--- authserver/www/admin.php | 14 ++++++++++---- 3 files changed, 29 insertions(+), 20 deletions(-) diff --git a/authserver/authd/authd.php b/authserver/authd/authd.php index e0f7296..15416c0 100644 --- a/authserver/authd/authd.php +++ b/authserver/authd/authd.php @@ -2,11 +2,6 @@ // TODO: SO MUCH ERROR CHECKING ITS NOT FUNNY -if(file_exists("config.php")) { - require_once("config.php"); -} else { - // config file doesnt exist, we must abort sensibly -} // get out master library for ga4php require_once("../lib/lib.php"); @@ -47,7 +42,8 @@ if($pid == -1) { $otkid = $row["users_otk"]; } if($otkid!="") { - unlink("otks/$otkid.png"); + global $BASE_DIR; + unlink("$BASE_DIR/authserver/authd/otks/$otkid.png"); } $sql = "update users set users_tokendata='',users_otk='' where users_username='$username'"; @@ -106,13 +102,14 @@ if($pid == -1) { } else if($username != $msg["username"]) { msg_send($cl_queue, MSG_GET_OTK_PNG, false); } else { - $hand = fopen("otks/$otk.png", "rb"); - $data = fread($hand, filesize("otks/$otk.png")); + global $BASE_DIR; + $hand = fopen("$BASE_DIR/authserver/authd/otks/$otk.png", "rb"); + $data = fread($hand, filesize("$BASE_DIR/authserver/authd/otks/$otk.png")); fclose($hand); - unlink("otks/$otk.png"); + unlink("$BASE_DIR/authserver/authd/otks/$otk.png"); $sql = "update users set users_otk='' where users_username='$username'"; $dbo->query($sql); - error_log("senting otk, fsize: ".filesize("otks/$otk.png")." $otk "); + error_log("senting otk, fsize: ".filesize("$BASE_DIR/authserver/authd/otks/$otk.png")." $otk "); msg_send($cl_queue, MSG_GET_OTK_PNG, $data); } } @@ -123,8 +120,9 @@ if($pid == -1) { if(!isset($msg["username"])) { msg_send($cl_queue, MSG_ADD_USER_TOKEN, false); } else { + global $BASE_DIR; $username = $msg["username"]; - $tokentype="HOTP"; + $tokentype="TOTP"; if(isset($msg["tokentype"])) { $tokentype=$msg["tokentype"]; } @@ -136,9 +134,9 @@ if($pid == -1) { $myga->setUser($username, $tokentype, "", $hexkey); $url = $myga->createUrl($username); - mkdir("otks"); + if(!file_exists("$BASE_DIR/authserver/authd/otks")) mkdir("$BASE_DIR/authserver/authd/otks"); $otk = generateRandomString(); - system("qrencode -o otks/$otk.png $url"); + system("qrencode -o $BASE_DIR/authserver/authd/otks/$otk.png $url"); $sql = "update users set users_otk='$otk' where users_username='$username'"; $dbo = getDatabase(); diff --git a/authserver/lib/lib.php b/authserver/lib/lib.php index 02be059..52f09ca 100644 --- a/authserver/lib/lib.php +++ b/authserver/lib/lib.php @@ -17,6 +17,10 @@ define("MSG_GET_OTK_PNG", 10); define("MSG_GET_OTK_ID", 11); define("MSG_DELETE_USER_TOKEN", 12); +// BASE_DIR = +$BASE_DIR = realpath(dirname(__FILE__)."/../../"); +global $BASE_DIR; + // messy require_once(dirname(__FILE__)."/../../lib/ga4php.php"); @@ -35,15 +39,16 @@ function generateRandomString() function getDatabase() { $dbobject = false; - if(file_exists("gaasdata.sqlite")) { + global $BASE_DIR; + if(file_exists("$BASE_DIR/authserver/authd/gaasdata.sqlite")) { try { - $dbobject = new PDO("sqlite:gaasdata.sqlite"); + $dbobject = new PDO("sqlite:$BASE_DIR/authserver/authd/gaasdata.sqlite"); } catch(PDOException $exep) { error_log("execpt on db open"); } } else { try { - $dbobject = new PDO("sqlite:gaasdata.sqlite"); + $dbobject = new PDO("sqlite:$BASE_DIR/authserver/authd/gaasdata.sqlite"); } catch(PDOException $exep) { error_log("execpt on db open"); } diff --git a/authserver/www/admin.php b/authserver/www/admin.php index b35a227..5f2364d 100644 --- a/authserver/www/admin.php +++ b/authserver/www/admin.php @@ -36,6 +36,8 @@ On this page, you create users and manage their tokens and passwords. A few note and edit anyone, including you
  • OTK/One-Time-Keys are the QRcode for provisioning a GA token, it can only be viewed once and once viewed is deleted. If you need a new one, you need to delete the user and re-create. +
  • TOTP tokens are time based tokens that change every 30 seconds, HOTP tokens are event tokens +that change everytime they are used or generated Delete Password"; else $haspass = "No"; - if($user["hastoken"]) $hastoken = "Yes Re-Create (hotp) Re-Create (totp) Delete"; - else $hastoken = "No Create (hotp) Create (totp)"; - - if($user["otk"]!="") $otk = "Get"; + if($user["otk"]=="deleted") $otk = "OTK Was Not Picked Up"; + else if($user["otk"]!="") $otk = "Get"; else $otk = "Already Claimed"; + if($user["hastoken"]) $hastoken = "Yes Re-Create (HOTP) Re-Create (TOTP) Delete"; + else { + $hastoken = "No Create (HOTP) Create (TOTP)"; + if($user["otk"]!="deleted")$otk = "No Token Exists"; + } + $delete = "Delete"; echo ""; -- 1.7.0.4