Subversion Repositories oidplus

Rev

Rev 784 | Rev 801 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed

Rev Author Line No. Line
709 daniel-mar 1 
<?php
2 
 
3 
/*
4 
 * OIDplus 2.0
5 
 * Copyright 2019 - 2021 Daniel Marschall, ViaThinkSoft
6 
 *
7 
 * Licensed under the Apache License, Version 2.0 (the "License");
8 
 * you may not use this file except in compliance with the License.
9 
 * You may obtain a copy of the License at
10 
 *
11 
 *     http://www.apache.org/licenses/LICENSE-2.0
12 
 *
13 
 * Unless required by applicable law or agreed to in writing, software
14 
 * distributed under the License is distributed on an "AS IS" BASIS,
15 
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 
 * See the License for the specific language governing permissions and
17 
 * limitations under the License.
18 
 */
19 
 
20 
if (!defined('INSIDE_OIDPLUS')) die();
21 
 
22 
class OIDplusCaptchaPluginVtsClientChallenge extends OIDplusCaptchaPlugin {
23 
 
24 
        public static function id(): string {
25 
                return 'ViaThinkSoft Client Challenge';
26 
        }
27 
 
28 
        public static function isVisible(): bool {
29 
                return false;
30 
        }
31 
 
32 
        public function csrfUnlock($actionID) {
33 
                if ($actionID == 'get_challenge') {
34 
                        return true;
35 
                }
36 
                return false;
37 
        }
38 
 
39 
        public function action($actionID, $params) {
40 
                if ($actionID == 'get_challenge') {
41 
                        $complexity=500000; // TODO: make configurable
42 
                        $server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
43 
 
44 
                        $min = 0;
45 
                        $max = $complexity;
46 
                        $starttime = time();
47 
                        $random = rand($min,$max); // TODO: cryptographic rand
48 
                        $ip_target = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown';
49 
                        $challenge = sha3_512($starttime.'/'.$ip_target.'/'.$random);
50 
                        $challenge_integrity = sha3_512_hmac($challenge,$server_secret);
51 
                        $send_to_client = array($starttime, $ip_target, $challenge, $min, $max, $challenge_integrity);
52 
 
53 
                        return array("status" => 0, "challenge" => $send_to_client);
54 
                }
55 
        }
56 
 
57 
        public function captchaDomHead() {
58 
                // Here you can add styles and scripts to be included into the HTML <head> part
59 
                return '<script>
60 
                function oidplus_captcha_response() {
61 
                        return OIDplusCaptchaPluginVtsClientChallenge.captchaResponse();
62 
                }
63 
                function oidplus_captcha_reset() {
64 
                        return OIDplusCaptchaPluginVtsClientChallenge.captchaReset(true);
65 
                }
66 
                </script>
67 
 
784 daniel-mar 68 
                <script src="'.(OIDplus::webPath() . 'vendor/components/jquery/jquery.min.js').'"></script>
69 
                <script src="'.(OIDplus::webPath() . 'vendor/emn178/js-sha3/src/sha3.js').'"></script>
800 daniel-mar 70 
                <script src="'.(OIDplus::webpath(__DIR__,true) . 'OIDplusCaptchaPluginVtsClientChallenge.js').'"></script>
709 daniel-mar 71 
                '; // we include OIDplusCaptchaPluginVtsClientChallenge.js not via manifest.xml, otherwise oobe.php would not work
72 
        }
73 
 
74 
        public function captchaGenerate($header_text=null, $footer_text=null) {
75 
                return '<noscript>'.
76 
                        '<p><font color="red">'._L('You need to enable JavaScript to solve the CAPTCHA.').'</font></p>'.
77 
                        '</noscript>'.
78 
                        '<input type="text" id="vts_validation_result" name="vts_validation_result" value="" style="display:none">'.
79 
                        '<script>
80 
                        OIDplusCaptchaPluginVtsClientChallenge.captchaReset(true); // try to solve it while the user enters the form
81 
                        $("form").submit(function(e){
82 
                                if (!OIDplusCaptchaPluginVtsClientChallenge.currentresponse) {
83 
                                        // if the user is too fast, then we will calculate it now
84 
                                        OIDplusCaptchaPluginVtsClientChallenge.currentresponse = OIDplusCaptchaPluginVtsClientChallenge.captchaResponse();
85 
                                }
86 
                                $("#vts_validation_result").val(OIDplusCaptchaPluginVtsClientChallenge.currentresponse);
87 
                        });
88 
                        </script>';
89 
        }
90 
 
91 
        public function captchaVerify($params, $fieldname=null) {
92 
 
93 
                if (is_null($fieldname)) $fieldname = 'vts_validation_result';
94 
 
95 
                $server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
96 
                $max_time = 10*60; // 10min. TODO: make configurable!
97 
 
718 daniel-mar 98 
                if (!isset($params[$fieldname])) throw new OIDplusException('No challenge response found');
709 daniel-mar 99 
 
100 
                list($starttime, $ip_target, $challenge, $answer, $challenge_integrity) = @json_decode($params[$fieldname], true);
101 
 
102 
                if ($ip_target != (isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown')) {
718 daniel-mar 103 
                        throw new OIDplusException(_L('Wrong IP address'));
709 daniel-mar 104 
                } else if (time()-$starttime > $max_time) {
718 daniel-mar 105 
                        throw new OIDplusException(_L('Challenge expired'));
709 daniel-mar 106 
                } else if ($challenge_integrity != sha3_512_hmac($challenge,$server_secret)) {
718 daniel-mar 107 
                        throw new OIDplusException(_L('Challenge integrity failed'));
709 daniel-mar 108 
                } else if ($challenge !== sha3_512($starttime.'/'.$ip_target.'/'.$answer)) {
718 daniel-mar 109 
                        throw new OIDplusException(_L('Wrong answer'));
709 daniel-mar 110 
                }
111 
        }
112 
 
113 
        public static function setupHTML(): string {
114 
                return '<div id="CAPTCHAPLUGIN_PARAMS_VtsClientChallenge">'.
115 
                       '<p>'._L('ViaThinkSoft Client Challenge lets the client computer solve a cryptographic problem instead of letting the user solve a CAPTCHA. This slows down brute-force attacks.').'</p>'.
116 
                       '</div>';
117 
        }
118 
 
119 
}