WebSVN – oidplus – Diff – /trunk/plugins/viathinksoft/captcha/vts_challenge/OIDplusCaptchaPluginVtsClientChallenge.class.php


<?php
 
/*
 * OIDplus 2.0
 * Copyright 2019 - 2022 Daniel Marschall, ViaThinkSoft
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
 
namespace ViaThinkSoft\OIDplus;
 
class OIDplusCaptchaPluginVtsClientChallenge extends OIDplusCaptchaPlugin {
 
        public static function id(): string {
                return 'ViaThinkSoft Client Challenge';
        }
 
        public function isVisible(): bool {
                return false;
        }
 
        public function csrfUnlock($actionID) {
                if ($actionID == 'get_challenge') {
                        return true;
                }
                return false;
        }
 
        public function action($actionID, $params) {
                if ($actionID == 'get_challenge') {
                        $server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
 
                        $offset = 0; // doesn't matter
                        $min = $offset;
                        $max = $offset + OIDplus::baseConfig()->getValue('VTS_CAPTCHA_COMPLEXITY', 50000);
                        if ($max > mt_getrandmax()) $max = mt_getrandmax();
 
                        $starttime = time();
                        $random = mt_rand($min,$max);
                        $ip_target = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown';
                        $challenge = sha3_512($starttime.'/'.$ip_target.'/'.$random);
                        $challenge_integrity = sha3_512_hmac($challenge,$server_secret);
                        $send_to_client = array($starttime, $ip_target, $challenge, $min, $max, $challenge_integrity);
 
                        $open_trans_file = self::getOpenTransFileName($ip_target, $random);
                        if (@file_put_contents($open_trans_file, '') === false) {
                                throw new OIDplusException(_L('Cannot write file %1', $open_trans_file));
                        }
 
                        return array(
                                "status" => 0,
                                "challenge" => $send_to_client,
                                // Autosolve on=calculate result on page load; off=calculate result on form submit
                                "autosolve" => OIDplus::baseConfig()->getValue('VTS_CAPTCHA_AUTOSOLVE', true)
                        );
                }
        }
 
        private static function getOpenTransFileName($ip_target, $random) {
                $dir = OIDplus::localpath().'/userdata/cache';
                $server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
 
                // First, delete challenges which were never completed
                $files = glob($dir.'/vts_client_challenge_*.tmp');
                $expire = strtotime('-3 DAYS');
                foreach ($files as $file) {
                        if (!is_file($file)) continue;
                        if (filemtime($file) > $expire) continue;
                        @unlink($file);
                }
 
                return $dir.'/vts_client_challenge_'.sha3_512_hmac($ip_target.'/'.$random, $server_secret).'.tmp';
        }
 
        public function captchaGenerate($header_text=null, $footer_text=null) {
                return '<noscript>'.
                       '<p><font color="red">'._L('You need to enable JavaScript to solve the CAPTCHA.').'</font></p>'.
                       '</noscript>'.
                       '<input type="hidden" id="vts_validation_result" name="vts_validation_result" value="">'.
                       '<script>'.
                       'OIDplusCaptchaPluginVtsClientChallenge.captchaShow('.js_escape(OIDplus::webpath(null,OIDplus::PATH_RELATIVE)).');'.
                       '</script>';
        }
 
        public function captchaVerify($params, $fieldname=null) {
 
                if (is_null($fieldname)) $fieldname = 'vts_validation_result';
 
                $server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
 
                if (!isset($params[$fieldname])) throw new OIDplusException(_L('No challenge response found').' (A)');
 
                $client_response = @json_decode($params[$fieldname], true);
 
                if (!is_array($client_response)) throw new OIDplusException(_L('Challenge response is invalid').' (B)');
                if (count($client_response) != 5) throw new OIDplusException(_L('Challenge response is invalid').' (C)');
                list($starttime, $ip_target, $challenge, $answer, $challenge_integrity) = $client_response;
                if (!is_numeric($starttime)) throw new OIDplusException(_L('Challenge response is invalid').' (D)');
                if (!is_string($ip_target)) throw new OIDplusException(_L('Challenge response is invalid').' (E)');
                if (!is_string($challenge)) throw new OIDplusException(_L('Challenge response is invalid').' (F)');
                if (!is_numeric($answer)) throw new OIDplusException(_L('Challenge response is invalid').' (G)');
                if (!is_string($challenge_integrity)) throw new OIDplusException(_L('Challenge response is invalid').' (H)');
 
                $open_trans_file = self::getOpenTransFileName($ip_target, $answer);
 
                $current_ip = (isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown');
                if ($ip_target != $current_ip) {
                        throw new OIDplusException(_L('IP address has changed. Please try again. (current IP %1, expected %2)', $current_ip, $ip_target));
                } else if (time()-$starttime > OIDplus::baseConfig()->getValue('VTS_CAPTCHA_MAXTIME', 10*60/*10 minutes*/)) {
                        throw new OIDplusException(_L('Challenge expired. Please try again.'));
                } else if ($challenge_integrity != sha3_512_hmac($challenge,$server_secret)) {
                        throw new OIDplusException(_L('Challenge integrity failed'));
                } else if ($challenge !== sha3_512($starttime.'/'.$ip_target.'/'.$answer)) {
                        throw new OIDplusException(_L('Wrong answer'));
                } else if (!file_exists($open_trans_file)) {
                        throw new OIDplusException(_L('Challenge submitted twice or transaction missing'));
                } else {
                        @unlink($open_trans_file);
                }
        }
 
        public static function setupHTML(): string {
                return '<div id="CAPTCHAPLUGIN_PARAMS_VtsClientChallenge">'.
                       '<p>'._L('ViaThinkSoft Client Challenge lets the client computer solve a cryptographic problem instead of letting the user solve a CAPTCHA. This slows down brute-force attacks.').'</p>'.
                       '</div>';
        }
 
}
 

Subversion Repositories oidplus

oidplus/trunk/plugins/viathinksoft/captcha/vts_challenge/OIDplusCaptchaPluginVtsClientChallenge.class.php – Rev 1025 → 1050

Rev 1025		Rev 1050
1	<?php	1	<?php
2		2
3	/*	3	/*
4	* OIDplus 2.0	4	* OIDplus 2.0
5	* Copyright 2019 - 2022 Daniel Marschall, ViaThinkSoft	5	* Copyright 2019 - 2022 Daniel Marschall, ViaThinkSoft
6	*	6	*
7	* Licensed under the Apache License, Version 2.0 (the "License");	7	* Licensed under the Apache License, Version 2.0 (the "License");
8	* you may not use this file except in compliance with the License.	8	* you may not use this file except in compliance with the License.
9	* You may obtain a copy of the License at	9	* You may obtain a copy of the License at
10	*	10	*
11	* http://www.apache.org/licenses/LICENSE-2.0	11	* http://www.apache.org/licenses/LICENSE-2.0
12	*	12	*
13	* Unless required by applicable law or agreed to in writing, software	13	* Unless required by applicable law or agreed to in writing, software
14	* distributed under the License is distributed on an "AS IS" BASIS,	14	* distributed under the License is distributed on an "AS IS" BASIS,
15	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.	15	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16	* See the License for the specific language governing permissions and	16	* See the License for the specific language governing permissions and
17	* limitations under the License.	17	* limitations under the License.
18	*/	18	*/
19		19
20	if (!defined('INSIDE_OIDPLUS')) die();	20	namespace ViaThinkSoft\OIDplus;
21		21
22	class OIDplusCaptchaPluginVtsClientChallenge extends OIDplusCaptchaPlugin {	22	class OIDplusCaptchaPluginVtsClientChallenge extends OIDplusCaptchaPlugin {
23		23
24	public static function id(): string {	24	public static function id(): string {
25	return 'ViaThinkSoft Client Challenge';	25	return 'ViaThinkSoft Client Challenge';
26	}	26	}
27		27
28	public function isVisible(): bool {	28	public function isVisible(): bool {
29	return false;	29	return false;
30	}	30	}
31		31
32	public function csrfUnlock($actionID) {	32	public function csrfUnlock($actionID) {
33	if ($actionID == 'get_challenge') {	33	if ($actionID == 'get_challenge') {
34	return true;	34	return true;
35	}	35	}
36	return false;	36	return false;
37	}	37	}
38		38
39	public function action($actionID, $params) {	39	public function action($actionID, $params) {
40	if ($actionID == 'get_challenge') {	40	if ($actionID == 'get_challenge') {
41	$server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');	41	$server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
42		42
43	$offset = 0; // doesn't matter	43	$offset = 0; // doesn't matter
44	$min = $offset;	44	$min = $offset;
45	$max = $offset + OIDplus::baseConfig()->getValue('VTS_CAPTCHA_COMPLEXITY', 50000);	45	$max = $offset + OIDplus::baseConfig()->getValue('VTS_CAPTCHA_COMPLEXITY', 50000);
46	if ($max > mt_getrandmax()) $max = mt_getrandmax();	46	if ($max > mt_getrandmax()) $max = mt_getrandmax();
47		47
48	$starttime = time();	48	$starttime = time();
49	$random = mt_rand($min,$max);	49	$random = mt_rand($min,$max);
50	$ip_target = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown';	50	$ip_target = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown';
51	$challenge = sha3_512($starttime.'/'.$ip_target.'/'.$random);	51	$challenge = sha3_512($starttime.'/'.$ip_target.'/'.$random);
52	$challenge_integrity = sha3_512_hmac($challenge,$server_secret);	52	$challenge_integrity = sha3_512_hmac($challenge,$server_secret);
53	$send_to_client = array($starttime, $ip_target, $challenge, $min, $max, $challenge_integrity);	53	$send_to_client = array($starttime, $ip_target, $challenge, $min, $max, $challenge_integrity);
54		54
55	$open_trans_file = self::getOpenTransFileName($ip_target, $random);	55	$open_trans_file = self::getOpenTransFileName($ip_target, $random);
56	if (@file_put_contents($open_trans_file, '') === false) {	56	if (@file_put_contents($open_trans_file, '') === false) {
57	throw new OIDplusException(_L('Cannot write file %1', $open_trans_file));	57	throw new OIDplusException(_L('Cannot write file %1', $open_trans_file));
58	}	58	}
59		59
60	return array(	60	return array(
61	"status" => 0,	61	"status" => 0,
62	"challenge" => $send_to_client,	62	"challenge" => $send_to_client,
63	// Autosolve on=calculate result on page load; off=calculate result on form submit	63	// Autosolve on=calculate result on page load; off=calculate result on form submit
64	"autosolve" => OIDplus::baseConfig()->getValue('VTS_CAPTCHA_AUTOSOLVE', true)	64	"autosolve" => OIDplus::baseConfig()->getValue('VTS_CAPTCHA_AUTOSOLVE', true)
65	);	65	);
66	}	66	}
67	}	67	}
68		68
69	private static function getOpenTransFileName($ip_target, $random) {	69	private static function getOpenTransFileName($ip_target, $random) {
70	$dir = OIDplus::localpath().'/userdata/cache';	70	$dir = OIDplus::localpath().'/userdata/cache';
71	$server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');	71	$server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
72		72
73	// First, delete challenges which were never completed	73	// First, delete challenges which were never completed
74	$files = glob($dir.'/vts_client_challenge_*.tmp');	74	$files = glob($dir.'/vts_client_challenge_*.tmp');
75	$expire = strtotime('-3 DAYS');	75	$expire = strtotime('-3 DAYS');
76	foreach ($files as $file) {	76	foreach ($files as $file) {
77	if (!is_file($file)) continue;	77	if (!is_file($file)) continue;
78	if (filemtime($file) > $expire) continue;	78	if (filemtime($file) > $expire) continue;
79	@unlink($file);	79	@unlink($file);
80	}	80	}
81		81
82	return $dir.'/vts_client_challenge_'.sha3_512_hmac($ip_target.'/'.$random, $server_secret).'.tmp';	82	return $dir.'/vts_client_challenge_'.sha3_512_hmac($ip_target.'/'.$random, $server_secret).'.tmp';
83	}	83	}
84		84
85	public function captchaGenerate($header_text=null, $footer_text=null) {	85	public function captchaGenerate($header_text=null, $footer_text=null) {
86	return '<noscript>'.	86	return '<noscript>'.
87	'<p><font color="red">'._L('You need to enable JavaScript to solve the CAPTCHA.').'</font></p>'.	87	'<p><font color="red">'._L('You need to enable JavaScript to solve the CAPTCHA.').'</font></p>'.
88	'</noscript>'.	88	'</noscript>'.
89	'<input type="hidden" id="vts_validation_result" name="vts_validation_result" value="">'.	89	'<input type="hidden" id="vts_validation_result" name="vts_validation_result" value="">'.
90	'<script>'.	90	'<script>'.
91	'OIDplusCaptchaPluginVtsClientChallenge.captchaShow('.js_escape(OIDplus::webpath(null,OIDplus::PATH_RELATIVE)).');'.	91	'OIDplusCaptchaPluginVtsClientChallenge.captchaShow('.js_escape(OIDplus::webpath(null,OIDplus::PATH_RELATIVE)).');'.
92	'</script>';	92	'</script>';
93	}	93	}
94		94
95	public function captchaVerify($params, $fieldname=null) {	95	public function captchaVerify($params, $fieldname=null) {
96		96
97	if (is_null($fieldname)) $fieldname = 'vts_validation_result';	97	if (is_null($fieldname)) $fieldname = 'vts_validation_result';
98		98
99	$server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');	99	$server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
100		100
101	if (!isset($params[$fieldname])) throw new OIDplusException(_L('No challenge response found').' (A)');	101	if (!isset($params[$fieldname])) throw new OIDplusException(_L('No challenge response found').' (A)');
102		102
103	$client_response = @json_decode($params[$fieldname], true);	103	$client_response = @json_decode($params[$fieldname], true);
104		104
105	if (!is_array($client_response)) throw new OIDplusException(_L('Challenge response is invalid').' (B)');	105	if (!is_array($client_response)) throw new OIDplusException(_L('Challenge response is invalid').' (B)');
106	if (count($client_response) != 5) throw new OIDplusException(_L('Challenge response is invalid').' (C)');	106	if (count($client_response) != 5) throw new OIDplusException(_L('Challenge response is invalid').' (C)');
107	list($starttime, $ip_target, $challenge, $answer, $challenge_integrity) = $client_response;	107	list($starttime, $ip_target, $challenge, $answer, $challenge_integrity) = $client_response;
108	if (!is_numeric($starttime)) throw new OIDplusException(_L('Challenge response is invalid').' (D)');	108	if (!is_numeric($starttime)) throw new OIDplusException(_L('Challenge response is invalid').' (D)');
109	if (!is_string($ip_target)) throw new OIDplusException(_L('Challenge response is invalid').' (E)');	109	if (!is_string($ip_target)) throw new OIDplusException(_L('Challenge response is invalid').' (E)');
110	if (!is_string($challenge)) throw new OIDplusException(_L('Challenge response is invalid').' (F)');	110	if (!is_string($challenge)) throw new OIDplusException(_L('Challenge response is invalid').' (F)');
111	if (!is_numeric($answer)) throw new OIDplusException(_L('Challenge response is invalid').' (G)');	111	if (!is_numeric($answer)) throw new OIDplusException(_L('Challenge response is invalid').' (G)');
112	if (!is_string($challenge_integrity)) throw new OIDplusException(_L('Challenge response is invalid').' (H)');	112	if (!is_string($challenge_integrity)) throw new OIDplusException(_L('Challenge response is invalid').' (H)');
113		113
114	$open_trans_file = self::getOpenTransFileName($ip_target, $answer);	114	$open_trans_file = self::getOpenTransFileName($ip_target, $answer);
115		115
116	$current_ip = (isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown');	116	$current_ip = (isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown');
117	if ($ip_target != $current_ip) {	117	if ($ip_target != $current_ip) {
118	throw new OIDplusException(_L('IP address has changed. Please try again. (current IP %1, expected %2)', $current_ip, $ip_target));	118	throw new OIDplusException(_L('IP address has changed. Please try again. (current IP %1, expected %2)', $current_ip, $ip_target));
119	} else if (time()-$starttime > OIDplus::baseConfig()->getValue('VTS_CAPTCHA_MAXTIME', 1060/10 minutes*/)) {	119	} else if (time()-$starttime > OIDplus::baseConfig()->getValue('VTS_CAPTCHA_MAXTIME', 1060/10 minutes*/)) {
120	throw new OIDplusException(_L('Challenge expired. Please try again.'));	120	throw new OIDplusException(_L('Challenge expired. Please try again.'));
121	} else if ($challenge_integrity != sha3_512_hmac($challenge,$server_secret)) {	121	} else if ($challenge_integrity != sha3_512_hmac($challenge,$server_secret)) {
122	throw new OIDplusException(_L('Challenge integrity failed'));	122	throw new OIDplusException(_L('Challenge integrity failed'));
123	} else if ($challenge !== sha3_512($starttime.'/'.$ip_target.'/'.$answer)) {	123	} else if ($challenge !== sha3_512($starttime.'/'.$ip_target.'/'.$answer)) {
124	throw new OIDplusException(_L('Wrong answer'));	124	throw new OIDplusException(_L('Wrong answer'));
125	} else if (!file_exists($open_trans_file)) {	125	} else if (!file_exists($open_trans_file)) {
126	throw new OIDplusException(_L('Challenge submitted twice or transaction missing'));	126	throw new OIDplusException(_L('Challenge submitted twice or transaction missing'));
127	} else {	127	} else {
128	@unlink($open_trans_file);	128	@unlink($open_trans_file);
129	}	129	}
130	}	130	}
131		131
132	public static function setupHTML(): string {	132	public static function setupHTML(): string {
133	return '<div id="CAPTCHAPLUGIN_PARAMS_VtsClientChallenge">'.	133	return '<div id="CAPTCHAPLUGIN_PARAMS_VtsClientChallenge">'.
134	'<p>'._L('ViaThinkSoft Client Challenge lets the client computer solve a cryptographic problem instead of letting the user solve a CAPTCHA. This slows down brute-force attacks.').'</p>'.	134	'<p>'._L('ViaThinkSoft Client Challenge lets the client computer solve a cryptographic problem instead of letting the user solve a CAPTCHA. This slows down brute-force attacks.').'</p>'.
135	'</div>';	135	'</div>';
136	}	136	}
137		137
138	}	138	}
139		139