Subversion Repositories oidplus

Rev

Rev 1116 | Rev 1282 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed

Rev 1116 Rev 1130
Line 63... Line 63...
63 
                        $max = $offset + OIDplus::baseConfig()->getValue('VTS_CAPTCHA_COMPLEXITY', 50000);
 63 
                        $max = $offset + OIDplus::baseConfig()->getValue('VTS_CAPTCHA_COMPLEXITY', 50000);
64 
                        if ($max > mt_getrandmax()) $max = mt_getrandmax();
 64 
                        if ($max > mt_getrandmax()) $max = mt_getrandmax();
65 
 
 65 
 
66 
                        $starttime = time();
 66 
                        $starttime = time();
67 
                        $random = mt_rand($min,$max);
 67 
                        $random = mt_rand($min,$max);
68 
                        $ip_target = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown';
 68 
                        $ip_target = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
69 
                        $challenge = sha3_512($starttime.'/'.$ip_target.'/'.$random);
 69 
                        $challenge = sha3_512($starttime.'/'.$ip_target.'/'.$random);
70 
                        $challenge_integrity = sha3_512_hmac($challenge,$server_secret);
 70 
                        $challenge_integrity = sha3_512_hmac($challenge,$server_secret);
71 
                        $send_to_client = array($starttime, $ip_target, $challenge, $min, $max, $challenge_integrity);
 71 
                        $send_to_client = array($starttime, $ip_target, $challenge, $min, $max, $challenge_integrity);
72 
 
 72 
 
73 
                        $open_trans_file = self::getOpenTransFileName($ip_target, $random);
 73 
                        $open_trans_file = self::getOpenTransFileName($ip_target, $random);
Line 85... Line 85...
85 
                        return parent::action($actionID, $params);
 85 
                        return parent::action($actionID, $params);
86 
                }
 86 
                }
87 
        }
 87 
        }
88 
 
 88 
 
89 
        /**
 89 
        /**
90 
         * @param $ip_target
 90 
         * @param string $ip_target
91 
         * @param $random
 91 
         * @param string|int $random
92 
         * @return string
 92 
         * @return string
93 
         * @throws OIDplusException
 93 
         * @throws OIDplusException
94 
         */
 94 
         */
95 
        private static function getOpenTransFileName($ip_target, $random) {
 95 
        private static function getOpenTransFileName(string $ip_target, $random): string {
96 
                $dir = OIDplus::localpath().'/userdata/cache';
 96 
                $dir = OIDplus::localpath().'/userdata/cache';
97 
                $server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
 97 
                $server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
98 
 
 98 
 
99 
                // First, delete challenges which were never completed
 99 
                // First, delete challenges which were never completed
100 
                $files = glob($dir.'/vts_client_challenge_*.tmp');
 100 
                $files = glob($dir.'/vts_client_challenge_*.tmp');
Line 149... Line 149...
149 
                if (!is_numeric($answer)) throw new OIDplusException(_L('Challenge response is invalid').' (G)');
 149 
                if (!is_numeric($answer)) throw new OIDplusException(_L('Challenge response is invalid').' (G)');
150 
                if (!is_string($challenge_integrity)) throw new OIDplusException(_L('Challenge response is invalid').' (H)');
 150 
                if (!is_string($challenge_integrity)) throw new OIDplusException(_L('Challenge response is invalid').' (H)');
151 
 
 151 
 
152 
                $open_trans_file = self::getOpenTransFileName($ip_target, $answer);
 152 
                $open_trans_file = self::getOpenTransFileName($ip_target, $answer);
153 
 
 153 
 
154 
                $current_ip = (isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown');
 154 
                $current_ip = ($_SERVER['REMOTE_ADDR'] ?? 'unknown');
155 
                if ($ip_target != $current_ip) {
 155 
                if ($ip_target != $current_ip) {
156 
                        throw new OIDplusException(_L('IP address has changed. Please try again. (current IP %1, expected %2)', $current_ip, $ip_target));
 156 
                        throw new OIDplusException(_L('IP address has changed. Please try again. (current IP %1, expected %2)', $current_ip, $ip_target));
157 
                } else if (time()-$starttime > OIDplus::baseConfig()->getValue('VTS_CAPTCHA_MAXTIME', 10*60/*10 minutes*/)) {
 157 
                } else if (time()-$starttime > OIDplus::baseConfig()->getValue('VTS_CAPTCHA_MAXTIME', 10*60/*10 minutes*/)) {
158 
                        throw new OIDplusException(_L('Challenge expired. Please try again.'));
 158 
                        throw new OIDplusException(_L('Challenge expired. Please try again.'));
159 
                } else if ($challenge_integrity != sha3_512_hmac($challenge,$server_secret)) {
 159 
                } else if ($challenge_integrity != sha3_512_hmac($challenge,$server_secret)) {