WebSVN – oidplus – Diff – /trunk/plugins/viathinksoft/captcha/vts_challenge/OIDplusCaptchaPluginVtsClientChallenge.class.php



         * @return array
         * @throws OIDplusException
         */
        public function action(string $actionID, array $params): array {
                if ($actionID == 'get_challenge') {
 
 
                        $offset = 0; // doesn't matter
                        $min = $offset;
                        $max = $offset + OIDplus::baseConfig()->getValue('VTS_CAPTCHA_COMPLEXITY', 50000);
                        if ($max > mt_getrandmax()) $max = mt_getrandmax();
 
                        $starttime = time();
                        $random = mt_rand($min,$max);
                        $ip_target = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
                        $challenge = sha3_512($starttime.'/'.$ip_target.'/'.$random); // $random is secret!
                        $challenge_integrity = OIDplus::authUtils()->makeAuthKey('797bfc34-f4fa-11ed-86ca-3c4a92df8582:'.$challenge);
                        $send_to_client = array($starttime, $ip_target, $challenge, $min, $max, $challenge_integrity);
 
                        $open_trans_file = self::getOpenTransFileName($ip_target, $random);
                        if (@file_put_contents($open_trans_file, '') === false) {
                                throw new OIDplusException(_L('Cannot write file %1', $open_trans_file));

         * @return string
         * @throws OIDplusException
         */
        private static function getOpenTransFileName(string $ip_target, $random): string {
                $dir = OIDplus::localpath().'/userdata/cache';
 
 
                // First, delete challenges which were never completed
                $files = glob($dir.'/vts_client_challenge_*.tmp');
                $expire = strtotime('-3 DAYS');
                foreach ($files as $file) {
                        if (!is_file($file)) continue;
                        if (filemtime($file) > $expire) continue;
                        @unlink($file);
                }
 
                return $dir.'/vts_client_challenge_'.OIDplus::authUtils()->makeSecret('461f4a9e-f4fa-11ed-86ca-3c4a92df8582:'.$ip_target.'/'.$random).'.tmp';
        }
 
        /**
         * @param string|null $header_text
         * @param string|null $footer_text

         */
        public function captchaVerify(array $params, string $fieldname=null) {
 
                if (is_null($fieldname)) $fieldname = 'vts_validation_result';
 
 
 
                if (!isset($params[$fieldname])) throw new OIDplusException(_L('No challenge response found').' (A)');
 
                $client_response = @json_decode($params[$fieldname], true);
 
                if (!is_array($client_response)) throw new OIDplusException(_L('Challenge response is invalid').' (B)');

                $current_ip = ($_SERVER['REMOTE_ADDR'] ?? 'unknown');
                if ($ip_target != $current_ip) {
                        throw new OIDplusException(_L('IP address has changed. Please try again. (current IP %1, expected %2)', $current_ip, $ip_target));
                } else if (time()-$starttime > OIDplus::baseConfig()->getValue('VTS_CAPTCHA_MAXTIME', 10*60/*10 minutes*/)) {
                        throw new OIDplusException(_L('Challenge expired. Please try again.'));
                } else if (!OIDplus::authUtils()->validateAuthKey('797bfc34-f4fa-11ed-86ca-3c4a92df8582:'.$challenge, $challenge_integrity)) {
                        throw new OIDplusException(_L('Challenge integrity failed'));
                } else if ($challenge !== sha3_512($starttime.'/'.$ip_target.'/'.$answer)) {
                        throw new OIDplusException(_L('Wrong answer'));
                } else if (!file_exists($open_trans_file)) {
                        throw new OIDplusException(_L('Challenge submitted twice or transaction missing'));

Subversion Repositories oidplus

oidplus/trunk/plugins/viathinksoft/captcha/vts_challenge/OIDplusCaptchaPluginVtsClientChallenge.class.php – Rev 1130 → 1282

Rev 1130		Rev 1282
Line 54...		Line 54...
54	* @return array	54	* @return array
55	* @throws OIDplusException	55	* @throws OIDplusException
56	*/	56	*/
57	public function action(string $actionID, array $params): array {	57	public function action(string $actionID, array $params): array {
58	if ($actionID == 'get_challenge') {	58	if ($actionID == 'get_challenge') {
59	$server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');	-
60		-
61	$offset = 0; // doesn't matter	59	$offset = 0; // doesn't matter
62	$min = $offset;	60	$min = $offset;
63	$max = $offset + OIDplus::baseConfig()->getValue('VTS_CAPTCHA_COMPLEXITY', 50000);	61	$max = $offset + OIDplus::baseConfig()->getValue('VTS_CAPTCHA_COMPLEXITY', 50000);
64	if ($max > mt_getrandmax()) $max = mt_getrandmax();	62	if ($max > mt_getrandmax()) $max = mt_getrandmax();
65		63
66	$starttime = time();	64	$starttime = time();
67	$random = mt_rand($min,$max);	65	$random = mt_rand($min,$max);
68	$ip_target = $_SERVER['REMOTE_ADDR'] ?? 'unknown';	66	$ip_target = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
69	$challenge = sha3_512($starttime.'/'.$ip_target.'/'.$random);	67	$challenge = sha3_512($starttime.'/'.$ip_target.'/'.$random); // $random is secret!
70	$challenge_integrity = sha3_512_hmac($challenge,$server_secret);	68	$challenge_integrity = OIDplus::authUtils()->makeAuthKey('797bfc34-f4fa-11ed-86ca-3c4a92df8582:'.$challenge);
71	$send_to_client = array($starttime, $ip_target, $challenge, $min, $max, $challenge_integrity);	69	$send_to_client = array($starttime, $ip_target, $challenge, $min, $max, $challenge_integrity);
72		70
73	$open_trans_file = self::getOpenTransFileName($ip_target, $random);	71	$open_trans_file = self::getOpenTransFileName($ip_target, $random);
74	if (@file_put_contents($open_trans_file, '') === false) {	72	if (@file_put_contents($open_trans_file, '') === false) {
75	throw new OIDplusException(_L('Cannot write file %1', $open_trans_file));	73	throw new OIDplusException(_L('Cannot write file %1', $open_trans_file));
Line 92...		Line 90...
92	* @return string	90	* @return string
93	* @throws OIDplusException	91	* @throws OIDplusException
94	*/	92	*/
95	private static function getOpenTransFileName(string $ip_target, $random): string {	93	private static function getOpenTransFileName(string $ip_target, $random): string {
96	$dir = OIDplus::localpath().'/userdata/cache';	94	$dir = OIDplus::localpath().'/userdata/cache';
97	$server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');	-
98		95
99	// First, delete challenges which were never completed	96	// First, delete challenges which were never completed
100	$files = glob($dir.'/vts_client_challenge_*.tmp');	97	$files = glob($dir.'/vts_client_challenge_*.tmp');
101	$expire = strtotime('-3 DAYS');	98	$expire = strtotime('-3 DAYS');
102	foreach ($files as $file) {	99	foreach ($files as $file) {
103	if (!is_file($file)) continue;	100	if (!is_file($file)) continue;
104	if (filemtime($file) > $expire) continue;	101	if (filemtime($file) > $expire) continue;
105	@unlink($file);	102	@unlink($file);
106	}	103	}
107		104
108	return $dir.'/vts_client_challenge_'.sha3_512_hmac($ip_target.'/'.$random, $server_secret).'.tmp';	105	return $dir.'/vts_client_challenge_'.OIDplus::authUtils()->makeSecret('461f4a9e-f4fa-11ed-86ca-3c4a92df8582:'.$ip_target.'/'.$random).'.tmp';
109	}	106	}
110		107
111	/**	108	/**
112	* @param string\|null $header_text	109	* @param string\|null $header_text
113	* @param string\|null $footer_text	110	* @param string\|null $footer_text
Line 132...		Line 129...
132	*/	129	*/
133	public function captchaVerify(array $params, string $fieldname=null) {	130	public function captchaVerify(array $params, string $fieldname=null) {
134		131
135	if (is_null($fieldname)) $fieldname = 'vts_validation_result';	132	if (is_null($fieldname)) $fieldname = 'vts_validation_result';
136		133
137	$server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');	-
138		-
139	if (!isset($params[$fieldname])) throw new OIDplusException(_L('No challenge response found').' (A)');	134	if (!isset($params[$fieldname])) throw new OIDplusException(_L('No challenge response found').' (A)');
140		135
141	$client_response = @json_decode($params[$fieldname], true);	136	$client_response = @json_decode($params[$fieldname], true);
142		137
143	if (!is_array($client_response)) throw new OIDplusException(_L('Challenge response is invalid').' (B)');	138	if (!is_array($client_response)) throw new OIDplusException(_L('Challenge response is invalid').' (B)');
Line 154...		Line 149...
154	$current_ip = ($_SERVER['REMOTE_ADDR'] ?? 'unknown');	149	$current_ip = ($_SERVER['REMOTE_ADDR'] ?? 'unknown');
155	if ($ip_target != $current_ip) {	150	if ($ip_target != $current_ip) {
156	throw new OIDplusException(_L('IP address has changed. Please try again. (current IP %1, expected %2)', $current_ip, $ip_target));	151	throw new OIDplusException(_L('IP address has changed. Please try again. (current IP %1, expected %2)', $current_ip, $ip_target));
157	} else if (time()-$starttime > OIDplus::baseConfig()->getValue('VTS_CAPTCHA_MAXTIME', 1060/10 minutes*/)) {	152	} else if (time()-$starttime > OIDplus::baseConfig()->getValue('VTS_CAPTCHA_MAXTIME', 1060/10 minutes*/)) {
158	throw new OIDplusException(_L('Challenge expired. Please try again.'));	153	throw new OIDplusException(_L('Challenge expired. Please try again.'));
159	} else if ($challenge_integrity != sha3_512_hmac($challenge,$server_secret)) {	154	} else if (!OIDplus::authUtils()->validateAuthKey('797bfc34-f4fa-11ed-86ca-3c4a92df8582:'.$challenge, $challenge_integrity)) {
160	throw new OIDplusException(_L('Challenge integrity failed'));	155	throw new OIDplusException(_L('Challenge integrity failed'));
161	} else if ($challenge !== sha3_512($starttime.'/'.$ip_target.'/'.$answer)) {	156	} else if ($challenge !== sha3_512($starttime.'/'.$ip_target.'/'.$answer)) {
162	throw new OIDplusException(_L('Wrong answer'));	157	throw new OIDplusException(_L('Wrong answer'));
163	} else if (!file_exists($open_trans_file)) {	158	} else if (!file_exists($open_trans_file)) {
164	throw new OIDplusException(_L('Challenge submitted twice or transaction missing'));	159	throw new OIDplusException(_L('Challenge submitted twice or transaction missing'));