Subversion Repositories oidplus

Rev

Rev 784 | Rev 801 | Go to most recent revision | Blame | Compare with Previous | Last modification | View Log | RSS feed

  1. <?php
  2.  
  3. /*
  4.  * OIDplus 2.0
  5.  * Copyright 2019 - 2021 Daniel Marschall, ViaThinkSoft
  6.  *
  7.  * Licensed under the Apache License, Version 2.0 (the "License");
  8.  * you may not use this file except in compliance with the License.
  9.  * You may obtain a copy of the License at
  10.  *
  11.  *     http://www.apache.org/licenses/LICENSE-2.0
  12.  *
  13.  * Unless required by applicable law or agreed to in writing, software
  14.  * distributed under the License is distributed on an "AS IS" BASIS,
  15.  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16.  * See the License for the specific language governing permissions and
  17.  * limitations under the License.
  18.  */
  19.  
  20. if (!defined('INSIDE_OIDPLUS')) die();
  21.  
  22. class OIDplusCaptchaPluginVtsClientChallenge extends OIDplusCaptchaPlugin {
  23.  
  24.         public static function id(): string {
  25.                 return 'ViaThinkSoft Client Challenge';
  26.         }
  27.  
  28.         public static function isVisible(): bool {
  29.                 return false;
  30.         }
  31.  
  32.         public function csrfUnlock($actionID) {
  33.                 if ($actionID == 'get_challenge') {
  34.                         return true;
  35.                 }
  36.                 return false;
  37.         }
  38.  
  39.         public function action($actionID, $params) {
  40.                 if ($actionID == 'get_challenge') {
  41.                         $complexity=500000; // TODO: make configurable
  42.                         $server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
  43.  
  44.                         $min = 0;
  45.                         $max = $complexity;
  46.                         $starttime = time();
  47.                         $random = rand($min,$max); // TODO: cryptographic rand
  48.                         $ip_target = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown';
  49.                         $challenge = sha3_512($starttime.'/'.$ip_target.'/'.$random);
  50.                         $challenge_integrity = sha3_512_hmac($challenge,$server_secret);
  51.                         $send_to_client = array($starttime, $ip_target, $challenge, $min, $max, $challenge_integrity);
  52.  
  53.                         return array("status" => 0, "challenge" => $send_to_client);
  54.                 }
  55.         }
  56.  
  57.         public function captchaDomHead() {
  58.                 // Here you can add styles and scripts to be included into the HTML <head> part
  59.                 return '<script>
  60.                 function oidplus_captcha_response() {
  61.                         return OIDplusCaptchaPluginVtsClientChallenge.captchaResponse();
  62.                 }
  63.                 function oidplus_captcha_reset() {
  64.                         return OIDplusCaptchaPluginVtsClientChallenge.captchaReset(true);
  65.                 }
  66.                 </script>
  67.  
  68.                 <script src="'.(OIDplus::webPath() . 'vendor/components/jquery/jquery.min.js').'"></script>
  69.                 <script src="'.(OIDplus::webPath() . 'vendor/emn178/js-sha3/src/sha3.js').'"></script>
  70.                 <script src="'.(OIDplus::webpath(__DIR__,true) . 'OIDplusCaptchaPluginVtsClientChallenge.js').'"></script>
  71.                 '; // we include OIDplusCaptchaPluginVtsClientChallenge.js not via manifest.xml, otherwise oobe.php would not work
  72.         }
  73.  
  74.         public function captchaGenerate($header_text=null, $footer_text=null) {
  75.                 return '<noscript>'.
  76.                         '<p><font color="red">'._L('You need to enable JavaScript to solve the CAPTCHA.').'</font></p>'.
  77.                         '</noscript>'.
  78.                         '<input type="text" id="vts_validation_result" name="vts_validation_result" value="" style="display:none">'.
  79.                         '<script>
  80.                         OIDplusCaptchaPluginVtsClientChallenge.captchaReset(true); // try to solve it while the user enters the form
  81.                         $("form").submit(function(e){
  82.                                 if (!OIDplusCaptchaPluginVtsClientChallenge.currentresponse) {
  83.                                         // if the user is too fast, then we will calculate it now
  84.                                         OIDplusCaptchaPluginVtsClientChallenge.currentresponse = OIDplusCaptchaPluginVtsClientChallenge.captchaResponse();
  85.                                 }
  86.                                 $("#vts_validation_result").val(OIDplusCaptchaPluginVtsClientChallenge.currentresponse);
  87.                         });
  88.                         </script>';
  89.         }
  90.  
  91.         public function captchaVerify($params, $fieldname=null) {
  92.  
  93.                 if (is_null($fieldname)) $fieldname = 'vts_validation_result';
  94.  
  95.                 $server_secret='VtsClientChallenge:'.OIDplus::baseConfig()->getValue('SERVER_SECRET');
  96.                 $max_time = 10*60; // 10min. TODO: make configurable!
  97.  
  98.                 if (!isset($params[$fieldname])) throw new OIDplusException('No challenge response found');
  99.  
  100.                 list($starttime, $ip_target, $challenge, $answer, $challenge_integrity) = @json_decode($params[$fieldname], true);
  101.  
  102.                 if ($ip_target != (isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : 'unknown')) {
  103.                         throw new OIDplusException(_L('Wrong IP address'));
  104.                 } else if (time()-$starttime > $max_time) {
  105.                         throw new OIDplusException(_L('Challenge expired'));
  106.                 } else if ($challenge_integrity != sha3_512_hmac($challenge,$server_secret)) {
  107.                         throw new OIDplusException(_L('Challenge integrity failed'));
  108.                 } else if ($challenge !== sha3_512($starttime.'/'.$ip_target.'/'.$answer)) {
  109.                         throw new OIDplusException(_L('Wrong answer'));
  110.                 }
  111.         }
  112.  
  113.         public static function setupHTML(): string {
  114.                 return '<div id="CAPTCHAPLUGIN_PARAMS_VtsClientChallenge">'.
  115.                        '<p>'._L('ViaThinkSoft Client Challenge lets the client computer solve a cryptographic problem instead of letting the user solve a CAPTCHA. This slows down brute-force attacks.').'</p>'.
  116.                        '</div>';
  117.         }
  118.  
  119. }
  120.