2fa

docker/www/Dockerfile

@@ -9,9 +9,10 @@ ARG XDEBUG_AUTOSTART=1
 ARG XDEBUG_REMOTE_LOG
 
 RUN apt-get update -y
-RUN apt-get install -y --no-install-recommends libzip-dev zip unzip git libfreetype6-dev libjpeg62-turbo-dev libpng-dev
+RUN apt-get install -y --no-install-recommends libzip-dev zip unzip git libfreetype6-dev libjpeg62-turbo-dev libpng-dev zlib1g-dev libicu-dev g++
 
-RUN docker-php-ext-install mysqli calendar mbstring
+RUN docker-php-ext-install mysqli calendar mbstring intl
+RUN docker-php-ext-configure intl
 RUN docker-php-ext-configure gd --with-freetype-dir=/usr/include/ --with-jpeg-dir=/usr/include/ && docker-php-ext-install -j$(nproc) gd
 RUN pecl install xdebug && docker-php-ext-enable xdebug && \
     echo "xdebug.remote_enable=${XDEBUG_REMOTE_ENABLE}" >> /usr/local/etc/php/conf.d/docker-php-ext-xdebug.ini && \

forum/composer.json

@@ -1,6 +1,8 @@
 {
   "name": "coderscommunity/forum",
   "require": {
-    "sentry/sentry": "^1.0"
+    "sentry/sentry": "^1.0",
+    "ext-mbstring": "*",
+    "ext-intl": "*"
   }
 }

forum/qa-plugin/q2a-googleauthenticator-login/composer.json

@@ -0,0 +1,20 @@
+{
+    "name": "event15/q2a-googleauthenticator-login",
+    "type": "library",
+    "license": "GPLv2",
+    "authors": [
+        {
+            "name": "Marek Woś",
+            "email": "mwos@getresponse.com"
+        }
+    ],
+    "minimum-stability": "dev",
+    "autoload": {
+        "psr-4": {
+            "CodersCommunity\\": "src/"
+        }
+    },
+    "require": {
+        "robthree/twofactorauth": "dev-master"
+    }
+}

forum/qa-plugin/q2a-googleauthenticator-login/metadata.json

@@ -0,0 +1,13 @@
+{
+  "name": "Google Authenticator 2-factor authentication for Q2A",
+  "description": "This plugin provides a Google 2FA security for users on forum",
+  "version": "1.0",
+  "date": "2018-05-30",
+  "author": "Marek Woś",
+  "author_uri": "http://github.com/event15",
+  "license": "GPLv2",
+  "update_uri": "Web address for Q2A to check for updates",
+  "min_q2a": "1.7",
+  "min_php": "5.4",
+  "load_order": "Bootstrap moment in which the plugin will be loaded"
+}

forum/qa-plugin/q2a-googleauthenticator-login/q2a-googleauthenticator-admin.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace CodersCommunity;
+
+require_once __DIR__ . '/../../vendor/autoload.php';
+
+class q2a_googleauthenticator_admin
+{
+    public function init_queries()
+    {
+        $isActive = qa_opt('googleauthenticator_login');
+        $result = null;
+
+        if (1 === $isActive) {
+            return null;
+        }
+
+        $queries = [];
+
+        $columns = qa_db_read_all_values(qa_db_query_sub('describe ^users'));
+        if (!in_array('2fa_enabled', $columns, true)) {
+            $queries[] = 'ALTER TABLE ^users ADD `2fa_enabled` SMALLINT (1) DEFAULT 0';
+        }
+
+        if (!in_array('2fa_change_date', $columns, true)) {
+            $queries[] = 'ALTER TABLE ^users ADD `2fa_change_date` VARCHAR (80) DEFAULT 0';
+        }
+
+        if (!in_array('2fa_secret', $columns, true)) {
+            $queries[] =
+                'ALTER TABLE ^users ADD `2fa_secret` VARCHAR ( 80 ) CHARACTER SET utf8 COLLATE utf8_general_ci NULL';
+        }
+
+        if (!in_array('2fa_recovery_code', $columns, true)) {
+            $queries[] = 'ALTER TABLE ^users ADD `2fa_recovery_code` VARCHAR (11) DEFAULT 0';
+        }
+
+        if(count($queries)) {
+            $result = $queries;
+        }
+
+        // we're already set up
+        qa_opt('googleauthenticator_login', 1);
+
+        return $result;
+    }
+
+    public function admin_form()
+    {
+        $saved = false;
+
+        if (qa_clicked('2fa_save_button')) {
+            $enabled = qa_post_text('googleauthenticator_enable_plugin');
+            qa_opt('googleauthenticator_login', empty($enabled) ? 0 : 1);
+
+            $saved = true;
+        }
+
+        return [
+            'ok' => $saved ? qa_lang('plugin_2fa/saved_plugin_settings') : null,
+            'fields' => [[
+                'type' => 'checkbox',
+                'label' => qa_lang('plugin_2fa/disable_plugin'),
+                'value' => qa_opt('googleauthenticator_login') ? true : false,
+                'tags' => 'NAME="googleauthenticator_enable_plugin"'
+                ]
+            ],
+            'buttons' => [[
+                'label' => qa_lang('plugin_2fa/save_settings'),
+                'tags' => 'NAME="2fa_save_button"'
+                ]
+            ]
+        ];
+    }
+}

forum/qa-plugin/q2a-googleauthenticator-login/q2a-googleauthenticator-layer.php

@@ -0,0 +1,171 @@
+<?php
+
+require_once GOOGLEAUTHENTICATOR_BASIC_PATH . '/src/GoogleAuthenticator.php';
+
+class qa_html_theme_layer extends qa_html_theme_base
+{
+    public function doctype()
+    {
+        parent::doctype();
+
+        if ('account' === $this->request && true === (bool) qa_opt('googleauthenticator_login')) {
+            $content = [
+                'tags'    => 'method="post" action="' . qa_self_html() . '"',
+                'style'   => 'wide',
+                'title'   => qa_lang('plugin_2fa/title')
+            ];
+
+            $content += $this->enablePlugin();
+
+            $this->content['form_2fa'] = $content;
+            qa_html_theme_base::doctype();
+        }
+    }
+
+    private function getUserQuery($userId): ?array
+    {
+        $users = qa_db_read_all_assoc(
+            qa_db_query_sub(
+                'SELECT us.userid, us.2fa_enabled, us.email, us.handle, us.2fa_change_date, up.points FROM ^users us LEFT JOIN ^userpoints up ON us.userid = up.userid WHERE us.userid=$',
+                $userId['userid'] ?? $userId
+            )
+        );
+
+        return empty($users) ? null : $users[0];
+    }
+
+    private function updateUserEnable2FA($userId, $isEnabled, $secret = null, $recoveryCode = null): ?bool
+    {
+        $time = $this->setTime();
+        $result = qa_db_query_sub(
+            'UPDATE ^users SET 2fa_enabled=#, 2fa_change_date=$, 2fa_secret=$, 2fa_recovery_code=$ WHERE userid=#',
+            $isEnabled,
+            $time,
+            $secret,
+            $recoveryCode,
+            $userId['userid']
+        );
+
+        if (true === $result) {
+            return $isEnabled;
+        }
+
+        user_error(qa_lang('plugin_2fa/2fa_setup_error'));
+    }
+
+    private function enablePlugin(): array
+    {
+        $userAccount   = $this->getUser();
+        [$userActive2fa, $recoveryCode, $secret] = $this->prepareGoogleAuthenticator($userAccount);
+
+        if (!(bool) $userActive2fa) {
+            return $this->render2FADisabledForm();
+        }
+
+        $result = $this->render2FAEnabledForm($userAccount['2fa_change_date']);
+
+        if (isset($this->init)) {
+            $note = qa_lang_html('plugin_2fa/2fa_data_info');
+            $note = str_replace(
+                ['{{ QR_CODE }}', '{{ SECRET }}', '{{ RECOVERY_CODE }}', '{{ ERROR_START }}', '{{ ERROR_END }}'],
+                [
+                    '<br><div style="text-align: center;"><img src="' . $this->init->getQRCode() . '"></div><br>',
+                    '<code>' . $secret . '</code>',
+                    '<code>' . $recoveryCode . '</code>',
+                    '<br><div class="qa-error">',
+                    '</div><br>'
+                ],
+                $note
+            );
+
+            $result['fields'][] = [
+                'style' => 'tall',
+                'type' => 'static',
+                'note' => $note
+            ];
+        }
+
+        return $result;
+    }
+
+    private function render2FAEnabledForm($date): array
+    {
+        return [
+            'fields'  => [
+                'old' => [
+                    'label' => qa_lang('plugin_2fa/plugin_is_enabled'),
+                    'tags'  => 'name="oldpassword" disabled',
+                    'value' => $date,
+                    'type'  => 'input'
+                ],
+            ],
+            'buttons' => [
+                'enable' => [
+                    'label' => qa_lang('plugin_2fa/disable_plugin')
+                ]
+            ],
+            'hidden'  => [
+                'dodisable2fa' => '1',
+                'code'         => qa_get_form_security_code('2faform')
+            ]
+        ];
+    }
+
+    private function render2FADisabledForm(): array
+    {
+        return [
+            'fields'  => [
+                'old' => [
+                    'label' => qa_lang('plugin_2fa/plugin_is_disabled'),
+                    'value' => '',
+                    'type'  => 'static'
+                ]
+            ],
+            'buttons' => [
+                'enable_2fa' => [
+                    'label' => qa_lang('plugin_2fa/enable_plugin')
+                ]
+            ],
+            'hidden'  => [
+                'doenable2fa' => '1',
+                'code'        => qa_get_form_security_code('2faform')
+            ]
+        ];
+    }
+
+    private function getUser(): ?array
+    {
+        $userId = qa_get_logged_in_userid();
+
+        if (!isset($userId)) {
+            qa_redirect('login');
+        }
+
+        return $this->getUserQuery($userId);
+    }
+
+    private function setTime()
+    {
+        $time      = new DateTime('now');
+        $formatter = new IntlDateFormatter('pl_PL', IntlDateFormatter::SHORT, IntlDateFormatter::SHORT);
+        $formatter->setPattern('EEEE, dd MMMM yyyy, HH:mm:ss');
+
+        return $formatter->format($time);
+    }
+
+    private function prepareGoogleAuthenticator(?array $userAccount): array
+    {
+        $userActive2fa = $userAccount['2fa_enabled'];
+        if (qa_clicked('doenable2fa')) {
+            $this->init = new GoogleAuthenticator;
+            $this->init->createSecret();
+            $recoveryCode = $this->init->getRandomRecoveryCode();
+            $secret       = $this->init->getSecret();
+            $userActive2fa = $this->updateUserEnable2FA($userAccount, true, $secret, $recoveryCode);
+        } elseif (qa_clicked('dodisable2fa')) {
+            $userActive2fa = $this->updateUserEnable2FA($userAccount, false);
+        }
+
+        return [$userActive2fa ?? false, $recoveryCode ?? false, $secret ?? false];
+    }
+}