├── .gitignore
├── README.md
├── bin
    └── synchronise_with_source.sh
├── composer.json
├── config.inc.php.dist
├── kolab2fa.js
├── kolab_2fa.php
├── lib
    └── Kolab2FA
    │   ├── Driver
    │       ├── Base.php
    │       ├── Exception.php
    │       ├── HOTP.php
    │       ├── TOTP.php
    │       └── Yubikey.php
    │   ├── Log
    │       ├── Logger.php
    │       ├── RcubeLogger.php
    │       └── Syslog.php
    │   ├── OTP
    │       ├── HOTP.php
    │       ├── OTP.php
    │       └── TOTP.php
    │   └── Storage
    │       ├── Base.php
    │       ├── Exception.php
    │       ├── LDAP.php
    │       └── RcubeUser.php
├── localization
    ├── bg_BG.inc
    ├── ca_ES.inc
    ├── cs_CZ.inc
    ├── da_DK.inc
    ├── de.inc
    ├── de_CH.inc
    ├── de_DE.inc
    ├── el.inc
    ├── en_US.inc
    ├── es_AR.inc
    ├── es_ES.inc
    ├── et_EE.inc
    ├── fi_FI.inc
    ├── fr_FR.inc
    ├── he_IL.inc
    ├── hr_HR.inc
    ├── hu_HU.inc
    ├── it_IT.inc
    ├── ja_JP.inc
    ├── ko_KR.inc
    ├── lv.inc
    ├── nl_NL.inc
    ├── pl.inc
    ├── pl_PL.inc
    ├── pt_BR.inc
    ├── pt_PT.inc
    ├── ru_RU.inc
    ├── sk_SK.inc
    ├── sl_SI.inc
    ├── sv.inc
    ├── sv_SE.inc
    ├── th_TH.inc
    ├── uk_UA.inc
    ├── vi_VN.inc
    ├── zh_CN.inc
    └── zh_TW.inc
└── skins
    ├── elastic
        └── templates
        │   └── config.html
    └── larry
        ├── kolab2fa.css
        └── templates
            └── config.html


/.gitignore:
--------------------------------------------------------------------------------
1 | bin/data/
2 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | IMPORTANT INFORMATION
  2 | =====================
  3 | 
  4 | > This is a clone from https://git.kolab.org/diffusion/RPK/  
  5 | > For bug reports and pull requests, please go to https://kolab.org/
  6 | 
  7 | How to upgrade this clone
  8 | =========================
  9 | 
 10 | Execute the [synchronise_with_source.sh](bin/synchronise_with_source.sh) shell script.
 11 | 
 12 | Kolab Multi-Factor Authentication Plugin
 13 | ========================================
 14 | 
 15 | The plugin is designed to be a generic container for different 2nd factor 
 16 | authentication mechanisms paired with different ways to store the related 
 17 | data for Roundcube user accounts. Both drivers and storage backends are derived 
 18 | from abstract classes which define the common interface and are configurable.
 19 | 
 20 | Drivers
 21 | -------
 22 | 
 23 | Multiple methods for 2nd factor authentication can be enabled for the users 
 24 | to select from. The basic implementation covers TOTP, HOTP and Yubikey methods.
 25 | 
 26 | TOTP (RFC 6238) and HOTP (RFC 4226) can be used in conjunction with freely available 
 27 | mobile phone apps like FreeOTP (TOTP only!) or Google Authenticator. To provision 
 28 | the app with your account settings, a QR code is displayed which can be scanned 
 29 | with the mobile phone camera.
 30 | 
 31 | The Yubikey driver uses the Yubico Validation Service either by using the public 
 32 | YubiCloud API or another locally hosted verification server. The host(s) to use 
 33 | for validation are configurable.
 34 | 
 35 | 
 36 | Storage Backends
 37 | ----------------
 38 | 
 39 | Some authentication methods require to store secret data per user account on the 
 40 | server. For this, one of different storage backends can be selected:
 41 | 
 42 | **Roundcube**
 43 | 
 44 | The simplest way is to store authentication secrets and configuration in the 
 45 | user preferences of Roundcube itself.
 46 | 
 47 | **LDAP**
 48 | 
 49 | For an external storage option, the LDAP module can be used. This keeps the 
 50 | authentication data separated from the Roundcube user database. See //LDAP Storage// 
 51 | below for more information. The LDAP connection parameters are defined through the 
 52 | `kolab_2fa_storage_config` config option.
 53 | 
 54 | 
 55 | Installation
 56 | ------------
 57 | 
 58 | After placing the plugin contents into Roundcube's plugins directory, the 3rd party 
 59 | libraries need to be installed using Composer:
 60 | 
 61 | ```
 62 | $ composer require "endroid/qrcode" "~1.5.0" --no-update
 63 | $ composer require "spomky-labs/otphp" "~5.0.0" --no-update
 64 | $ composer require "enygma/yubikey" "~3.2"
 65 | ```
 66 | 
 67 | See the `composer.json` file for the actual module names and versions.
 68 | 
 69 | 
 70 | Configuration
 71 | -------------
 72 | 
 73 | Copy the sample `config.inc.php.dist` file into `config.inc.php` and adjust the 
 74 | settings according to your desired setup. All options are described with inline 
 75 | comments directly in the sample file.
 76 | 
 77 | When using the LDAP storage together with a Kolab installation, you may want to save 
 78 | an additional LDAP lookup for authentication factors on every login, the LDAP driver 
 79 | can assign roles to the user record when registering authentication factors
 80 | (see `user_roles` storage config option). With the following additions to the 
 81 | `kolab_auth` plugin config, these roles can be used to determine whether the user 
 82 | has multi-factor authentication enabled:
 83 | 
 84 | ```
 85 | // Disable lokkups by default:
 86 | $config['kolab_2fa_check'] = false;
 87 | 
 88 | // Enable 2nd factor lookup on a role-by-role basis
 89 | $config['kolab_auth_role_settings'] = array(
 90 |     'cn=totp-user,dc=example,dc=org' => array(
 91 |         'kolab_2fa_check' => array(
 92 |             'mode' => 'override',
 93 |             'value' => true,
 94 |         ),
 95 |     ),
 96 | );
 97 | ```
 98 | 
 99 | LDAP Storage
100 | ------------
101 | 
102 | Define an `organizationalunit` with DN `ou=Tokens,dc=example,dc=org` to store 
103 | all authentication tokens.
104 | 
105 | For token records, the [[https://git.fedorahosted.org/cgit/freeipa.git/tree/install/share/70ipaotp.ldif | FreeIPA OTP schema]] 
106 | can be used. Please install this schema in your Kolab LDAP directory.
107 | 
108 | This is an example record for a TOTP token registered to user doe@example.org:
109 | 
110 | ```
111 | dn: ipatokenUniqueID=totp:c4a1ced768a0da55df662e73,ou=Tokens,dc=example,dc=org
112 | objectClass: top
113 | objectClass: ipaToken
114 | objectClass: ipatokenTOTP
115 | objectClass: ldapSubEntry
116 | cn: Mobile App (TOTP)
117 | ipatokenUniqueID: totp:c4a1ced768a0da55df662e73
118 | ipatokenOwner: uid=doe,ou=People,dc=example,dc=org
119 | ipatokenNotBefore: 201506110211Z
120 | ipatokenOTPkey: 4T5CI7SOKWYQ5JTM
121 | ipatokenDisabled: TRUE
122 | ```
123 | 
124 | 
125 | 


--------------------------------------------------------------------------------
/bin/synchronise_with_source.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | ####
  3 | # Dowloads latest state of source repository and updates this one.
  4 | ####
  5 | # @author stev leibelt <artodeto@bazzline.net>
  6 | # @since 2021-02-01
  7 | ####
  8 | 
  9 | function _cleanup_root ()
 10 | {
 11 | 	local STRING_LENGTH_PATH_OF_THE_ROOT=$((${#PATH_TO_THE_ROOT} + 1)) #we have to add +1 to remove the "/"
 12 | 
 13 | 	if [[ ${DEBUG} -eq 1 ]];
 14 | 	then
 15 | 		echo ":: PATH_OF_THIS_FILE >>${PATH_OF_THIS_FILE}<<."
 16 | 		echo ":: PATH_TO_THE_ROOT >>${PATH_TO_THE_ROOT}<<."
 17 | 		echo ":: STRING_LENGTH_PATH_OF_THE_ROOT >>${STRING_LENGTH_PATH_OF_THE_ROOT}<<."
 18 | 	fi
 19 | 
 20 | 	for ITEM_PATH in ${PATH_TO_THE_ROOT}/*
 21 | 	do
 22 | 		ITEM_NAME="${ITEM_PATH:${STRING_LENGTH_PATH_OF_THE_ROOT}}"
 23 | 
 24 | 		if [[ ${ITEM_NAME} != "bin" ]];
 25 | 		then
 26 | 			if [[ ${DEBUG} -eq 1 ]];
 27 | 			then
 28 | 				echo ":: Delete >>${ITEM_PATH}<<"
 29 | 			fi
 30 | 			rm -fr ${ITEM_PATH}
 31 | 		else
 32 | 			if [[ ${DEBUG} -eq 1 ]];
 33 | 			then
 34 | 				echo ":: Keep >>${ITEM_PATH}<<"
 35 | 			fi
 36 | 		fi
 37 | 	done
 38 | }
 39 | 
 40 | function _copy_source_to_root ()
 41 | {
 42 | 	if [[ ${DEBUG} -eq 1 ]];
 43 | 	then
 44 | 		echo ":: Copy content of >>${PATH_TO_THE_PLUGIN_SOURCE}<< to >>${PATH_TO_THE_ROOT}<<"
 45 | 	fi
 46 | 
 47 | 	cp -a ${PATH_TO_THE_PLUGIN_SOURCE}/* ${PATH_TO_THE_ROOT}
 48 | }
 49 | 
 50 | function _update_readme ()
 51 | {
 52 | 	if [[ ${DEBUG} -eq 1 ]];
 53 | 	then
 54 | 		echo ":: Prefixing >>${PATH_TO_THE_ROOT_README}<< with important information."
 55 | 	fi
 56 | 
 57 | 	cat > ${PATH_TO_THE_ROOT_README} <<DELIM
 58 | IMPORTANT INFORMATION
 59 | =====================
 60 | 
 61 | > This is a clone from https://git.kolab.org/diffusion/RPK/  
 62 | > For bug reports and pull requests, please go to https://kolab.org/
 63 | 
 64 | How to upgrade this clone
 65 | =========================
 66 | 
 67 | Execute the [synchronise_with_source.sh](bin/synchronise_with_source.sh) shell script.
 68 | 
 69 | DELIM
 70 | 
 71 | 	if [[ ${DEBUG} -eq 1 ]];
 72 | 	then
 73 | 		echo ":: Attaching content of >>${PATH_TO_THE_SOURCE_README}<< to >>${PATH_TO_THE_ROOT}<<."
 74 | 	fi
 75 | 
 76 | 	cat ${PATH_TO_THE_SOURCE_README} >> ${PATH_TO_THE_ROOT_README}
 77 | }
 78 | 
 79 | function _update_source ()
 80 | {
 81 | 	if [[ -d "${PATH_TO_THE_SOURCE}" ]];
 82 | 	then
 83 | 		if [[ ${DEBUG} -eq 1 ]];
 84 | 		then
 85 | 			echo ":: Source path exists."
 86 | 			echo ":: Removing >>${PATH_TO_THE_SOURCE}<<."
 87 | 		fi
 88 | 		rm -fr "${PATH_TO_THE_SOURCE}"
 89 | 	fi
 90 | 
 91 | 	if [[ ${DEBUG} -eq 1 ]];
 92 | 	then
 93 | 		echo ":: Creating path >>${PATH_TO_THE_SOURCE}<<."
 94 | 		echo ":: Cloning repository into >>${PATH_TO_THE_SOURCE}<<."
 95 | 	fi
 96 | 
 97 | 	mkdir -p "${PATH_TO_THE_SOURCE}"
 98 | 
 99 | 	cd "${PATH_TO_THE_SOURCE}"
100 | 
101 | 	$(git clone https://git.kolab.org/diffusion/RPK/roundcubemail-plugins-kolab.git .)
102 | 
103 | 	LATEST_SOURCE_TAG=$(git tag | grep roundcubemail | sort -n | tail -n 1)
104 | 
105 | 	if [[ ${LATEST_SOURCE_TAG} == ${LATEST_TAG} ]];
106 | 	then
107 | 		echo ":: No new tag available."
108 | 		echo "   Latest source tag >>${LATEST_SOURCE_TAG}<<."
109 | 		echo "   Is equal to latest tag >>${LATEST_TAG}<<."
110 | 
111 | 		echo ""
112 | 		cd -
113 | 
114 | 		exit
115 | 		echo "   Aborting"
116 | 	fi
117 | 
118 | 	if [[ ${DEBUG} -eq 1 ]];
119 | 	then
120 | 		echo ":: Switching to latest tag >>${LATEST_SOURCE_TAG}<<."
121 | 	fi
122 | 
123 | 	git checkout ${LATEST_SOURCE_TAG}
124 | 
125 | 	cd -
126 | }
127 | 
128 | function synchronise_from_source_repository ()
129 | {
130 | 	#bo: variable declaration
131 | 	##independent section
132 | 	local CURRENT_WORKING_DIRECTORY=$(pwd)
133 | 	local DEBUG=0
134 | 	local PATH_OF_THIS_FILE=$(cd $(dirname "${BASH_SOURCE[0]}"); pwd)
135 | 	local LATEST_TAG=$(git tag | sort -n | tail -n 1)
136 | 
137 | 	##dependent section
138 | 	local PATH_TO_THE_ROOT=$(cd "${PATH_OF_THIS_FILE}/../"; pwd)
139 | 	local PATH_TO_THE_SOURCE="${PATH_OF_THIS_FILE}/data/source"
140 | 
141 | 	local PATH_TO_THE_PLUGIN_SOURCE="${PATH_TO_THE_SOURCE}/plugins/kolab_2fa"
142 | 
143 | 	local PATH_TO_THE_ROOT_README="${PATH_TO_THE_ROOT}/README.md"
144 | 	local PATH_TO_THE_SOURCE_README="${PATH_TO_THE_PLUGIN_SOURCE}/README.md"
145 | 	#eo: variable declaration
146 | 
147 | 	#bo: business logic
148 | 	_cleanup_root
149 | 	_update_source
150 | 	_copy_source_to_root
151 | 	_update_readme
152 | 	echo ""
153 | 	echo ":: Done"
154 | 	echo "   Please create latest tag >>${LATEST_SOURCE_TAG}<<."
155 | 	#eo: business logic
156 | }
157 | 
158 | synchronise_from_source_repository
159 | 


--------------------------------------------------------------------------------
/composer.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "name": "kolab/kolab_2fa",
 3 |     "type": "roundcube-plugin",
 4 |     "description": "Kolab 2-Factor Authentication",
 5 |     "homepage": "https://git.kolab.org/diffusion/RPK/",
 6 |     "license": "AGPL-3.0-or-later",
 7 |     "authors": [
 8 |         {
 9 |             "name": "Thomas Bruederli",
10 |             "email": "thomas@roundcube.net",
11 |             "role": "Developer"
12 |         },
13 |         {
14 |             "name": "Aleksander Machniak",
15 |             "email": "machniak@kolabsys.com",
16 |             "role": "Lead"
17 |         }
18 |     ],
19 |     "repositories": [
20 |         {
21 |             "type": "composer",
22 |             "url": "https://plugins.roundcube.net"
23 |         }
24 |     ],
25 |     "require": {
26 |         "php": ">=5.3.0",
27 |         "roundcube/plugin-installer": "~0.2.0",
28 |         "spomky-labs/otphp": "~5.0.0",
29 |         "endroid/qr-code": "~1.6.5",
30 |         "enygma/yubikey": "~3.2"
31 |     }
32 | }
33 | 


--------------------------------------------------------------------------------
/config.inc.php.dist:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /**
  4 |  * Kolab 2-Factor-Authentication plugin configuration
  5 |  *
  6 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  7 |  *
  8 |  * This program is free software: you can redistribute it and/or modify
  9 |  * it under the terms of the GNU Affero General Public License as
 10 |  * published by the Free Software Foundation, either version 3 of the
 11 |  * License, or (at your option) any later version.
 12 |  *
 13 |  * This program is distributed in the hope that it will be useful,
 14 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 15 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 16 |  * GNU Affero General Public License for more details.
 17 |  *
 18 |  * You should have received a copy of the GNU Affero General Public License
 19 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
 20 |  */
 21 | 
 22 | // available methods/providers. Supported methods are: 'totp','hotp','yubikey'
 23 | $config['kolab_2fa_drivers'] = array('totp');
 24 | 
 25 | // backend for storing 2-factor-auth related per-user settings
 26 | // available backends are: 'roundcube', 'ldap', 'sql'
 27 | $config['kolab_2fa_storage'] = 'roundcube';
 28 | 
 29 | // additional config options for the above storage backend
 30 | // here an example for the LDAP backend:
 31 | $config['kolab_2fa_storage_config'] = array(
 32 |     'debug'     => false,
 33 |     'hosts'     => array('localhost'),
 34 |     'port'      => 389,
 35 |     'bind_dn'   => 'uid=kolab-auth-service,ou=Special Users,dc=example,dc=org',
 36 |     'bind_pass' => 'Welcome2KolabSystems',
 37 |     'base_dn'   => 'ou=Tokens,dc=example,dc=org',
 38 |     // filter used to list stored factors for a user
 39 |     'filter'    => '(&(objectClass=ipaToken)(objectclass=ldapSubEntry)(ipatokenOwner=%fu))',
 40 |     'scope'     => 'sub',
 41 |     // translates driver properties to LDAP attributes
 42 |     'fieldmap'  => array(
 43 |         'label'    => 'cn',
 44 |         'id'       => 'ipatokenUniqueID',
 45 |         'active'   => 'ipatokenDisabled',
 46 |         'created'  => 'ipatokenNotBefore',
 47 |         'userdn'   => 'ipatokenOwner',
 48 |         'secret'   => 'ipatokenOTPkey',
 49 |         // HOTP attributes
 50 |         'counter'  => 'ipatokenHOTPcounter',
 51 |         'digest'   => 'ipatokenOTPalgorithm',
 52 |         'digits'   => 'ipatokenOTPdigits',
 53 |     ),
 54 |     // LDAP object classes derived from factor IDs (prefix)
 55 |     // will be translated into the %c placeholder
 56 |     'classmap' => array(
 57 |         'totp:' => 'ipatokenTOTP',
 58 |         'hotp:' => 'ipatokenHOTP',
 59 |         '*'     => 'ipaToken',
 60 |     ),
 61 |     // translates property values into LDAP attribute values and vice versa
 62 |     'valuemap' => array(
 63 |         'active' => array(
 64 |             false   => 'TRUE',
 65 |             true    => 'FALSE',
 66 |         ),
 67 |     ),
 68 |     // specify non-string data types for properties for implicit conversion
 69 |     'attrtypes' => array(
 70 |         'created' => 'datetime',
 71 |         'counter' => 'integer',
 72 |         'digits'  => 'integer',
 73 |     ),
 74 |     // apply these default values to factor records if not specified by the drivers
 75 |     'defaults' => array(
 76 |         'active' => false,
 77 |         // these are required for ipatokenHOTP records and should match the kolab_2fa_hotp parameters
 78 |         'digest' => 'sha1',
 79 |         'digits' => 6,
 80 |     ),
 81 |     // use this LDAP attribute to compose DN values for factor entries
 82 |     'rdn'       => 'ipatokenUniqueID',
 83 |     // assign these object classes to new factor entries
 84 |     'objectclass' => array(
 85 |         'top',
 86 |         'ipaToken',
 87 |         '%c',
 88 |         'ldapSubEntry',
 89 |     ),
 90 |     // add these roles to the user's LDAP record if key prefix-matches a factor entry
 91 |     'user_roles' => array(
 92 |         'totp:' => 'cn=totp-user,dc=example,dc=org',
 93 |         'hotp:' => 'cn=hotp-user,dc=example,dc=org',
 94 |     ),
 95 | );
 96 | 
 97 | // force a lookup for active authentication factors for this user.
 98 | // to be set by another plugin (e.g. kolab_auth based on LDAP roles)
 99 | // $config['kolab_2fa_check'] = true;
100 | 
101 | // timeout for 2nd factor auth submission (in seconds)
102 | $config['kolab_2fa_timeout'] = 120;
103 | 
104 | // configuration parameters for TOTP (uncomment to adjust)
105 | $config['kolab_2fa_totp'] = array(
106 |     // 'digits'   => 6,
107 |     // 'interval' => 30,
108 |     // 'digest'   => 'sha1',
109 |     // 'issuer'   => 'Roundcube',
110 | );
111 | 
112 | // configuration parameters for HOTP (uncomment to adjust)
113 | $config['kolab_2fa_hotp'] = array(
114 |     // 'digits' => 6,
115 |     // 'window' => 4,
116 |     // 'digest' => 'sha1',
117 | );
118 | 
119 | // configuration parameters for Yubikey (uncomment to adjust)
120 | $config['kolab_2fa_yubikey'] = array(
121 |     'clientid' => '123456',
122 |     'apikey' => '<your-server-api-key>',
123 |     // 'hosts'  => array('api.myhost1.com','api2.myhost.com'),
124 |     'use_https' => true,  // connect via https if set to true
125 | );


--------------------------------------------------------------------------------
/kolab2fa.js:
--------------------------------------------------------------------------------
  1 | /**
  2 |  * Kolab 2-Factor-Authentication plugin client functions
  3 |  *
  4 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
  5 |  *
  6 |  * @licstart  The following is the entire license notice for the
  7 |  * JavaScript code in this page.
  8 |  *
  9 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
 10 |  *
 11 |  * This program is free software: you can redistribute it and/or modify
 12 |  * it under the terms of the GNU Affero General Public License as
 13 |  * published by the Free Software Foundation, either version 3 of the
 14 |  * License, or (at your option) any later version.
 15 |  *
 16 |  * This program is distributed in the hope that it will be useful,
 17 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 18 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 19 |  * GNU Affero General Public License for more details.
 20 |  *
 21 |  * You should have received a copy of the GNU Affero General Public License
 22 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
 23 |  *
 24 |  * @licend  The above is the entire license notice
 25 |  * for the JavaScript code in this page.
 26 |  */
 27 | 
 28 | window.rcmail && rcmail.addEventListener('init', function(evt) {
 29 |     var highsec_call_stack = [];
 30 |     var highsec_dialog;
 31 |     var factor_dialog;
 32 | 
 33 |     if (!rcmail.env.kolab_2fa_factors) {
 34 |         rcmail.env.kolab_2fa_factors = {};
 35 |     }
 36 | 
 37 |     /**
 38 |      * Equivalend of PHP time()
 39 |      */
 40 |     function time() {
 41 |         return Math.round(new Date().getTime() / 1000);
 42 |     }
 43 | 
 44 |     /**
 45 |      * Render the settings UI
 46 |      */
 47 |     function render() {
 48 |         var table = $('#kolab2fa-factors tbody');
 49 |         table.html('');
 50 | 
 51 |         var rows = 0;
 52 |         $.each(rcmail.env.kolab_2fa_factors, function(id, props) {
 53 |             if (props.active) {
 54 |                 var tr = $('<tr>').addClass(props.method).appendTo(table),
 55 |                     button = $('<a class="button icon delete">').attr({href: '#', rel: id})
 56 |                         .append($('<span class="inner">').text(rcmail.get_label('remove','kolab_2fa')));
 57 | 
 58 |                 $('<td>').addClass('name').text(props.label || props.name).appendTo(tr);
 59 |                 $('<td>').addClass('created').text(props.created || '??').appendTo(tr);
 60 |                 $('<td>').addClass('actions buttons-cell').append(button).appendTo(tr);
 61 |                 rows++;
 62 |             }
 63 |         });
 64 | 
 65 |         table.parent()[(rows > 0 ? 'show' : 'hide')]();
 66 |     }
 67 | 
 68 |     /**
 69 |      * Open dialog to add the given authentication factor
 70 |      */
 71 |     function add_factor(method) {
 72 |         var lock, form = $('#kolab2fa-prop-' + method),
 73 |             props = rcmail.env.kolab_2fa_factors[method];
 74 | 
 75 |         if (form.length) {
 76 |             form.get(0).reset();
 77 |             form.find('img.qrcode').attr('src', 'data:image/gif;base64,R0lGODlhDwAPAIAAAMDAwAAAACH5BAEAAAAALAAAAAAPAA8AQAINhI+py+0Po5y02otnAQA7');
 78 |             form.off('submit');
 79 | 
 80 |             factor_dialog = rcmail.show_popup_dialog(
 81 |                 form.show(),
 82 |                 rcmail.get_label('addfactor', 'kolab_2fa'),
 83 |                 [
 84 |                     {
 85 |                         text: rcmail.gettext('save', 'kolab_2fa'),
 86 |                         'class': 'mainaction save',
 87 |                         click: function(e) {
 88 |                             save_data(method);
 89 |                         }
 90 |                     },
 91 |                     {
 92 |                         text: rcmail.gettext('cancel'),
 93 |                         'class': 'cancel',
 94 |                         click: function() {
 95 |                             factor_dialog.dialog('close');
 96 |                         }
 97 |                     }
 98 |                 ],
 99 |                 {
100 |                     open: function(event, ui) {
101 |                         $(event.target).find('input[name="_verify_code"]').keypress(function(e) {
102 |                             if (e.which == 13) {
103 |                                 $(e.target).closest('.ui-dialog').find('button.mainaction').click();
104 |                             }
105 |                         });
106 |                     },
107 |                     close: function(event, ui) {
108 |                         form.hide().appendTo(document.body);
109 |                         factor_dialog = null;
110 |                     }
111 |                 }
112 |             )
113 |             .data('method', method)
114 |             .data('timestamp', time());
115 | 
116 |             form.on('submit', function(e) {
117 |                 save_data(method);
118 |                 return false;
119 |             });
120 | 
121 |             // load generated data
122 |             lock = rcmail.set_busy(true, 'loading');
123 |             rcmail.http_post('plugin.kolab-2fa-data', { _method: method }, lock);
124 |         }
125 |     }
126 | 
127 |     /**
128 |      * Remove the given factor from the account
129 |      */
130 |     function remove_factor(id) {
131 |         if (rcmail.env.kolab_2fa_factors[id]) {
132 |             rcmail.env.kolab_2fa_factors[id].active = false;
133 |         }
134 |         render();
135 | 
136 |         var lock = rcmail.set_busy(true, 'saving');
137 |         rcmail.http_post('plugin.kolab-2fa-save', { _method: id, _data: 'false' }, lock);
138 |     }
139 | 
140 |     /**
141 |      * Submit factor settings form
142 |      */
143 |     function save_data(method) {
144 |         var lock, data, form = $('#kolab2fa-prop-' + method),
145 |             verify = form.find('input[name="_verify_code"]');
146 | 
147 |         if (verify.length && !verify.val().length) {
148 |             alert(rcmail.get_label('verifycodemissing','kolab_2fa'));
149 |             verify.select();
150 |             return false;
151 |         }
152 | 
153 |         data = form_data(form);
154 |         lock = rcmail.set_busy(true, 'saving');
155 |         rcmail.http_post('plugin.kolab-2fa-save', {
156 |             _method: data.id || method,
157 |             _data: JSON.stringify(data),
158 |             _verify_code: verify.val(),
159 |             _timestamp: factor_dialog ? factor_dialog.data('timestamp') : null
160 |         }, lock);
161 |     }
162 | 
163 |     /**
164 |      * Collect all factor properties from the form
165 |      */
166 |     function form_data(form)
167 |     {
168 |         var data = {};
169 |         form.find('input, select').each(function(i, elem) {
170 |             if (elem.name.indexOf('_prop') === 0) {
171 |                 k = elem.name.match(/\[([a-z0-9_.-]+)\]$/i) ? RegExp.$1 : null;
172 |                 if (k) {
173 |                     data[k] = elem.tagName == 'SELECT' ? $('option:selected', elem).val() : $(elem).val();
174 |                 }
175 |             }
176 |         });
177 | 
178 |         return data;
179 |     }
180 | 
181 |     /**
182 |      * Execute the given function after the user authorized the session with a 2nd factor
183 |      */
184 |     function require_high_security(func, exclude)
185 |     {
186 |         // request 2nd factor auth
187 |         if (!rcmail.env.session_secured || rcmail.env.session_secured < time() - 120) {
188 |             var method, name;
189 | 
190 |             // find an active factor
191 |             $.each(rcmail.env.kolab_2fa_factors, function(id, prop) {
192 |                 if (prop.active && !method || method == exclude) {
193 |                     method = id;
194 |                     name = prop.label || prop.name;
195 |                     if (!exclude || id !== exclude) {
196 |                         return true;
197 |                     }
198 |                 }
199 |             });
200 | 
201 |             // we have a registered factor, use it
202 |             if (method) {
203 |                 highsec_call_stack.push(func);
204 | 
205 |                 // TODO: list all active factors to choose from
206 |                 var html = String($('#kolab2fa-highsecuritydialog').html()).replace('$name', name);
207 | 
208 |                 highsec_dialog = rcmail.show_popup_dialog(
209 |                     html,
210 |                     rcmail.get_label('highsecurityrequired', 'kolab_2fa'),
211 |                     [
212 |                         {
213 |                             text: rcmail.gettext('enterhighsecurity', 'kolab_2fa'),
214 |                             click: function(e) {
215 |                                 var lock, code = highsec_dialog.find('input[name="_code"]').val();
216 | 
217 |                                 if (code && code.length) {
218 |                                     lock = rcmail.set_busy(true, 'verifying');
219 |                                     rcmail.http_post('plugin.kolab-2fa-verify', {
220 |                                         _method: method,
221 |                                         _code: code,
222 |                                         _session: 1,
223 |                                         _timestamp: highsec_dialog.data('timestamp')
224 |                                     }, lock);
225 |                                 }
226 |                                 else {
227 |                                     highsec_dialog.find('input[name="_code"]').select();
228 |                                 }
229 |                             },
230 |                             'class': 'mainaction save'
231 |                         },
232 |                         {
233 |                             text: rcmail.gettext('cancel'),
234 |                             'class': 'cancel',
235 |                             click: function() {
236 |                                 highsec_dialog.dialog('close');
237 |                             }
238 |                         }
239 |                     ],
240 |                     {
241 |                         open: function(event, ui) {
242 |                             // submit code on <Enter>
243 |                             $(event.target).find('input[name="_code"]').keypress(function(e) {
244 |                                 if (e.which == 13) {
245 |                                     $(e.target).closest('.ui-dialog').find('button.mainaction').click();
246 |                                 }
247 |                             }).select();
248 |                         },
249 |                         close: function(event, ui) {
250 |                             $(this).remove();
251 |                             highsec_dialog = null;
252 |                             highsec_call_stack.pop();
253 |                         }
254 |                     }
255 |                 ).data('timestamp', time());
256 | 
257 |                 return false;
258 |             }
259 |         }
260 | 
261 |         // just trigger the callback
262 |         func.call(this);
263 |     };
264 | 
265 |     // callback for factor data provided by the server
266 |     rcmail.addEventListener('plugin.render_data', function(data) {
267 |         var method = data.method,
268 |             form = $('#kolab2fa-prop-' + method);
269 | 
270 |         if (form.length) {
271 |             $.each(data, function(field, value) {
272 |                 form.find('[name="_prop[' + field + ']"]').val(value);
273 |             });
274 | 
275 |             if (data.qrcode) {
276 |                 $('img.qrcode[rel='+method+']').attr('src', "data:image/png;base64," + data.qrcode);
277 |             }
278 |         }
279 |         else if (window.console) {
280 |             console.error("Cannot assign auth data", data);
281 |         }
282 |     });
283 | 
284 |     // callback for save action
285 |     rcmail.addEventListener('plugin.save_success', function(data) {
286 |         if (!data.active && rcmail.env.kolab_2fa_factors[data.id]) {
287 |             delete rcmail.env.kolab_2fa_factors[data.id];
288 |         }
289 |         else if (rcmail.env.kolab_2fa_factors[data.id]) {
290 |             $.extend(rcmail.env.kolab_2fa_factors[data.id], data);
291 |         }
292 |         else {
293 |             rcmail.env.kolab_2fa_factors[data.id] = data;
294 |         }
295 | 
296 |         if (factor_dialog) {
297 |             factor_dialog.dialog('close');
298 |         }
299 | 
300 |         render();
301 |     });
302 | 
303 |     // callback for verify action
304 |     rcmail.addEventListener('plugin.verify_response', function(data) {
305 |         // execute high-security call stack and close dialog
306 |         if (data.success && highsec_dialog && highsec_dialog.is(':visible')) {
307 |             var func;
308 |             while (highsec_call_stack.length) {
309 |                 func = highsec_call_stack.pop();
310 |                 func();
311 |             }
312 | 
313 |             highsec_dialog.dialog('close');
314 |             rcmail.env.session_secured = time();
315 |         }
316 |         else {
317 |             rcmail.display_message(data.message, data.success ? 'confirmation' : 'warning');
318 | 
319 |             if (highsec_dialog && highsec_dialog.is(':visible')) {
320 |                 highsec_dialog.find('input[name="_code"]').val('').select();
321 |             }
322 |             else {
323 |                 $('#kolab2fa-prop-' + data.method + ' input.k2fa-verify').val('').select();
324 |             }
325 |         }
326 |     });
327 | 
328 |     // callback for save failure
329 |     rcmail.addEventListener('plugin.reset_form', function(method) {
330 |         if (rcmail.env.kolab_2fa_factors[method]) {
331 |             rcmail.env.kolab_2fa_factors[method].active = false;
332 |         }
333 | 
334 |         render();
335 |     });
336 | 
337 |     // handler for selections
338 |     $('#kolab2fa-add').change(function() {
339 |         var method = $('option:selected', this).val();
340 | 
341 |         // require auth verification
342 |         require_high_security(function() {
343 |             add_factor(method);
344 |         });
345 | 
346 |         this.selectedIndex = 0;
347 |     });
348 | 
349 |     // handler for delete button clicks
350 |     $('#kolab2fa-factors tbody').on('click', '.button.delete', function(e) {
351 |         var id = $(this).attr('rel');
352 | 
353 |         // require auth verification
354 |         require_high_security(function() {
355 |             if (confirm(rcmail.get_label('authremoveconfirm', 'kolab_2fa'))) {
356 |                 remove_factor(id);
357 |             }
358 |         }, id);
359 | 
360 |         return false;
361 |     });
362 | 
363 |     // submit verification code on <Enter>
364 |     $('.propform input.k2fa-verify').keypress(function(e) {
365 |         if (e.which == 13) {
366 |             $(this).closest('.propform').find('.button.verify').click();
367 |         }
368 |     });
369 | 
370 |     // render list initially
371 |     render();
372 | });


--------------------------------------------------------------------------------
/kolab_2fa.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /**
  4 |  * Kolab 2-Factor-Authentication plugin
  5 |  *
  6 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
  7 |  *
  8 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  9 |  *
 10 |  * This program is free software: you can redistribute it and/or modify
 11 |  * it under the terms of the GNU Affero General Public License as
 12 |  * published by the Free Software Foundation, either version 3 of the
 13 |  * License, or (at your option) any later version.
 14 |  *
 15 |  * This program is distributed in the hope that it will be useful,
 16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 18 |  * GNU Affero General Public License for more details.
 19 |  *
 20 |  * You should have received a copy of the GNU Affero General Public License
 21 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
 22 |  */
 23 | 
 24 | class kolab_2fa extends rcube_plugin
 25 | {
 26 |     public $task = '(login|settings)';
 27 | 
 28 |     protected $login_verified = null;
 29 |     protected $login_factors = array();
 30 |     protected $drivers = array();
 31 |     protected $storage;
 32 | 
 33 |     /**
 34 |      * Plugin init
 35 |      */
 36 |     public function init()
 37 |     {
 38 |         $this->load_config();
 39 |         $this->add_hook('startup', array($this, 'startup'));
 40 |     }
 41 | 
 42 |     /**
 43 |      * Startup hook
 44 |      */
 45 |     public function startup($args)
 46 |     {
 47 |         $rcmail = rcmail::get_instance();
 48 | 
 49 |         // register library namespace to autoloader
 50 |         $loader = include(INSTALL_PATH . 'vendor/autoload.php');
 51 |         $loader->set('Kolab2FA', array($this->home . '/lib'));
 52 | 
 53 |         if ($args['task'] === 'login' && $this->api->output) {
 54 |             $this->add_texts('localization/', false);
 55 |             $this->add_hook('authenticate', array($this, 'authenticate'));
 56 | 
 57 |             // process 2nd factor auth step after regular login
 58 |             if ($args['action'] === 'plugin.kolab-2fa-login' /* || !empty($_SESSION['kolab_2fa_factors']) */) {
 59 |                 return $this->login_verify($args);
 60 |             }
 61 |         }
 62 |         else if ($args['task'] === 'settings') {
 63 |             $this->add_texts('localization/', !$this->api->output->ajax_call);
 64 |             $this->add_hook('settings_actions', array($this, 'settings_actions'));
 65 |             $this->register_action('plugin.kolab-2fa', array($this, 'settings_view'));
 66 |             $this->register_action('plugin.kolab-2fa-data', array($this, 'settings_data'));
 67 |             $this->register_action('plugin.kolab-2fa-save', array($this, 'settings_save'));
 68 |             $this->register_action('plugin.kolab-2fa-verify', array($this, 'settings_verify'));
 69 |         }
 70 | 
 71 |         return $args;
 72 |     }
 73 | 
 74 |     /**
 75 |      * Handler for 'authenticate' plugin hook.
 76 |      *
 77 |      * ATTENTION: needs to be called *after* kolab_auth::authenticate()
 78 |      */
 79 |     public function authenticate($args)
 80 |     {
 81 |         // nothing to be done for me
 82 |         if ($args['abort'] || $this->login_verified !== null) {
 83 |             return $args;
 84 |         }
 85 | 
 86 |         $rcmail = rcmail::get_instance();
 87 | 
 88 |         // parse $host URL
 89 |         $a_host = parse_url($args['host']);
 90 |         $hostname = $_SESSION['hostname'] = $a_host['host'] ?: $args['host'];
 91 | 
 92 |         // 1. find user record (and its prefs) before IMAP login
 93 |         if ($user = rcube_user::query($args['user'], $hostname)) {
 94 |             $rcmail->config->set_user_prefs($user->get_prefs());
 95 |         }
 96 | 
 97 |         // 2a. let plugins provide the list of active authentication factors
 98 |         $lookup = $rcmail->plugins->exec_hook('kolab_2fa_lookup', array(
 99 |             'user'    => $args['user'],
100 |             'host'    => $hostname,
101 |             'factors' => $rcmail->config->get('kolab_2fa_factors'),
102 |             'check'   => $rcmail->config->get('kolab_2fa_check', true),
103 |         ));
104 |         if (isset($lookup['factors'])) {
105 |             $factors = (array)$lookup['factors'];
106 |         }
107 |         // 2b. check storage if this user has 2FA enabled
108 |         else if ($lookup['check'] !== false && ($storage = $this->get_storage($args['user']))) {
109 |             $factors = (array)$storage->enumerate();
110 |         }
111 | 
112 |         if (count($factors) > 0) {
113 |             $args['abort'] = true;
114 |             $factors = array_unique($factors);
115 | 
116 |             // 3. flag session for 2nd factor verification
117 |             $_SESSION['kolab_2fa_time']    = time();
118 |             $_SESSION['kolab_2fa_nonce']   = bin2hex(openssl_random_pseudo_bytes(32));
119 |             $_SESSION['kolab_2fa_factors'] = $factors;
120 | 
121 |             $_SESSION['username'] = $args['user'];
122 |             $_SESSION['host']     = $args['host'];
123 |             $_SESSION['password'] = $rcmail->encrypt($args['pass']);
124 | 
125 |             // 4. render to 2nd auth step
126 |             $this->login_step($factors);
127 |         }
128 | 
129 |         return $args;
130 |     }
131 | 
132 |     /**
133 |      * Handler for the additional login step requesting the 2FA verification code
134 |      */
135 |     public function login_step($factors)
136 |     {
137 |         // replace handler for login form
138 |         $this->login_factors = array_values($factors);
139 |         $this->api->output->add_handler('loginform', array($this, 'auth_form'));
140 | 
141 |         // focus the code input field on load
142 |         $this->api->output->add_script('$("input.kolab2facode").first().select();', 'docready');
143 | 
144 |         $this->api->output->send('login');
145 |     }
146 | 
147 |     /**
148 |      * Process the 2nd factor code verification form submission
149 |      */
150 |     public function login_verify($args)
151 |     {
152 |         $rcmail = rcmail::get_instance();
153 | 
154 |         $time  = $_SESSION['kolab_2fa_time'];
155 |         $nonce = $_SESSION['kolab_2fa_nonce'];
156 |         $factors = (array)$_SESSION['kolab_2fa_factors'];
157 | 
158 |         $this->login_verified = false;
159 |         $expired = $time < time() - $rcmail->config->get('kolab_2fa_timeout', 120);
160 | 
161 |         if (!empty($factors) && !empty($nonce) && !$expired) {
162 |             // TODO: check signature
163 | 
164 |             // try to verify each configured factor
165 |             foreach ($factors as $factor) {
166 |                 list($method) = explode(':', $factor, 2);
167 | 
168 |                 // verify the submitted code
169 |                 $code = rcube_utils::get_input_value("_${nonce}_${method}", rcube_utils::INPUT_POST);
170 |                 $this->login_verified = $this->verify_factor_auth($factor, $code);
171 | 
172 |                 // accept first successful method
173 |                 if ($this->login_verified) {
174 |                     break;
175 |                 }
176 |             }
177 |         }
178 | 
179 |         if ($this->login_verified) {
180 |             // restore POST data from session
181 |             $_POST['_user'] = $_SESSION['username'];
182 |             $_POST['_host'] = $_SESSION['host'];
183 |             $_POST['_pass'] = $rcmail->decrypt($_SESSION['password']);
184 |         }
185 | 
186 |         // proceed with regular login ...
187 |         $args['action'] = 'login';
188 | 
189 |         // session data will be reset in index.php thus additional
190 |         // auth attempts with intercepted data will be rejected
191 |         // $rcmail->kill_session();
192 | 
193 |         // we can't display any custom error messages on failed login
194 |         // but that's actually desired to expose as little information as possible
195 | 
196 |         return $args;
197 |     }
198 |     
199 |     /**
200 |      * Helper method to verify the given method/code tuple
201 |      */
202 |     protected function verify_factor_auth($method, $code)
203 |     {
204 |         if (strlen($code) && ($driver = $this->get_driver($method))) {
205 |             // set properties from login
206 |             $driver->username  = $_SESSION['username'];
207 | 
208 |             try {
209 |                 // verify the submitted code
210 |                 return $driver->verify($code, $_SESSION['kolab_2fa_time']);
211 |             }
212 |             catch (Exception $e) {
213 |                 rcube::raise_error($e, true, false);
214 |             }
215 |         }
216 | 
217 |         return false;
218 |     }
219 | 
220 |     /**
221 |      * Render 2nd factor authentication form in place of the regular login form
222 |      */
223 |     public function auth_form($attrib = array())
224 |     {
225 |         $form_name  = !empty($attrib['form']) ? $attrib['form'] : 'form';
226 |         $nonce = $_SESSION['kolab_2fa_nonce'];
227 | 
228 |         $methods = array_unique(array_map(function($factor) {
229 |                 list($method, $id) = explode(':', $factor);
230 |                 return $method;
231 |             },
232 |             $this->login_factors
233 |         ));
234 | 
235 |         // forward these values as the regular login screen would submit them
236 |         $input_task   = new html_hiddenfield(array('name' => '_task', 'value' => 'login'));
237 |         $input_action = new html_hiddenfield(array('name' => '_action', 'value' => 'plugin.kolab-2fa-login'));
238 |         $input_tzone  = new html_hiddenfield(array('name' => '_timezone', 'id' => 'rcmlogintz', 'value' => rcube_utils::get_input_value('_timezone', rcube_utils::INPUT_POST)));
239 |         $input_url    = new html_hiddenfield(array('name' => '_url', 'id' => 'rcmloginurl', 'value' => rcube_utils::get_input_value('_url', rcube_utils::INPUT_POST)));
240 | 
241 |         // create HTML table with two cols
242 |         $table = new html_table(array('cols' => 2));
243 |         $required = count($methods) > 1 ? null : 'required';
244 | 
245 |         // render input for each configured auth method
246 |         foreach ($methods as $i => $method) {
247 |             if ($row++ > 0) {
248 |                 $table->add(array('colspan' => 2, 'class' => 'title hint', 'style' => 'text-align:center'),
249 |                     $this->gettext('or'));
250 |             }
251 | 
252 |             $field_id = "rcmlogin2fa$method";
253 |             $input_code = new html_inputfield(array(
254 |                     'name'         => "_${nonce}_${method}",
255 |                     'class'        => 'kolab2facode',
256 |                     'id'           => $field_id,
257 |                     'required'     => $required,
258 |                     'autocomplete' => 'off',
259 |                     'data-icon'    => 'key' // for Elastic
260 |                 ) + $attrib);
261 |             $table->add('title', html::label($field_id, html::quote($this->gettext($method))));
262 |             $table->add('input', $input_code->show(''));
263 |         }
264 | 
265 |         $out  = $input_task->show();
266 |         $out .= $input_action->show();
267 |         $out .= $input_tzone->show();
268 |         $out .= $input_url->show();
269 |         $out .= $table->show();
270 | 
271 |         // add submit button
272 |         if (rcube_utils::get_boolean($attrib['submit'])) {
273 |             $out .= html::p('formbuttons', html::tag('button', array(
274 |                     'type'  => 'submit',
275 |                     'id'    => 'rcmloginsubmit',
276 |                     'class' => 'button mainaction save',
277 |                 ), $this->gettext('continue'))
278 |             );
279 |         }
280 | 
281 |         // surround html output with a form tag
282 |         if (empty($attrib['form'])) {
283 |             $out = $this->api->output->form_tag(array('name' => $form_name, 'method' => 'post'), $out);
284 |         }
285 | 
286 |         return $out;
287 |     }
288 | 
289 |     /**
290 |      * Load driver class for the given authentication factor
291 |      *
292 |      * @param string $factor Factor identifier (<method>:<id>)
293 |      * @return Kolab2FA\Driver\Base
294 |      */
295 |     public function get_driver($factor)
296 |     {
297 |         list($method) = explode(':', $factor, 2);
298 | 
299 |         $rcmail = rcmail::get_instance();
300 | 
301 |         if ($this->drivers[$factor]) {
302 |             return $this->drivers[$factor];
303 |         }
304 | 
305 |         $config = $rcmail->config->get('kolab_2fa_' . $method, array());
306 | 
307 |         // use product name as "issuer""
308 |         if (empty($config['issuer'])) {
309 |             $config['issuer'] = $rcmail->config->get('product_name');
310 |         }
311 | 
312 |         try {
313 |             // TODO: use external auth service if configured
314 | 
315 |             $driver = \Kolab2FA\Driver\Base::factory($factor, $config);
316 | 
317 |             // attach storage
318 |             $driver->storage = $this->get_storage();
319 | 
320 |             if ($rcmail->user->ID) {
321 |                 $driver->username  = $rcmail->get_user_name();
322 |             }
323 | 
324 |             $this->drivers[$factor] = $driver;
325 |             return $driver;
326 |         }
327 |         catch (Exception $e) {
328 |             $error = strval($e);
329 |         }
330 | 
331 |         rcube::raise_error(array(
332 |                 'code' => 600,
333 |                 'type' => 'php',
334 |                 'file' => __FILE__,
335 |                 'line' => __LINE__,
336 |                 'message' => $error),
337 |             true, false);
338 | 
339 |         return false;
340 |     }
341 | 
342 |     /**
343 |      * Getter for a storage instance singleton
344 |      */
345 |     public function get_storage($for = null)
346 |     {
347 |         if (!isset($this->storage) || (!empty($for) && $this->storage->username !== $for)) {
348 |             $rcmail = rcmail::get_instance();
349 |             try {
350 |                 $this->storage = \Kolab2FA\Storage\Base::factory(
351 |                     $rcmail->config->get('kolab_2fa_storage', 'roundcube'),
352 |                     $rcmail->config->get('kolab_2fa_storage_config', array())
353 |                 );
354 | 
355 |                 $this->storage->set_username($for);
356 |                 $this->storage->set_logger(new \Kolab2FA\Log\RcubeLogger());
357 | 
358 |                 // set user properties from active session
359 |                 if (!empty($_SESSION['kolab_dn'])) {
360 |                     $this->storage->userdn = $_SESSION['kolab_dn'];
361 |                 }
362 |             }
363 |             catch (Exception $e) {
364 |                 $this->storage = false;
365 | 
366 |                 rcube::raise_error(array(
367 |                         'code' => 600,
368 |                         'type' => 'php',
369 |                         'file' => __FILE__,
370 |                         'line' => __LINE__,
371 |                         'message' => $error),
372 |                     true, false);
373 |             }
374 |         }
375 | 
376 |         return $this->storage;
377 |     }
378 | 
379 |     /**
380 |      * Handler for 'settings_actions' hook
381 |      */
382 |     public function settings_actions($args)
383 |     {
384 |         // register as settings action
385 |         $args['actions'][] = array(
386 |             'action' => 'plugin.kolab-2fa',
387 |             'class'  => 'twofactorauth',
388 |             'label'  => 'settingslist',
389 |             'title'  => 'settingstitle',
390 |             'domain' => 'kolab_2fa',
391 |         );
392 | 
393 |         return $args;
394 |     }
395 | 
396 |     /**
397 |      * Handler for settings/plugin.kolab-2fa requests
398 |      */
399 |     public function settings_view()
400 |     {
401 |         $this->register_handler('plugin.settingsform', array($this, 'settings_form'));
402 |         $this->register_handler('plugin.settingslist', array($this, 'settings_list'));
403 |         $this->register_handler('plugin.factoradder', array($this, 'settings_factoradder'));
404 |         $this->register_handler('plugin.highsecuritydialog', array($this, 'settings_highsecuritydialog'));
405 | 
406 |         $this->include_script('kolab2fa.js');
407 |         $this->include_stylesheet($this->local_skin_path() . '/kolab2fa.css');
408 | 
409 |         if ($this->check_secure_mode()) {
410 |             $this->api->output->set_env('session_secured', $_SESSION['kolab_2fa_secure_mode']);
411 |         }
412 | 
413 |         $this->api->output->add_label('save','cancel');
414 |         $this->api->output->set_pagetitle($this->gettext('settingstitle'));
415 |         $this->api->output->send('kolab_2fa.config');
416 |     }
417 | 
418 |     /**
419 |      * Render the menu to add another authentication factor
420 |      */
421 |     public function settings_factoradder($attrib)
422 |     {
423 |         $rcmail = rcmail::get_instance();
424 | 
425 |         $attrib['id'] = 'kolab2fa-add';
426 | 
427 |         $select = new html_select($attrib);
428 |         $select->add($this->gettext('addfactor') . '...', '');
429 |         foreach ((array)$rcmail->config->get('kolab_2fa_drivers', array()) as $method) {
430 |             $select->add($this->gettext($method), $method);
431 |         }
432 | 
433 |         return $select->show();
434 |     }
435 | 
436 |     /**
437 |      * Render a list of active factor this user has configured
438 |      */
439 |     public function settings_list($attrib = array())
440 |     {
441 |         $attrib['id'] = 'kolab2fa-factors';
442 |         $table = new html_table(array('cols' => 3));
443 | 
444 |         $table->add_header('name', $this->gettext('factor'));
445 |         $table->add_header('created', $this->gettext('created'));
446 |         $table->add_header('actions', '');
447 | 
448 |         return $table->show($attrib);
449 |     }
450 | 
451 |     /**
452 |      * Render the settings form template object
453 |      */
454 |     public function settings_form($attrib = array())
455 |     {
456 |         $rcmail = rcmail::get_instance();
457 |         $storage = $this->get_storage($rcmail->get_user_name());
458 |         $factors = $storage ? (array)$storage->enumerate() : array();
459 |         $drivers = (array)$rcmail->config->get('kolab_2fa_drivers', array());
460 |         $env_methods = array();
461 | 
462 |         foreach ($drivers as $j => $method) {
463 |             $out .= $this->settings_factor($method, $attrib);
464 |             $env_methods[$method] = array(
465 |                 'name'   => $this->gettext($method),
466 |                 'active' => 0,
467 |             );
468 |         }
469 | 
470 |         $me = $this;
471 |         $factors = array_combine(
472 |             $factors,
473 |             array_map(function($id) use ($me, &$env_methods) {
474 |                 $props = array('id' => $id);
475 | 
476 |                 if ($driver = $me->get_driver($id)) {
477 |                     $props += $this->format_props($driver->props());
478 |                     $props['method'] = $driver->method;
479 |                     $props['name'] = $me->gettext($driver->method);
480 |                     $env_methods[$driver->method]['active']++;
481 |                 }
482 | 
483 |                 return $props;
484 |             }, $factors)
485 |         );
486 | 
487 |         $this->api->output->set_env('kolab_2fa_methods', $env_methods);
488 |         $this->api->output->set_env('kolab_2fa_factors', !empty($factors) ? $factors : null);
489 | 
490 |         return html::div(array('id' => 'kolab2fapropform'), $out);
491 |     }
492 | 
493 |     /**
494 |      * Render the settings UI for the given method/driver
495 |      */
496 |     protected function settings_factor($method, $attrib)
497 |     {
498 |         $out = '';
499 |         $rcmail = rcmail::get_instance();
500 |         $attrib += array('class' => 'propform');
501 | 
502 |         if ($driver = $this->get_driver($method)) {
503 |             $table = new html_table(array('cols' => 2, 'class' => $attrib['class']));
504 | 
505 |             foreach ($driver->props() as $field => $prop) {
506 |                 if (!$prop['editable']) {
507 |                     continue;
508 |                 }
509 | 
510 |                 switch ($prop['type']) {
511 |                     case 'boolean':
512 |                     case 'checkbox':
513 |                         $input = new html_checkbox(array('value' => '1'));
514 |                         break;
515 | 
516 |                     case 'enum':
517 |                     case 'select':
518 |                         $input = new html_select(array('disabled' => $prop['readonly']));
519 |                         $input->add(array_map(array($this, 'gettext'), $prop['options']), $prop['options']);
520 |                         break;
521 | 
522 |                     default:
523 |                         $input = new html_inputfield(array('size' => $prop['size'] ?: 30, 'disabled' => !$prop['editable']));
524 |                 }
525 | 
526 |                 $explain_label = $field . 'explain' . $method;
527 |                 $explain_html = $rcmail->text_exists($explain_label, 'kolab_2fa') ? html::div('explain form-text', $this->gettext($explain_label)) : '';
528 | 
529 |                 $field_id = 'rcmk2fa' . $method . $field;
530 |                 $table->add('title', html::label($field_id, $this->gettext($field)));
531 |                 $table->add(null, $input->show('', array('id' => $field_id, 'name' => "_prop[$field]")) . $explain_html);
532 |             }
533 | 
534 |             // add row for displaying the QR code
535 |             if (method_exists($driver, 'get_provisioning_uri')) {
536 |                 $table->add('title', $this->gettext('qrcode'));
537 |                 $table->add(null,
538 |                     html::div('explain form-text', $this->gettext("qrcodeexplain$method"))
539 |                     . html::tag('img', array('src' => 'data:image/gif;base64,R0lGODlhDwAPAIAAAMDAwAAAACH5BAEAAAAALAAAAAAPAA8AQAINhI+py+0Po5y02otnAQA7', 'class' => 'qrcode', 'rel' => $method))
540 |                 );
541 | 
542 |                 // add row for testing the factor
543 |                 $field_id = 'rcmk2faverify' . $method;
544 |                 $table->add('title', html::label($field_id, $this->gettext('verifycode')));
545 |                 $table->add(null,
546 |                     html::tag('input', array('type' => 'text', 'name' => '_verify_code', 'id' => $field_id, 'class' => 'k2fa-verify', 'size' => 20, 'required' => true)) .
547 |                     html::div('explain form-text', $this->gettext("verifycodeexplain$method"))
548 |                 );
549 | 
550 |             }
551 | 
552 |             $input_id = new html_hiddenfield(array('name' => '_prop[id]', 'value' => ''));
553 | 
554 |             $out .= html::tag('form', array(
555 |                     'method' => 'post',
556 |                     'action' => '#',
557 |                     'id'     => 'kolab2fa-prop-' . $method,
558 |                     'style'  => 'display:none',
559 |                     'class'  => 'propform',
560 |                 ),
561 |                 html::tag('fieldset', array(),
562 |                     html::tag('legend', array(), $this->gettext($method)) .
563 |                     html::div('factorprop', $table->show()) .
564 |                     $input_id->show()
565 |                 )
566 |             );
567 |         }
568 | 
569 |         return $out;
570 |     }
571 | 
572 |     /**
573 |      * Render the high-security-dialog content
574 |      */
575 |     public function settings_highsecuritydialog($attrib = array())
576 |     {
577 |         $attrib += array('id' => 'kolab2fa-highsecuritydialog');
578 | 
579 |         $field_id = 'rcmk2facode';
580 |         $input = new html_inputfield(array('name' => '_code', 'id' => $field_id, 'class' => 'verifycode', 'size' => 20));
581 |         $label = html::label(array('for' => $field_id, 'class' => 'col-form-label col-sm-4'), '$name');
582 | 
583 |         return html::div($attrib,
584 |             html::div('explain form-text', $this->gettext('highsecuritydialog'))
585 |             . html::div('propform row form-group', $label . html::div('col-sm-8', $input->show('')))
586 |         );
587 |     }
588 | 
589 |     /**
590 |      * Handler for settings/plugin.kolab-2fa-save requests
591 |      */
592 |     public function settings_save()
593 |     {
594 |         $method = rcube_utils::get_input_value('_method', rcube_utils::INPUT_POST);
595 |         $data   = @json_decode(rcube_utils::get_input_value('_data', rcube_utils::INPUT_POST), true);
596 | 
597 |         $rcmail = rcmail::get_instance();
598 |         $storage = $this->get_storage($rcmail->get_user_name());
599 |         $success = false;
600 |         $errors = 0;
601 |         $save_data = array();
602 | 
603 |         if ($driver = $this->get_driver($method)) {
604 |             if ($data === false) {
605 |                 if ($this->check_secure_mode()) {
606 |                     // remove method from active factors and clear stored settings
607 |                     $success = $driver->clear();
608 |                 }
609 |                 else {
610 |                     $errors++;
611 |                 }
612 |             }
613 |             else {
614 |                 // verify the submitted code before saving
615 |                 $verify_code = rcube_utils::get_input_value('_verify_code', rcube_utils::INPUT_POST);
616 |                 $timestamp = intval(rcube_utils::get_input_value('_timestamp', rcube_utils::INPUT_POST));
617 |                 if (!empty($verify_code)) {
618 |                     if (!$driver->verify($verify_code, $timestamp)) {
619 |                         $this->api->output->command('plugin.verify_response', array(
620 |                             'id'      => $driver->id,
621 |                             'method'  => $driver->method,
622 |                             'success' => false,
623 |                             'message' => str_replace('$method', $this->gettext($driver->method), $this->gettext('codeverificationfailed'))
624 |                         ));
625 |                         $this->api->output->send();
626 |                     }
627 |                 }
628 | 
629 |                 foreach ($data as $prop => $value) {
630 |                     if (!$driver->set($prop, $value)) {
631 |                         $errors++;
632 |                     }
633 |                 }
634 | 
635 |                 $driver->set('active', true);
636 |             }
637 | 
638 |             // commit changes to the user properties
639 |             if (!$errors) {
640 |                 if ($success = $driver->commit()) {
641 |                     $save_data = $data !== false ? $this->format_props($driver->props()) : array();
642 |                 }
643 |                 else {
644 |                     $errors++;
645 |                 }
646 |             }
647 |         }
648 | 
649 |         if ($success) {
650 |             $this->api->output->show_message($data === false ? $this->gettext('factorremovesuccess') : $this->gettext('factorsavesuccess'), 'confirmation');
651 |             $this->api->output->command('plugin.save_success', array(
652 |                     'method' => $method,
653 |                     'active' => $data !== false,
654 |                     'id'     => $driver->id) + $save_data);
655 |         }
656 |         else if ($errors) {
657 |             $this->api->output->show_message($this->gettext('factorsaveerror'), 'error');
658 |             $this->api->output->command('plugin.reset_form', $method);
659 |         }
660 | 
661 |         $this->api->output->send();
662 |     }
663 | 
664 |     /**
665 |      * Handler for settings/plugin.kolab-2fa-data requests
666 |      */
667 |     public function settings_data()
668 |     {
669 |         $method = rcube_utils::get_input_value('_method', rcube_utils::INPUT_POST);
670 | 
671 |         if ($driver = $this->get_driver($method)) {
672 |             $data = array('method' => $method, 'id' => $driver->id);
673 | 
674 |             foreach ($driver->props(true) as $field => $prop) {
675 |                 $data[$field] = $prop['text'] ?: $prop['value'];
676 |             }
677 | 
678 |             // generate QR code for provisioning URI
679 |             if (method_exists($driver, 'get_provisioning_uri')) {
680 |                 try {
681 |                     $uri = $driver->get_provisioning_uri();
682 | 
683 |                     $qr = new Endroid\QrCode\QrCode();
684 |                     $qr->setText($uri)
685 |                        ->setSize(240)
686 |                        ->setPadding(10)
687 |                        ->setErrorCorrection('high')
688 |                        ->setForegroundColor(array('r' => 0, 'g' => 0, 'b' => 0, 'a' => 0))
689 |                        ->setBackgroundColor(array('r' => 255, 'g' => 255, 'b' => 255, 'a' => 0));
690 |                     $data['qrcode'] = base64_encode($qr->get());
691 |                 }
692 |                 catch (Exception $e) {
693 |                     rcube::raise_error($e, true, false);
694 |                 }
695 |             }
696 | 
697 |             $this->api->output->command('plugin.render_data', $data);
698 |         }
699 | 
700 |         $this->api->output->send();
701 |     }
702 | 
703 |     /**
704 |      * Handler for settings/plugin.kolab-2fa-verify requests
705 |      */
706 |     public function settings_verify()
707 |     {
708 |         $method = rcube_utils::get_input_value('_method', rcube_utils::INPUT_POST);
709 |         $timestamp = intval(rcube_utils::get_input_value('_timestamp', rcube_utils::INPUT_POST));
710 |         $success = false;
711 | 
712 |         if ($driver = $this->get_driver($method)) {
713 |             $data = @json_decode(rcube_utils::get_input_value('_data', rcube_utils::INPUT_POST), true);
714 |             if (is_array($data)) {
715 |                 foreach ($data as $key => $value) {
716 |                     if ($value !== '******') {
717 |                         $driver->$key = $value;
718 |                     }
719 |                 }
720 |             }
721 | 
722 |             $success = $driver->verify(rcube_utils::get_input_value('_code', rcube_utils::INPUT_POST), $timestamp);
723 |             $method = $driver->method;
724 |         }
725 | 
726 |         // put session into high-security mode
727 |         if ($success && !empty($_POST['_session'])) {
728 |             $_SESSION['kolab_2fa_secure_mode'] = time();
729 |         }
730 | 
731 |         $this->api->output->command('plugin.verify_response', array(
732 |             'method' => $method,
733 |             'success' => $success,
734 |             'message' => str_replace('$method', $this->gettext($method),
735 |                 $this->gettext($success ? 'codeverificationpassed' : 'codeverificationfailed'))
736 |         ));
737 | 
738 |         $this->api->output->send();
739 |     }
740 | 
741 |     /**
742 |      *
743 |      */
744 |     protected function format_props($props)
745 |     {
746 |         $rcmail = rcmail::get_instance();
747 |         $values = array();
748 | 
749 |         foreach ($props as $key => $prop) {
750 |             switch ($prop['type']) {
751 |                 case 'datetime':
752 |                     $value = $rcmail->format_date($prop['value']);
753 |                     break;
754 | 
755 |                 default:
756 |                     $value = $prop['value'];
757 |             }
758 | 
759 |             $values[$key] = $value;
760 |         }
761 | 
762 |         return $values;
763 |     }
764 | 
765 |     /**
766 |      *
767 |      */
768 |     protected function check_secure_mode()
769 |     {
770 |         $valid = ($_SESSION['kolab_2fa_secure_mode'] && $_SESSION['kolab_2fa_secure_mode'] > time() - 180);
771 |         return $valid;
772 |     }
773 | 
774 | }


--------------------------------------------------------------------------------
/lib/Kolab2FA/Driver/Base.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /**
  4 |  * Kolab 2-Factor-Authentication Driver base class
  5 |  *
  6 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
  7 |  *
  8 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  9 |  *
 10 |  * This program is free software: you can redistribute it and/or modify
 11 |  * it under the terms of the GNU Affero General Public License as
 12 |  * published by the Free Software Foundation, either version 3 of the
 13 |  * License, or (at your option) any later version.
 14 |  *
 15 |  * This program is distributed in the hope that it will be useful,
 16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 18 |  * GNU Affero General Public License for more details.
 19 |  *
 20 |  * You should have received a copy of the GNU Affero General Public License
 21 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
 22 |  */
 23 | 
 24 | namespace Kolab2FA\Driver;
 25 | 
 26 | abstract class Base
 27 | {
 28 |     public $method;
 29 |     public $id;
 30 |     public $storage;
 31 | 
 32 |     protected $config          = array();
 33 |     protected $props           = array();
 34 |     protected $user_props      = array();
 35 |     protected $pending_changes = false;
 36 |     protected $temporary       = false;
 37 |     protected $allowed_props   = array('username');
 38 | 
 39 |     public $user_settings = array(
 40 |         'active' => array(
 41 |             'type'     => 'boolean',
 42 |             'editable' => false,
 43 |             'hidden'   => false,
 44 |             'default'  => false,
 45 |         ),
 46 |         'label' => array(
 47 |             'type'      => 'text',
 48 |             'editable'  => true,
 49 |             'label'     => 'label',
 50 |             'generator' => 'default_label',
 51 |         ),
 52 |         'created' => array(
 53 |             'type'      => 'datetime',
 54 |             'editable'  => false,
 55 |             'hidden'    => false,
 56 |             'label'     => 'created',
 57 |             'generator' => 'time',
 58 |         ),
 59 |     );
 60 | 
 61 |     /**
 62 |      * Static factory method
 63 |      */
 64 |     public static function factory($id, $config)
 65 |     {
 66 |         list($method) = explode(':', $id);
 67 | 
 68 |         $classmap = array(
 69 |             'totp'    => '\\Kolab2FA\\Driver\\TOTP',
 70 |             'hotp'    => '\\Kolab2FA\\Driver\\HOTP',
 71 |             'yubikey' => '\\Kolab2FA\\Driver\\Yubikey',
 72 |         );
 73 | 
 74 |         $cls = $classmap[strtolower($method)];
 75 |         if ($cls && class_exists($cls)) {
 76 |             return new $cls($config, $id);
 77 |         }
 78 | 
 79 |         throw new Exception("Unknown 2FA driver '$method'");
 80 |     }
 81 | 
 82 |     /**
 83 |      * Default constructor
 84 |      */
 85 |     public function __construct($config = null, $id = null)
 86 |     {
 87 |         $this->init($config);
 88 | 
 89 |         if (!empty($id) && $id != $this->method) {
 90 |             $this->id = $id;
 91 |         }
 92 |         else { // generate random ID
 93 |             $this->id = $this->method . ':' . bin2hex(openssl_random_pseudo_bytes(12));
 94 |             $this->temporary = true;
 95 |         }
 96 |     }
 97 | 
 98 |     /**
 99 |      * Initialize the driver with the given config options
100 |      */
101 |     public function init($config)
102 |     {
103 |         if (is_array($config)) {
104 |             $this->config = array_merge($this->config, $config);
105 |         }
106 | 
107 |         if ($config['storage']) {
108 |             $this->storage = \Kolab2FA\Storage\Base::factory($config['storage'], $config['storage_config']);
109 |         }
110 |     }
111 | 
112 |     /**
113 |      * Verify the submitted authentication code
114 |      *
115 |      * @param string $code The 2nd authentication factor to verify
116 |      * @param int    $timestamp  Timestamp of authentication process (window start)
117 |      * @return boolean True if valid, false otherwise
118 |      */
119 |     abstract function verify($code, $timestamp = null);
120 | 
121 |     /**
122 |      * Getter for user-visible properties
123 |      */
124 |     public function props($force = false)
125 |     {
126 |         $data = array();
127 | 
128 |         foreach ($this->user_settings as $key => $p) {
129 |             if ($p['private']) {
130 |                 continue;
131 |             }
132 | 
133 |             $data[$key] = array(
134 |                 'type'     => $p['type'],
135 |                 'editable' => $p['editable'],
136 |                 'hidden'   => $p['hidden'],
137 |                 'label'    => $p['label'],
138 |                 'value'    => $this->get($key, $force),
139 |             );
140 | 
141 |             // format value into text
142 |             switch ($p['type']) {
143 |                 case 'boolean':
144 |                     $data[$key]['value'] = (bool)$data[$key]['value'];
145 |                     $data[$key]['text'] = $data[$key]['value'] ? 'yes' : 'no';
146 |                     break;
147 | 
148 |                 case 'datetime':
149 |                     if (is_numeric($data[$key]['value'])) {
150 |                         $data[$key]['text'] = date('c', $data[$key]['value']);
151 |                         break;
152 |                     }
153 | 
154 |                 default:
155 |                     $data[$key]['text'] = $data[$key]['value'];
156 |             }
157 |         }
158 | 
159 |         return $data;
160 |     }
161 | 
162 |     /**
163 |      * Implement this method if the driver can be prpvisioned via QR code
164 |      */
165 |     /* abstract function get_provisioning_uri(); */
166 | 
167 |     /**
168 |      * Generate a random secret string
169 |      */
170 |     public function generate_secret($length = 16)
171 |     {
172 |         // Base32 characters
173 |         $chars = array(
174 |             'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', //  7
175 |             'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', // 15
176 |             'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', // 23
177 |             'Y', 'Z', '2', '3', '4', '5', '6', '7', // 31
178 |         );
179 | 
180 |         $secret = '';
181 |         for ($i = 0; $i < $length; $i++) {
182 |             $secret .= $chars[array_rand($chars)];
183 |         }
184 |         return $secret;
185 |     }
186 | 
187 |     /**
188 |      * Generate the default label based on the method
189 |      */
190 |     public function default_label()
191 |     {
192 |         if (class_exists('\\rcmail', false)) {
193 |             return \rcmail::get_instance()->gettext($this->method, 'kolab_2fa');
194 |         }
195 | 
196 |         return strtoupper($this->method);
197 |     }
198 | 
199 |     /**
200 |      * Getter for read-only access to driver properties
201 |      */
202 |     public function get($key, $force = false)
203 |     {
204 |         // this is a per-user property: get from persistent storage
205 |         if (isset($this->user_settings[$key])) {
206 |             $value = $this->get_user_prop($key);
207 | 
208 |             // generate property value
209 |             if (!isset($value) && $force && $this->user_settings[$key]['generator']) {
210 |                 $func = $this->user_settings[$key]['generator'];
211 |                 if (is_string($func) && !is_callable($func)) {
212 |                     $func = array($this, $func);
213 |                 }
214 |                 if (is_callable($func)) {
215 |                     $value = call_user_func($func);
216 |                 }
217 |                 if (isset($value)) {
218 |                     $this->set_user_prop($key, $value);
219 |                 }
220 |             }
221 |         }
222 |         else {
223 |             $value = $this->props[$key];
224 |         }
225 | 
226 |         return $value;
227 |     }
228 | 
229 |     /**
230 |      * Setter for restricted access to driver properties
231 |      */
232 |     public function set($key, $value, $persistent = true)
233 |     {
234 |         // store as per-user property
235 |         if (isset($this->user_settings[$key])) {
236 |             if ($persistent) {
237 |                 return $this->set_user_prop($key, $value);
238 |             }
239 |             $this->user_props[$key] = $value;
240 |         }
241 | 
242 |         $setter = 'set_' . $key;
243 |         if (method_exists($this, $setter)) {
244 |             call_user_func(array($this, $setter), $value);
245 |         }
246 |         else if (in_array($key, $this->allowed_props)) {
247 |             $this->props[$key] = $value;
248 |         }
249 | 
250 |         return true;
251 |     }
252 | 
253 |     /**
254 |      * Commit changes to storage
255 |      */
256 |     public function commit()
257 |     {
258 |         if (!empty($this->user_props) && $this->storage && $this->pending_changes) {
259 |             if ($this->storage->write($this->id, $this->user_props)) {
260 |                 $this->pending_changes = false;
261 |                 $this->temporary = false;
262 |             }
263 |         }
264 | 
265 |         return !$this->pending_changes;
266 |     }
267 | 
268 |     /**
269 |      * Dedicated setter for the username property
270 |      */
271 |     public function set_username($username)
272 |     {
273 |         $this->props['username'] = $username;
274 | 
275 |         if ($this->storage) {
276 |             $this->storage->set_username($username);
277 |         }
278 | 
279 |         return true;
280 |     }
281 | 
282 |     /**
283 |      * Clear data stored for this driver
284 |      */
285 |     public function clear()
286 |     {
287 |         if ($this->storage) {
288 |             return $this->storage->remove($this->id);
289 |         }
290 | 
291 |         return false;
292 |     }
293 | 
294 |     /**
295 |      * Getter for per-user properties for this method
296 |      */
297 |     protected function get_user_prop($key)
298 |     {
299 |         if (!isset($this->user_props[$key]) && $this->storage && !$this->pending_changes && !$this->temporary) {
300 |             $this->user_props = (array)$this->storage->read($this->id);
301 |         }
302 | 
303 |         return $this->user_props[$key];
304 |     }
305 | 
306 |     /**
307 |      * Setter for per-user properties for this method
308 |      */
309 |     protected function set_user_prop($key, $value)
310 |     {
311 |         $this->pending_changes |= ($this->user_props[$key] !== $value);
312 |         $this->user_props[$key] = $value;
313 |         return true;
314 |     }
315 | 
316 |     /**
317 |      * Magic getter for read-only access to driver properties
318 |      */
319 |     public function __get($key)
320 |     {
321 |         // this is a per-user property: get from persistent storage
322 |         if (isset($this->user_settings[$key])) {
323 |             return $this->get_user_prop($key);
324 |         }
325 | 
326 |         return $this->props[$key];
327 |     }
328 | 
329 |     /**
330 |      * Magic setter for restricted access to driver properties
331 |      */
332 |     public function __set($key, $value)
333 |     {
334 |         $this->set($key, $value, false);
335 |     }
336 | 
337 |     /**
338 |      * Magic check if driver property is defined
339 |      */
340 |     public function __isset($key)
341 |     {
342 |         return isset($this->props[$key]);
343 |     }
344 | }
345 | 


--------------------------------------------------------------------------------
/lib/Kolab2FA/Driver/Exception.php:
--------------------------------------------------------------------------------
1 | <?php
2 | 
3 | namespace Kolab2FA\Driver;
4 | 
5 | class Exception extends \Exception
6 | {
7 |     
8 | }
9 | 


--------------------------------------------------------------------------------
/lib/Kolab2FA/Driver/HOTP.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /**
  4 |  * Kolab 2-Factor-Authentication HOTP driver implementation
  5 |  *
  6 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
  7 |  *
  8 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  9 |  *
 10 |  * This program is free software: you can redistribute it and/or modify
 11 |  * it under the terms of the GNU Affero General Public License as
 12 |  * published by the Free Software Foundation, either version 3 of the
 13 |  * License, or (at your option) any later version.
 14 |  *
 15 |  * This program is distributed in the hope that it will be useful,
 16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 18 |  * GNU Affero General Public License for more details.
 19 |  *
 20 |  * You should have received a copy of the GNU Affero General Public License
 21 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
 22 |  */
 23 | 
 24 | namespace Kolab2FA\Driver;
 25 | 
 26 | class HOTP extends Base
 27 | {
 28 |     public $method = 'hotp';
 29 | 
 30 |     protected $config = array(
 31 |         'digits'   => 6,
 32 |         'window'   => 4,
 33 |         'digest'   => 'sha1',
 34 |     );
 35 | 
 36 |     protected $backend;
 37 | 
 38 |     /**
 39 |      *
 40 |      */
 41 |     public function init($config)
 42 |     {
 43 |         parent::init($config);
 44 | 
 45 |         $this->user_settings += array(
 46 |             'secret' => array(
 47 |                 'type'      => 'text',
 48 |                 'private'   => true,
 49 |                 'label'     => 'secret',
 50 |                 'generator' => 'generate_secret',
 51 |             ),
 52 |             'counter' => array(
 53 |                 'type'      => 'integer',
 54 |                 'editable'  => false,
 55 |                 'hidden'    => true,
 56 |                 'generator' => 'random_counter',
 57 |             ),
 58 |         );
 59 | 
 60 |         // copy config options
 61 |         $this->backend = new \Kolab2FA\OTP\HOTP();
 62 |         $this->backend
 63 |             ->setDigits($this->config['digits'])
 64 |             ->setDigest($this->config['digest'])
 65 |             ->setIssuer($this->config['issuer'])
 66 |             ->setIssuerIncludedAsParameter(true);
 67 |     }
 68 | 
 69 |     /**
 70 |      *
 71 |      */
 72 |     public function verify($code, $timestamp = null)
 73 |     {
 74 |         // get my secret from the user storage
 75 |         $secret  = $this->get('secret');
 76 |         $counter = $this->get('counter');
 77 | 
 78 |         if (!strlen($secret)) {
 79 |             // LOG: "no secret set for user $this->username"
 80 |             // rcube::console("VERIFY HOTP: no secret set for user $this->username");
 81 |             return false;
 82 |         }
 83 | 
 84 |         try {
 85 |             $this->backend->setLabel($this->username)->setSecret($secret)->setCounter(intval($this->get('counter')));
 86 |             $pass = $this->backend->verify($code, $counter, $this->config['window']);
 87 | 
 88 |             // store incremented counter value
 89 |             $this->set('counter', $this->backend->getCounter());
 90 |             $this->commit();
 91 |         }
 92 |         catch (\Exception $e) {
 93 |             // LOG: exception
 94 |             // rcube::console("VERIFY HOTP: $this->id, " . strval($e));
 95 |             $pass = false;
 96 |         }
 97 | 
 98 |         // rcube::console('VERIFY HOTP', $this->username, $secret, $counter, $code, $pass);
 99 |         return $pass;
100 |     }
101 | 
102 |     /**
103 |      *
104 |      */
105 |     public function get_provisioning_uri()
106 |     {
107 |         if (!$this->secret) {
108 |             // generate new secret and store it
109 |             $this->set('secret', $this->get('secret', true));
110 |             $this->set('counter', $this->get('counter', true));
111 |             $this->set('created', $this->get('created', true));
112 |             $this->commit();
113 |         }
114 | 
115 |         // TODO: deny call if already active?
116 | 
117 |         $this->backend->setLabel($this->username)->setSecret($this->secret)->setCounter(intval($this->get('counter')));
118 |         return $this->backend->getProvisioningUri();
119 |     }
120 | 
121 |     /**
122 |      * Generate a random counter value
123 |      */
124 |     public function random_counter()
125 |     {
126 |         return mt_rand(1, 999);
127 |     }
128 | }
129 | 


--------------------------------------------------------------------------------
/lib/Kolab2FA/Driver/TOTP.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /**
  4 |  * Kolab 2-Factor-Authentication TOTP driver implementation
  5 |  *
  6 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
  7 |  *
  8 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  9 |  *
 10 |  * This program is free software: you can redistribute it and/or modify
 11 |  * it under the terms of the GNU Affero General Public License as
 12 |  * published by the Free Software Foundation, either version 3 of the
 13 |  * License, or (at your option) any later version.
 14 |  *
 15 |  * This program is distributed in the hope that it will be useful,
 16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 18 |  * GNU Affero General Public License for more details.
 19 |  *
 20 |  * You should have received a copy of the GNU Affero General Public License
 21 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
 22 |  */
 23 | 
 24 | namespace Kolab2FA\Driver;
 25 | 
 26 | class TOTP extends Base
 27 | {
 28 |     public $method = 'totp';
 29 | 
 30 |     protected $config = array(
 31 |         'digits'   => 6,
 32 |         'interval' => 30,
 33 |         'digest'   => 'sha1',
 34 |     );
 35 | 
 36 |     protected $backend;
 37 | 
 38 |     /**
 39 |      *
 40 |      */
 41 |     public function init($config)
 42 |     {
 43 |         parent::init($config);
 44 | 
 45 |         $this->user_settings += array(
 46 |             'secret' => array(
 47 |                 'type'      => 'text',
 48 |                 'private'   => true,
 49 |                 'label'     => 'secret',
 50 |                 'generator' => 'generate_secret',
 51 |             ),
 52 |         );
 53 | 
 54 |         // copy config options
 55 |         $this->backend = new \Kolab2FA\OTP\TOTP();
 56 |         $this->backend
 57 |             ->setDigits($this->config['digits'])
 58 |             ->setInterval($this->config['interval'])
 59 |             ->setDigest($this->config['digest'])
 60 |             ->setIssuer($this->config['issuer'])
 61 |             ->setIssuerIncludedAsParameter(true);
 62 |     }
 63 | 
 64 |     /**
 65 |      *
 66 |      */
 67 |     public function verify($code, $timestamp = null)
 68 |     {
 69 |         // get my secret from the user storage
 70 |         $secret = $this->get('secret');
 71 | 
 72 |         if (!strlen($secret)) {
 73 |             // LOG: "no secret set for user $this->username"
 74 |             // rcube::console("VERIFY TOTP: no secret set for user $this->username");
 75 |             return false;
 76 |         }
 77 | 
 78 |         $this->backend->setLabel($this->username)->setSecret($secret);
 79 | 
 80 |         // Pass a window to indicate the maximum timeslip between client (mobile
 81 |         // device) and server.
 82 |         $pass = $this->backend->verify($code, $timestamp, 150);
 83 | 
 84 |         // try all codes from $timestamp till now
 85 |         if (!$pass && $timestamp) {
 86 |             $now = time();
 87 |             while (!$pass && $timestamp < $now) {
 88 |                 $pass = $code === $this->backend->at($timestamp);
 89 |                 $timestamp += $this->config['interval'];
 90 |             }
 91 |         }
 92 | 
 93 |         // rcube::console('VERIFY TOTP', $this->username, $secret, $code, $timestamp, $pass);
 94 |         return $pass;
 95 |     }
 96 | 
 97 |     /**
 98 |      *
 99 |      */
100 |     public function get_provisioning_uri()
101 |     {
102 |         // rcube::console('PROV', $this->secret);
103 |         if (!$this->secret) {
104 |             // generate new secret and store it
105 |             $this->set('secret', $this->get('secret', true));
106 |             $this->set('created', $this->get('created', true));
107 |             // rcube::console('PROV2', $this->secret);
108 |             $this->commit();
109 |         }
110 | 
111 |         // TODO: deny call if already active?
112 | 
113 |         $this->backend->setLabel($this->username)->setSecret($this->secret);
114 |         return $this->backend->getProvisioningUri();
115 |     }
116 | 
117 | }
118 | 


--------------------------------------------------------------------------------
/lib/Kolab2FA/Driver/Yubikey.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /**
  4 |  * Kolab 2-Factor-Authentication Yubikey driver implementation
  5 |  *
  6 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
  7 |  *
  8 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  9 |  *
 10 |  * This program is free software: you can redistribute it and/or modify
 11 |  * it under the terms of the GNU Affero General Public License as
 12 |  * published by the Free Software Foundation, either version 3 of the
 13 |  * License, or (at your option) any later version.
 14 |  *
 15 |  * This program is distributed in the hope that it will be useful,
 16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 18 |  * GNU Affero General Public License for more details.
 19 |  *
 20 |  * You should have received a copy of the GNU Affero General Public License
 21 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
 22 |  */
 23 | 
 24 | namespace Kolab2FA\Driver;
 25 | 
 26 | class Yubikey extends Base
 27 | {
 28 |     public $method = 'yubikey';
 29 | 
 30 |     protected $backend;
 31 | 
 32 |     /**
 33 |      *
 34 |      */
 35 |     public function init($config)
 36 |     {
 37 |         parent::init($config);
 38 | 
 39 |         $this->user_settings += array(
 40 |             'yubikeyid' => array(
 41 |                 'type'     => 'text',
 42 |                 'editable' => true,
 43 |                 'label'    => 'secret',
 44 |             ),
 45 |         );
 46 | 
 47 |         // initialize validator
 48 |         $this->backend = new \Yubikey\Validate($this->config['apikey'], $this->config['clientid']);
 49 | 
 50 |         // set configured validation hosts
 51 |         if (!empty($this->config['hosts'])) {
 52 |             $this->backend->setHosts((array)$this->config['hosts']);
 53 |         }
 54 | 
 55 |         if (isset($this->config['use_https'])) {
 56 |             $this->backend->setUseSecure((bool)$this->config['use_https']);
 57 |         }
 58 |     }
 59 | 
 60 |     /**
 61 |      *
 62 |      */
 63 |     public function verify($code, $timestamp = null)
 64 |     {
 65 |         // get my secret from the user storage
 66 |         $keyid = $this->get('yubikeyid');
 67 |         $pass  = false;
 68 | 
 69 |         if (!strlen($keyid)) {
 70 |             // LOG: "no key registered for user $this->username"
 71 |             return false;
 72 |         }
 73 | 
 74 |         // check key prefix with associated Yubikey ID
 75 |         if (strpos($code, $keyid) === 0) {
 76 |             try {
 77 |                 $response = $this->backend->check($code);
 78 |                 $pass     = $response->success() === true;
 79 |             }
 80 |             catch (\Exception $e) {
 81 |                 // TODO: log exception
 82 |             }
 83 |         }
 84 | 
 85 |         // rcube::console('VERIFY Yubikey', $this->username, $keyid, $code, $pass);
 86 |         return $pass;
 87 |     }
 88 | 
 89 |     /**
 90 |      * @override
 91 |      */
 92 |     public function set($key, $value, $persistent = true)
 93 |     {
 94 |         if ($key == 'yubikeyid' && strlen($value) > 12) {
 95 |             // verify the submitted code
 96 |             try {
 97 |                 $response = $this->backend->check($value);
 98 |                 if ($response->success() !== true) {
 99 |                     // TODO: report error
100 |                     return false;
101 |                 }
102 |             }
103 |             catch (\Exception $e) {
104 |                 return false;
105 |             }
106 | 
107 |             // truncate the submitted yubikey code to 12 characters
108 |             $value = substr($value, 0, 12);
109 |         }
110 | 
111 |         return parent::set($key, $value, $persistent);
112 |     }
113 | 
114 |     /**
115 |      * @override
116 |      */
117 |     protected function set_user_prop($key, $value)
118 |     {
119 |         // set created timestamp
120 |         if ($key !== 'created' && !isset($this->created)) {
121 |             parent::set_user_prop('created', $this->get('created', true));
122 |         }
123 | 
124 |         return parent::set_user_prop($key, $value);
125 |     }
126 | }
127 | 


--------------------------------------------------------------------------------
/lib/Kolab2FA/Log/Logger.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | /**
 4 |  * Logging interface for the Kolab 2-Factor-Authentication components
 5 |  *
 6 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
 7 |  *
 8 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
 9 |  *
10 |  * This program is free software: you can redistribute it and/or modify
11 |  * it under the terms of the GNU Affero General Public License as
12 |  * published by the Free Software Foundation, either version 3 of the
13 |  * License, or (at your option) any later version.
14 |  *
15 |  * This program is distributed in the hope that it will be useful,
16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 |  * GNU Affero General Public License for more details.
19 |  *
20 |  * You should have received a copy of the GNU Affero General Public License
21 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
22 |  */
23 | 
24 | namespace Kolab2FA\Log;
25 | 
26 | interface Logger
27 | {
28 |     /**
29 |      * Setter for the log name
30 |      */
31 |     public function set_name($name);
32 | 
33 |     /**
34 |      * Setter for the minimum log level
35 |      */
36 |     public function set_level($level);
37 | 
38 |     /**
39 |      * Do log the given message at the given level
40 |      */
41 |     public function log($level, $message);
42 | }
43 | 


--------------------------------------------------------------------------------
/lib/Kolab2FA/Log/RcubeLogger.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | /**
 4 |  * Kolab 2-Factor-Authentication Logging class to log messages
 5 |  * through the Roundcube logging facilities.
 6 |  *
 7 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
 8 |  *
 9 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
10 |  *
11 |  * This program is free software: you can redistribute it and/or modify
12 |  * it under the terms of the GNU Affero General Public License as
13 |  * published by the Free Software Foundation, either version 3 of the
14 |  * License, or (at your option) any later version.
15 |  *
16 |  * This program is distributed in the hope that it will be useful,
17 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 |  * GNU Affero General Public License for more details.
20 |  *
21 |  * You should have received a copy of the GNU Affero General Public License
22 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
23 |  */
24 | 
25 | namespace Kolab2FA\Log;
26 | 
27 | use \rcube;
28 | 
29 | class RcubeLogger implements Logger
30 | {
31 |     protected $name = null;
32 |     protected $level = LOG_DEBUG;
33 | 
34 |     public function __construct($name = null)
35 |     {
36 |         if ($name !== null) {
37 |             $this->set_name($name);
38 |         }
39 |     }
40 | 
41 |     public function set_name($name)
42 |     {
43 |         $this->name = $name;
44 |     }
45 | 
46 |     public function set_level($name)
47 |     {
48 |         $this->level = $level;
49 |     }
50 | 
51 |     public function log($level, $message)
52 |     {
53 |         if (!is_string($message)) {
54 |             $message = var_export($message, true);
55 |         }
56 | 
57 |         switch ($level) {
58 |         case LOG_DEBUG:
59 |         case LOG_INFO:
60 |         case LOG_NOTICE:
61 |             if ($level >= $this->level) {
62 |                 rcube::write_log($this->name ?: 'console', $message);
63 |             }
64 |             break;
65 | 
66 |         case LOG_EMERGE:
67 |         case LOG_ALERT:
68 |         case LOG_CRIT:
69 |         case LOG_ERR:
70 |         case LOG_WARNING:
71 |             rcube::raise_error(array(
72 |                 'code' => 600,
73 |                 'type' => 'php',
74 |                 'message' => $message,
75 |             ), true, false);
76 |             break;
77 |         }
78 |     }
79 | }
80 | 
81 | 


--------------------------------------------------------------------------------
/lib/Kolab2FA/Log/Syslog.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | /**
 4 |  * Kolab 2-Factor-Authentication Logging class to log messages
 5 |  * through the Roundcube logging facilities.
 6 |  *
 7 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
 8 |  *
 9 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
10 |  *
11 |  * This program is free software: you can redistribute it and/or modify
12 |  * it under the terms of the GNU Affero General Public License as
13 |  * published by the Free Software Foundation, either version 3 of the
14 |  * License, or (at your option) any later version.
15 |  *
16 |  * This program is distributed in the hope that it will be useful,
17 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 |  * GNU Affero General Public License for more details.
20 |  *
21 |  * You should have received a copy of the GNU Affero General Public License
22 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
23 |  */
24 | 
25 | namespace Kolab2FA\Log;
26 | 
27 | use \rcube;
28 | 
29 | class Syslog implements Logger
30 | {
31 |     protected $name = 'Kolab2FA';
32 |     protected $level = LOG_INFO;
33 | 
34 |     public function set_name($name)
35 |     {
36 |         $this->name = $name;
37 |     }
38 | 
39 |     public function set_level($name)
40 |     {
41 |         $this->level = $level;
42 |     }
43 | 
44 |     public function log($level, $message)
45 |     {
46 |         if ($level >= $this->level) {
47 |             if (!is_string($message)) {
48 |                 $message = var_export($message, true);
49 |             }
50 | 
51 |             syslog($level, '[' . $this->name . '] ' . $message);
52 |         }
53 |     }
54 | }


--------------------------------------------------------------------------------
/lib/Kolab2FA/OTP/HOTP.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | /**
 4 |  * Kolab HOTP implementation based on Spomky-Labs/otphp
 5 |  *
 6 |  * This basically follows the exmaple implementation from
 7 |  * https://github.com/Spomky-Labs/otphp/tree/master/examples
 8 |  *
 9 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
10 |  *
11 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
12 |  *
13 |  * This program is free software: you can redistribute it and/or modify
14 |  * it under the terms of the GNU Affero General Public License as
15 |  * published by the Free Software Foundation, either version 3 of the
16 |  * License, or (at your option) any later version.
17 |  *
18 |  * This program is distributed in the hope that it will be useful,
19 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 |  * GNU Affero General Public License for more details.
22 |  *
23 |  * You should have received a copy of the GNU Affero General Public License
24 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
25 |  */
26 | 
27 | 
28 | namespace Kolab2FA\OTP;
29 | 
30 | use OTPHP\HOTP as Base;
31 | 
32 | class HOTP extends Base
33 | {
34 |     use OTP;
35 |     protected $counter = 0;
36 | 
37 |     public function setCounter($counter)
38 |     {
39 |         if (!is_integer($counter) || $counter < 0) {
40 |             throw new \Exception('Counter must be at least 0.');
41 |         }
42 |         $this->counter = $counter;
43 | 
44 |         return $this;
45 |     }
46 | 
47 |     public function getCounter()
48 |     {
49 |         return $this->counter;
50 |     }
51 | 
52 |     public function updateCounter($counter)
53 |     {
54 |         $this->counter = $counter;
55 | 
56 |         return $this;
57 |     }
58 | }


--------------------------------------------------------------------------------
/lib/Kolab2FA/OTP/OTP.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /**
  4 |  * Kolab OTP trait based on Spomky-Labs/otphp
  5 |  *
  6 |  * This basically follows the exmaple implementation from
  7 |  * https://github.com/Spomky-Labs/otphp/tree/master/examples
  8 |  *
  9 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
 10 |  *
 11 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
 12 |  *
 13 |  * This program is free software: you can redistribute it and/or modify
 14 |  * it under the terms of the GNU Affero General Public License as
 15 |  * published by the Free Software Foundation, either version 3 of the
 16 |  * License, or (at your option) any later version.
 17 |  *
 18 |  * This program is distributed in the hope that it will be useful,
 19 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 20 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 21 |  * GNU Affero General Public License for more details.
 22 |  *
 23 |  * You should have received a copy of the GNU Affero General Public License
 24 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
 25 |  */
 26 | 
 27 | namespace Kolab2FA\OTP;
 28 | 
 29 | trait OTP
 30 | {
 31 |     protected $secret = null;
 32 |     protected $issuer = null;
 33 |     protected $issuer_included_as_parameter = false;
 34 |     protected $label = null;
 35 |     protected $digest = 'sha1';
 36 |     protected $digits = 6;
 37 | 
 38 |     public function setSecret($secret)
 39 |     {
 40 |         $this->secret = $secret;
 41 | 
 42 |         return $this;
 43 |     }
 44 | 
 45 |     public function getSecret()
 46 |     {
 47 |         return $this->secret;
 48 |     }
 49 | 
 50 |     public function setLabel($label)
 51 |     {
 52 |         if ($this->hasSemicolon($label)) {
 53 |             throw new \Exception('Label must not contain a semi-colon.');
 54 |         }
 55 |         $this->label = $label;
 56 | 
 57 |         return $this;
 58 |     }
 59 | 
 60 |     public function getLabel()
 61 |     {
 62 |         return $this->label;
 63 |     }
 64 | 
 65 |     public function setIssuer($issuer)
 66 |     {
 67 |         if ($this->hasSemicolon($issuer)) {
 68 |             throw new \Exception('Issuer must not contain a semi-colon.');
 69 |         }
 70 |         $this->issuer = $issuer;
 71 | 
 72 |         return $this;
 73 |     }
 74 | 
 75 |     public function getIssuer()
 76 |     {
 77 |         return $this->issuer;
 78 |     }
 79 | 
 80 |     public function isIssuerIncludedAsParameter()
 81 |     {
 82 |         return $this->issuer_included_as_parameter;
 83 |     }
 84 | 
 85 |     public function setIssuerIncludedAsParameter($issuer_included_as_parameter)
 86 |     {
 87 |         $this->issuer_included_as_parameter = $issuer_included_as_parameter;
 88 | 
 89 |         return $this;
 90 |     }
 91 | 
 92 |     public function setDigits($digits)
 93 |     {
 94 |         if (!is_numeric($digits) || $digits < 1) {
 95 |             throw new \Exception('Digits must be at least 1.');
 96 |         }
 97 |         $this->digits = $digits;
 98 | 
 99 |         return $this;
100 |     }
101 | 
102 |     public function getDigits()
103 |     {
104 |         return $this->digits;
105 |     }
106 | 
107 |     public function setDigest($digest)
108 |     {
109 |         if (!in_array($digest, array('md5', 'sha1', 'sha256', 'sha512'))) {
110 |             throw new \Exception("'$digest' digest is not supported.");
111 |         }
112 |         $this->digest = $digest;
113 | 
114 |         return $this;
115 |     }
116 | 
117 |     public function getDigest()
118 |     {
119 |         return $this->digest;
120 |     }
121 | 
122 |     private function hasSemicolon($value)
123 |     {
124 |         $semicolons = array(':', '%3A', '%3a');
125 |         foreach ($semicolons as $semicolon) {
126 |             if (false !== strpos($value, $semicolon)) {
127 |                 return true;
128 |             }
129 |         }
130 | 
131 |         return false;
132 |     }
133 | }


--------------------------------------------------------------------------------
/lib/Kolab2FA/OTP/TOTP.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | /**
 4 |  * Kolab TOTP implementation based on Spomky-Labs/otphp
 5 |  *
 6 |  * This basically follows the exmaple implementation from
 7 |  * https://github.com/Spomky-Labs/otphp/tree/master/examples
 8 |  *
 9 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
10 |  *
11 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
12 |  *
13 |  * This program is free software: you can redistribute it and/or modify
14 |  * it under the terms of the GNU Affero General Public License as
15 |  * published by the Free Software Foundation, either version 3 of the
16 |  * License, or (at your option) any later version.
17 |  *
18 |  * This program is distributed in the hope that it will be useful,
19 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 |  * GNU Affero General Public License for more details.
22 |  *
23 |  * You should have received a copy of the GNU Affero General Public License
24 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
25 |  */
26 | 
27 | namespace Kolab2FA\OTP;
28 | 
29 | use OTPHP\TOTP as Base;
30 | 
31 | class TOTP extends Base
32 | {
33 |     use OTP;
34 |     protected $interval = 30;
35 | 
36 |     public function setInterval($interval)
37 |     {
38 |         if (!is_integer($interval) || $interval < 1) {
39 |             throw new \Exception('Interval must be at least 1.');
40 |         }
41 |         $this->interval = $interval;
42 | 
43 |         return $this;
44 |     }
45 | 
46 |     public function getInterval()
47 |     {
48 |         return $this->interval;
49 |     }
50 | }


--------------------------------------------------------------------------------
/lib/Kolab2FA/Storage/Base.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /**
  4 |  * Abstract storage backend class for the Kolab 2-Factor-Authentication plugin
  5 |  *
  6 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
  7 |  *
  8 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  9 |  *
 10 |  * This program is free software: you can redistribute it and/or modify
 11 |  * it under the terms of the GNU Affero General Public License as
 12 |  * published by the Free Software Foundation, either version 3 of the
 13 |  * License, or (at your option) any later version.
 14 |  *
 15 |  * This program is distributed in the hope that it will be useful,
 16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 18 |  * GNU Affero General Public License for more details.
 19 |  *
 20 |  * You should have received a copy of the GNU Affero General Public License
 21 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
 22 |  */
 23 | 
 24 | namespace Kolab2FA\Storage;
 25 | 
 26 | use \Kolab2FA\Log;
 27 | 
 28 | 
 29 | abstract class Base
 30 | {
 31 |     public $username = null;
 32 |     protected $config = array();
 33 |     protected $logger;
 34 | 
 35 |     /**
 36 |      *
 37 |      */
 38 |     public static function factory($backend, $config)
 39 |     {
 40 |         $classmap = array(
 41 |             'ldap' => '\\Kolab2FA\\Storage\\LDAP',
 42 |             'roundcube' => '\\Kolab2FA\\Storage\\RcubeUser',
 43 |             'rcubeuser' => '\\Kolab2FA\\Storage\\RcubeUser',
 44 |         );
 45 | 
 46 |         $cls = $classmap[strtolower($backend)];
 47 |         if ($cls && class_exists($cls)) {
 48 |             return new $cls($config);
 49 |         }
 50 | 
 51 |         throw new Exception("Unknown storage backend '$backend'");
 52 |     }
 53 | 
 54 |     /**
 55 |      * Default constructor
 56 |      */
 57 |     public function __construct($config = null)
 58 |     {
 59 |         if (is_array($config)) {
 60 |             $this->init($config);
 61 |         }
 62 |     }
 63 | 
 64 |     /**
 65 |      * Initialize the driver with the given config options
 66 |      */
 67 |     public function init(array $config)
 68 |     {
 69 |         $this->config = array_merge($this->config, $config);
 70 | 
 71 |         // use syslog logger by default
 72 |         $this->set_logger(new Log\Syslog());
 73 |     }
 74 | 
 75 |     /**
 76 |      * 
 77 |      */
 78 |     public function set_logger(Log\Logger $logger)
 79 |     {
 80 |         $this->logger = $logger;
 81 | 
 82 |         if ($this->config['debug']) {
 83 |             $this->logger->set_level(LOG_DEBUG);
 84 |         }
 85 |         else if ($this->config['loglevel']) {
 86 |             $this->logger->set_level($this->config['loglevel']);
 87 |         }
 88 |     }
 89 | 
 90 |     /**
 91 |      * Set username to store data for
 92 |      */
 93 |     public function set_username($username)
 94 |     {
 95 |         $this->username = $username;
 96 |     }
 97 | 
 98 |     /**
 99 |      * Send messager to the logging system
100 |      */
101 |     protected function log($level, $message)
102 |     {
103 |         if ($this->logger) {
104 |             $this->logger->log($level, $message);
105 |         }
106 |     }
107 | 
108 |     /**
109 |      * List keys holding settings for 2-factor-authentication
110 |      */
111 |     abstract public function enumerate();
112 | 
113 |     /**
114 |      * Read data for the given key
115 |      */
116 |     abstract public function read($key);
117 | 
118 |     /**
119 |      * Save data for the given key
120 |      */
121 |     abstract public function write($key, $value);
122 | 
123 |     /**
124 |      * Remove the data stored for the given key
125 |      */
126 |     abstract public function remove($key);
127 | }
128 | 


--------------------------------------------------------------------------------
/lib/Kolab2FA/Storage/Exception.php:
--------------------------------------------------------------------------------
1 | <?php
2 | 
3 | namespace Kolab2FA\Storage;
4 | 
5 | class Exception extends \Exception
6 | {
7 |     
8 | }
9 | 


--------------------------------------------------------------------------------
/lib/Kolab2FA/Storage/LDAP.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /**
  4 |  * Storage backend to store 2-Factor-Authentication settings in LDAP
  5 |  *
  6 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
  7 |  *
  8 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  9 |  *
 10 |  * This program is free software: you can redistribute it and/or modify
 11 |  * it under the terms of the GNU Affero General Public License as
 12 |  * published by the Free Software Foundation, either version 3 of the
 13 |  * License, or (at your option) any later version.
 14 |  *
 15 |  * This program is distributed in the hope that it will be useful,
 16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 18 |  * GNU Affero General Public License for more details.
 19 |  *
 20 |  * You should have received a copy of the GNU Affero General Public License
 21 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
 22 |  */
 23 | 
 24 | namespace Kolab2FA\Storage;
 25 | 
 26 | use \Net_LDAP3;
 27 | use \Kolab2FA\Log\Logger;
 28 | 
 29 | class LDAP extends Base
 30 | {
 31 |     public $userdn;
 32 | 
 33 |     private $cache = array();
 34 |     private $ldapcache = array();
 35 |     private $conn;
 36 |     private $error;
 37 | 
 38 |     public function init(array $config)
 39 |     {
 40 |         parent::init($config);
 41 | 
 42 |         $this->conn = new Net_LDAP3($config);
 43 |         $this->conn->config_set('log_hook', array($this, 'log'));
 44 | 
 45 |         $this->conn->connect();
 46 | 
 47 |         $bind_pass = $this->config['bind_pass'];
 48 |         $bind_user = $this->config['bind_user'];
 49 |         $bind_dn   = $this->config['bind_dn'];
 50 | 
 51 |         $this->ready = $this->conn->bind($bind_dn, $bind_pass);
 52 | 
 53 |         if (!$this->ready) {
 54 |             throw new Exception("LDAP storage not ready: " . $this->error);
 55 |         }
 56 |     }
 57 | 
 58 |     /**
 59 |      * List/set methods activated for this user
 60 |      */
 61 |     public function enumerate($active = true)
 62 |     {
 63 |         $filter  = $this->parse_vars($this->config['filter'],  '*');
 64 |         $base_dn = $this->parse_vars($this->config['base_dn'], '*');
 65 |         $scope   = $this->config['scope'] ?: 'sub';
 66 |         $ids     = array();
 67 | 
 68 |         if ($this->ready && ($result = $this->conn->search($base_dn, $filter, $scope, array($this->config['fieldmap']['id'], $this->config['fieldmap']['active'])))) {
 69 |             foreach ($result as $dn => $entry) {
 70 |                 $rec = $this->field_mapping($dn, Net_LDAP3::normalize_entry($entry, true));
 71 |                 if (!empty($rec['id']) && ($active === null || $active == $rec['active'])) {
 72 |                     $ids[] = $rec['id'];
 73 |                 }
 74 |             }
 75 |         }
 76 | 
 77 |         // TODO: cache this in memory
 78 | 
 79 |         return $ids;
 80 |     }
 81 | 
 82 |     /**
 83 |      * Read data for the given key
 84 |      */
 85 |     public function read($key)
 86 |     {
 87 |         if (!isset($this->cache[$key])) {
 88 |             $this->cache[$key] = $this->get_ldap_record($this->username, $key);
 89 |         }
 90 | 
 91 |         return $this->cache[$key];
 92 |     }
 93 | 
 94 |     /**
 95 |      * Save data for the given key
 96 |      */
 97 |     public function write($key, $value)
 98 |     {
 99 |         $success = false;
100 |         $ldap_attrs = array();
101 | 
102 |         if (is_array($value)) {
103 |             // add some default values
104 |             $value += (array)$this->config['defaults'] + array('active' => false, 'username' => $this->username, 'userdn' => $this->userdn);
105 | 
106 |             foreach ($value as $k => $val) {
107 |                 if ($attr = $this->config['fieldmap'][$k]) {
108 |                     $ldap_attrs[$attr] = $this->value_mapping($k, $val, false);
109 |                 }
110 |             }
111 |         }
112 |         else {
113 |             // invalid data structure
114 |             return false;
115 |         }
116 | 
117 |         // update existing record
118 |         if ($rec = $this->get_ldap_record($this->username, $key)) {
119 |             $old_attrs = $rec['_raw'];
120 |             $new_attrs = array_merge($old_attrs, $ldap_attrs);
121 | 
122 |             $result = $this->conn->modify_entry($rec['_dn'], $old_attrs, $new_attrs);
123 |             $success = !empty($result);
124 |         }
125 |         // insert new record
126 |         else if ($this->ready) {
127 |             $entry_dn = $this->get_entry_dn($this->username, $key);
128 | 
129 |             // add object class attribute
130 |             $me = $this;
131 |             $ldap_attrs['objectclass'] = array_map(function($cls) use ($me, $key) {
132 |                 return $me->parse_vars($cls, $key);
133 |             }, (array)$this->config['objectclass']);
134 | 
135 |             $success = $this->conn->add_entry($entry_dn, $ldap_attrs);
136 |         }
137 | 
138 |         if ($success) {
139 |             $this->cache[$key] = $value;
140 |             $this->ldapcache = array();
141 | 
142 |             // cleanup: remove disabled/inactive/temporary entries
143 |             if ($value['active']) {
144 |                 foreach ($this->enumerate(false) as $id) {
145 |                     if ($id != $key) {
146 |                         $this->remove($id);
147 |                     }
148 |                 }
149 | 
150 |                 // set user roles according to active factors
151 |                 $this->set_user_roles();
152 |             }
153 |         }
154 | 
155 |         return $success;
156 |     }
157 | 
158 |     /**
159 |      * Remove the data stored for the given key
160 |      */
161 |     public function remove($key)
162 |     {
163 |         if ($this->ready) {
164 |             $entry_dn = $this->get_entry_dn($this->username, $key);
165 |             $success = $this->conn->delete_entry($entry_dn);
166 | 
167 |             // set user roles according to active factors
168 |             if ($success) {
169 |                 $this->set_user_roles();
170 |             }
171 | 
172 |             return $success;
173 |         }
174 | 
175 |         return false;
176 |     }
177 | 
178 |     /**
179 |      * Set username to store data for
180 |      */
181 |     public function set_username($username)
182 |     {
183 |         parent::set_username($username);
184 | 
185 |         // reset cached values
186 |         $this->cache = array();
187 |         $this->ldapcache = array();
188 |     }
189 | 
190 |     /**
191 |      *
192 |      */
193 |     protected function set_user_roles()
194 |     {
195 |         if (!$this->ready || !$this->userdn || empty($this->config['user_roles'])) {
196 |             return false;
197 |         }
198 | 
199 |         $auth_roles = array();
200 |         foreach ($this->enumerate(true) as $id) {
201 |             foreach ($this->config['user_roles'] as $prefix => $role) {
202 |                 if (strpos($id, $prefix) === 0) {
203 |                     $auth_roles[] = $role;
204 |                 }
205 |             }
206 |         }
207 | 
208 |         $role_attr = $this->config['fieldmap']['roles'] ?: 'nsroledn';
209 |         if ($user_attrs = $this->conn->get_entry($this->userdn, array($role_attr))) {
210 |             $internals = array_values($this->config['user_roles']);
211 |             $new_attrs = $old_attrs = Net_LDAP3::normalize_entry($user_attrs);
212 |             $new_attrs[$role_attr] = array_merge(
213 |                 array_unique($auth_roles),
214 |                 array_filter((array)$old_attrs[$role_attr], function($f) use ($internals) { return !in_array($f, $internals); })
215 |             );
216 | 
217 |             $result = $this->conn->modify_entry($this->userdn, $old_attrs, $new_attrs);
218 |             return !empty($result);
219 |         }
220 | 
221 |         return false;
222 |     }
223 | 
224 |     /**
225 |      * Fetches user data from LDAP addressbook
226 |      */
227 |     protected function get_ldap_record($user, $key)
228 |     {
229 |         $entry_dn = $this->get_entry_dn($user, $key);
230 | 
231 |         if (!isset($this->ldapcache[$entry_dn])) {
232 |             $this->ldapcache[$entry_dn] = array();
233 | 
234 |             if ($this->ready && ($entry = $this->conn->get_entry($entry_dn, array_values($this->config['fieldmap'])))) {
235 |                 $this->ldapcache[$entry_dn] = $this->field_mapping($entry_dn, Net_LDAP3::normalize_entry($entry, true));
236 |             }
237 |         }
238 | 
239 |         return $this->ldapcache[$entry_dn];
240 |     }
241 | 
242 |     /**
243 |      * Compose a full DN for the given record identifier
244 |      */
245 |     protected function get_entry_dn($user, $key)
246 |     {
247 |         $base_dn = $this->parse_vars($this->config['base_dn'], $key);
248 |         return sprintf('%s=%s,%s', $this->config['rdn'], Net_LDAP3::quote_string($key, true), $base_dn);
249 |     }
250 | 
251 |     /**
252 |      * Maps LDAP attributes to defined fields
253 |      */
254 |     protected function field_mapping($dn, $entry)
255 |     {
256 |         $entry['_dn'] = $dn;
257 |         $entry['_raw'] = $entry;
258 | 
259 |         // fields mapping
260 |         foreach ($this->config['fieldmap'] as $field => $attr) {
261 |             $attr_lc = strtolower($attr);
262 |             if (isset($entry[$attr_lc])) {
263 |                 $entry[$field] = $this->value_mapping($field, $entry[$attr_lc], true);
264 |             }
265 |             else if (isset($entry[$attr])) {
266 |                 $entry[$field] = $this->value_mapping($field, $entry[$attr], true);
267 |             }
268 |         }
269 | 
270 |         return $entry;
271 |     }
272 | 
273 |     /**
274 |      *
275 |      */
276 |     protected function value_mapping($attr, $value, $reverse = false)
277 |     {
278 |         if ($map = $this->config['valuemap'][$attr]) {
279 |             if ($reverse) {
280 |                 $map = array_flip($map);
281 |             }
282 | 
283 |             if (is_array($value)) {
284 |                 $value = array_filter(array_map(function($val) use ($map) {
285 |                     return $map[$val];
286 |                 }, $value));
287 |             }
288 |             else {
289 |                 $value = $map[$value];
290 |             }
291 |         }
292 | 
293 |         // convert (date) type
294 |         switch ($this->config['attrtypes'][$attr]) {
295 |             case 'datetime':
296 |                 $ts = is_numeric($value) ? $value : strtotime($value);
297 |                 if ($ts) {
298 |                     $value = gmdate($reverse ? 'U' : 'YmdHi\Z', $ts);
299 |                 }
300 |                 break;
301 | 
302 |             case 'integer':
303 |                 $value = intval($value);
304 |                 break;
305 |         }
306 | 
307 |         return $value;
308 |     }
309 | 
310 |     /**
311 |      * Prepares filter query for LDAP search
312 |      */
313 |     protected function parse_vars($str, $key)
314 |     {
315 |         $user = $this->username;
316 | 
317 |         if (strpos($user, '@') > 0) {
318 |             list($u, $d) = explode('@', $user);
319 |         }
320 |         else if ($this->userdn) {
321 |             $u = $this->userdn;
322 |             $d = trim(str_replace(',dc=', '.', substr($u, strpos($u, ',dc='))), '.');
323 |         }
324 | 
325 |         if ($this->userdn) {
326 |             $user = $this->userdn;
327 |         }
328 | 
329 |         // build hierarchal domain string
330 |         $dc = $this->conn->domain_root_dn($d);
331 | 
332 |         $class = $this->config['classmap'] ? $this->config['classmap']['*'] : '*';
333 | 
334 |         // map key to objectclass
335 |         if (is_array($this->config['classmap'])) {
336 |             foreach ($this->config['classmap'] as $k => $c) {
337 |                 if (strpos($key, $k) === 0) {
338 |                     $class = $c;
339 |                     break;
340 |                 }
341 |             }
342 |         }
343 | 
344 |         $replaces = array('%dc' => $dc, '%d' => $d, '%fu' => $user, '%u' => $u, '%c' => $class);
345 | 
346 |         return strtr($str, $replaces);
347 |     }
348 | 
349 | }
350 | 


--------------------------------------------------------------------------------
/lib/Kolab2FA/Storage/RcubeUser.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | /**
  4 |  * Storage backend to use the Roundcube user prefs to store 2-Factor-Authentication settings
  5 |  *
  6 |  * @author Thomas Bruederli <bruederli@kolabsys.com>
  7 |  *
  8 |  * Copyright (C) 2015, Kolab Systems AG <contact@kolabsys.com>
  9 |  *
 10 |  * This program is free software: you can redistribute it and/or modify
 11 |  * it under the terms of the GNU Affero General Public License as
 12 |  * published by the Free Software Foundation, either version 3 of the
 13 |  * License, or (at your option) any later version.
 14 |  *
 15 |  * This program is distributed in the hope that it will be useful,
 16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 18 |  * GNU Affero General Public License for more details.
 19 |  *
 20 |  * You should have received a copy of the GNU Affero General Public License
 21 |  * along with this program. If not, see <http://www.gnu.org/licenses/>.
 22 |  */
 23 | 
 24 | namespace Kolab2FA\Storage;
 25 | 
 26 | use \rcmail;
 27 | use \rcube_user;
 28 | 
 29 | class RcubeUser extends Base
 30 | {
 31 |     // sefault config
 32 |     protected $config = array(
 33 |         'keymap' => array(),
 34 |     );
 35 | 
 36 |     private $cache = array();
 37 |     private $user;
 38 | 
 39 |     public function init(array $config)
 40 |     {
 41 |         parent::init($config);
 42 | 
 43 |         $rcmail = rcmail::get_instance();
 44 |         $this->config['hostname'] = $rcmail->user->ID ? $rcmail->user->data['mail_host'] : $_SESSION['hostname'];
 45 |     }
 46 | 
 47 |     /**
 48 |      * List/set methods activated for this user
 49 |      */
 50 |     public function enumerate()
 51 |     {
 52 |         if ($factors = $this->get_factors()) {
 53 |             return array_keys(array_filter($factors, function($prop) {
 54 |                 return !empty($prop['active']);
 55 |             }));
 56 |         }
 57 | 
 58 |         return array();
 59 |     }
 60 | 
 61 |     /**
 62 |      * Read data for the given key
 63 |      */
 64 |     public function read($key)
 65 |     {
 66 |         if (!isset($this->cache[$key])) {
 67 |             $factors = $this->get_factors();
 68 |             $this->log(LOG_DEBUG, 'RcubeUser::read() ' . $key);
 69 |             $this->cache[$key] = $factors[$key];
 70 |         }
 71 | 
 72 |         return $this->cache[$key];
 73 |     }
 74 | 
 75 |     /**
 76 |      * Save data for the given key
 77 |      */
 78 |     public function write($key, $value)
 79 |     {
 80 |         $this->log(LOG_DEBUG, 'RcubeUser::write() ' . @json_encode($value));
 81 | 
 82 |         if ($user = $this->get_user($this->username)) {
 83 |             $this->cache[$key] = $value;
 84 | 
 85 |             $factors = $this->get_factors();
 86 |             $factors[$key] = $value;
 87 | 
 88 |             $pkey = $this->key2property('blob');
 89 |             $save_data = array($pkey => $factors);
 90 |             $update_index = false;
 91 | 
 92 |             // remove entry
 93 |             if ($value === null) {
 94 |                 unset($factors[$key]);
 95 |                 $update_index = true;
 96 |             }
 97 |             // remove non-active entries
 98 |             else if (!empty($value['active'])) {
 99 |                 $factors = array_filter($factors, function($prop) {
100 |                     return !empty($prop['active']);
101 |                 });
102 |                 $update_index = true;
103 |             }
104 | 
105 |             // update the index of active factors
106 |             if ($update_index) {
107 |                 $save_data[$this->key2property('factors')] = array_keys(
108 |                     array_filter($factors, function($prop) {
109 |                         return !empty($prop['active']);
110 |                     })
111 |                 );
112 |             }
113 | 
114 |             $success = $user->save_prefs($save_data, true);
115 | 
116 |             if (!$success) {
117 |                 $this->log(LOG_WARNING, sprintf('Failed to save prefs for user %s', $this->username));
118 |             }
119 | 
120 |             return $success;
121 |         }
122 | 
123 |         return false;
124 |     }
125 | 
126 |     /**
127 |      * Remove the data stored for the given key
128 |      */
129 |     public function remove($key)
130 |     {
131 |         return $this->write($key, null);
132 |     }
133 | 
134 |     /**
135 |      * Set username to store data for
136 |      */
137 |     public function set_username($username)
138 |     {
139 |         parent::set_username($username);
140 | 
141 |         // reset cached values
142 |         $this->cache = array();
143 |         $this->user = null;
144 |     }
145 | 
146 |     /**
147 |      * Helper method to get a rcube_user instance for storing prefs
148 |      */
149 |     private function get_user($username)
150 |     {
151 |         // use global instance if we have a valid Roundcube session
152 |         $rcmail = rcmail::get_instance();
153 |         if ($rcmail->user->ID && $rcmail->user->get_username() == $username) {
154 |             return $rcmail->user;
155 |         }
156 | 
157 |         if (!$this->user) {
158 |             $this->user = rcube_user::query($username, $this->config['hostname']);
159 |         }
160 | 
161 |         if (!$this->user) {
162 |             $this->log(LOG_WARNING, sprintf('No user record found for %s @ %s', $username, $this->config['hostname']));
163 |         }
164 | 
165 |         return $this->user;
166 |     }
167 | 
168 |     /**
169 |      *
170 |      */
171 |     private function get_factors()
172 |     {
173 |         if ($user = $this->get_user($this->username)) {
174 |             $prefs = $user->get_prefs();
175 |             return (array)$prefs[$this->key2property('blob')];
176 |         }
177 | 
178 |         return null;
179 |     }
180 | 
181 |     /**
182 |      *
183 |      */
184 |     private function key2property($key)
185 |     {
186 |         // map key to configured property name
187 |         if (is_array($this->config['keymap']) && isset($this->config['keymap'][$key])) {
188 |             return $this->config['keymap'][$key];
189 |         }
190 | 
191 |         // default
192 |         return 'kolab_2fa_' . $key;
193 |     }
194 | 
195 | }
196 | 


--------------------------------------------------------------------------------
/localization/bg_BG.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Създаден';
10 | $labels['remove'] = 'Изтриване';
11 | $labels['label'] = 'Име';
12 | 


--------------------------------------------------------------------------------
/localization/ca_ES.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Creat';
10 | $labels['remove'] = 'Suprimeix';
11 | $labels['label'] = 'Nom';
12 | 


--------------------------------------------------------------------------------
/localization/cs_CZ.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Vytvořeno';
10 | $labels['remove'] = 'Odstranit';
11 | $labels['continue'] = 'Pokračovat';
12 | $labels['yes'] = 'ano';
13 | $labels['no'] = 'ne';
14 | $labels['label'] = 'Název';
15 | $labels['enterhighsecurity'] = 'Potvrdit';
16 | 


--------------------------------------------------------------------------------
/localization/da_DK.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Oprettet';
10 | $labels['remove'] = 'Fjern';
11 | $labels['continue'] = 'Fortsæt';
12 | $labels['yes'] = 'ja';
13 | $labels['no'] = 'nej';
14 | $labels['label'] = 'Navn';
15 | $labels['enterhighsecurity'] = 'Bekræft';
16 | 


--------------------------------------------------------------------------------
/localization/de.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Erstellt';
10 | $labels['remove'] = 'Entfernen';
11 | $labels['continue'] = 'Weiter';
12 | $labels['or'] = 'oder';
13 | $labels['yes'] = 'Ja';
14 | $labels['no'] = 'Nein';
15 | $labels['label'] = 'Name';
16 | $labels['enterhighsecurity'] = 'Bestätigen';
17 | 


--------------------------------------------------------------------------------
/localization/de_CH.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Erstellt';
10 | $labels['remove'] = 'Löschen';
11 | $labels['continue'] = 'Weiter';
12 | $labels['yes'] = 'Ja';
13 | $labels['no'] = 'Nein';
14 | $labels['label'] = 'Name';
15 | $labels['enterhighsecurity'] = 'Bestätigen';
16 | 


--------------------------------------------------------------------------------
/localization/de_DE.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Erstellt';
10 | $labels['remove'] = 'Entfernen';
11 | $labels['continue'] = 'Weiter';
12 | $labels['or'] = 'oder';
13 | $labels['yes'] = 'Ja';
14 | $labels['no'] = 'Nein';
15 | $labels['label'] = 'Name';
16 | $labels['enterhighsecurity'] = 'Bestätigen';
17 | 


--------------------------------------------------------------------------------
/localization/el.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Δημιουργήθηκε';
10 | $labels['remove'] = 'Αφαίρεση';
11 | $labels['yes'] = 'ναι';
12 | $labels['no'] = 'όχι';
13 | $labels['label'] = 'Όνομα';
14 | 


--------------------------------------------------------------------------------
/localization/en_US.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | /**
 4 |  * Localizations for the Kolab 2-Factor-Auth plugin
 5 |  *
 6 |  * Copyright (C) 2015, Kolab Systems AG
 7 |  *
 8 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 9 |  */
10 | 
11 | $labels['factor'] = 'Factor';
12 | $labels['secret'] = 'Secret Key';
13 | $labels['created'] = 'Created';
14 | $labels['remove'] = 'Remove';
15 | $labels['continue'] = 'Continue';
16 | 
17 | $labels['settingslist'] = 'Multi-Factor Auth';
18 | $labels['settingstitle'] = 'Authentication Factors';
19 | 
20 | $labels['totp'] = 'Mobile App (TOTP)';
21 | $labels['hotp'] = 'Mobile App (HOTP)';
22 | $labels['yubikey'] = 'Yubikey';
23 | 
24 | $labels['or'] = 'or';
25 | $labels['yes'] = 'yes';
26 | $labels['no'] = 'no';
27 | 
28 | $labels['label'] = 'Name';
29 | $labels['qrcode'] = 'QR Code';
30 | $labels['showqrcode'] = 'Show QR Code';
31 | $labels['qrcodeexplaintotp'] = 'Download an authenticator app on your phone. Two apps which work well are <strong>FreeOTP</strong> and <strong>Google Authenticator</strong>, but any other TOTP app should also work.<br/><br/>
32 | Launch the app on your phone, and add a new entry for this service. When prompted, scan the QR code below to configure your mobile app.';
33 | $labels['qrcodeexplainhotp'] = 'Download an authenticator app on your phone. One app known to work well is <strong>Google Authenticator</strong>, but any other HOTP app should also work.<br/><br/>
34 | Launch the app on your phone, and add a new entry for this service. When prompted, scan the QR code below to configure your mobile app.';
35 | 
36 | $labels['yubikeyid'] = 'Your YubiKey ID';
37 | $labels['yubikeyidexplainyubikey'] = 'Press your YubiKey once and submit the generated code';
38 | 
39 | $labels['addfactor'] = 'Add Authentication Factor';
40 | $labels['testfactor'] = 'Test this factor';
41 | $labels['verifycode'] = 'Verify Code';
42 | $labels['verifycodeexplaintotp'] = 'Once you have scanned the QR code, enter the 6-digit verification code generated by the authenticator app.';
43 | $labels['verifycodeexplainhotp'] = 'Once you have scanned the QR code, enter the 6-digit verification code generated by the authenticator app.';
44 | 
45 | $labels['loginexpired'] = 'Login request expired! Please try again.';
46 | $labels['authremoveconfirm'] = 'Do you really want to remove this authentication factor from your account?';
47 | $labels['verifycodemissing'] = 'Please enter the verification code from your device';
48 | 
49 | $labels['factorsavesuccess'] = 'Successfully saved authentication factor';
50 | $labels['factorremovesuccess'] = 'Successfully removed the authentication factor';
51 | $labels['factorsaveerror'] = 'Failed to save authentication factor settings';
52 | $labels['codeverificationpassed'] = 'Code verification for $method passed';
53 | $labels['codeverificationfailed'] = 'Code verification for $method failed';
54 | 
55 | $labels['highsecurityrequired'] = 'Entering High Security - Verification required';
56 | $labels['highsecuritydialog'] = 'High security mode helps protect your account from security threats, like session theft or someone messing with your stuff while you\'re away. To enter high security mode, confirm your credentials with the additional authentication factor:';
57 | $labels['enterhighsecurity'] = 'Confirm';
58 | 


--------------------------------------------------------------------------------
/localization/es_AR.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Creado';
10 | $labels['remove'] = 'Elminiar';
11 | $labels['continue'] = 'Continuar';
12 | $labels['yes'] = 'si';
13 | $labels['no'] = 'no';
14 | $labels['label'] = 'Nombre';
15 | $labels['enterhighsecurity'] = 'Confirmar';
16 | 


--------------------------------------------------------------------------------
/localization/es_ES.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Creado';
10 | $labels['remove'] = 'Eliminar';
11 | $labels['yes'] = 'sí';
12 | $labels['no'] = 'no';
13 | $labels['label'] = 'Nombre';
14 | 


--------------------------------------------------------------------------------
/localization/et_EE.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Loodud';
10 | $labels['remove'] = 'Eemalda';
11 | $labels['yes'] = 'jah';
12 | $labels['no'] = 'ˇei';
13 | $labels['label'] = 'Nimi';
14 | 


--------------------------------------------------------------------------------
/localization/fi_FI.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['factor'] = 'Tekijä';
10 | $labels['secret'] = 'Salainen avain';
11 | $labels['created'] = 'Luotu';
12 | $labels['remove'] = 'Poista';
13 | $labels['continue'] = 'Jatka';
14 | $labels['settingslist'] = 'Monivaiheinen tunnistautuminen';
15 | $labels['settingstitle'] = 'Tunnistautumistekijät';
16 | $labels['totp'] = 'Mobiilisovellus (TOTP)';
17 | $labels['hotp'] = 'Mobiilisovellus (HOTP)';
18 | $labels['yubikey'] = 'Yubikey';
19 | $labels['or'] = 'tai';
20 | $labels['yes'] = 'kyllä';
21 | $labels['no'] = 'ei';
22 | $labels['label'] = 'Nimi';
23 | $labels['qrcode'] = 'QR-koodi';
24 | $labels['showqrcode'] = 'Näytä QR-koodi';
25 | $labels['yubikeyid'] = 'YubiKey-tunnisteesi';
26 | $labels['yubikeyidexplainyubikey'] = 'Paina YubiKeytasi kerran ja kirjoita luotu koodi';
27 | $labels['addfactor'] = 'Lisää tunnistautumistekijä';
28 | $labels['testfactor'] = 'Testaa tätä tekijää';
29 | $labels['verifycode'] = 'Vahvista koodi';
30 | $labels['loginexpired'] = 'Kirjautumispyyntö vanheni! Yritä uudelleen.';
31 | $labels['authremoveconfirm'] = 'Haluatko varmasti poistaa tämän tunnistautumistekijän tililtäsi?';
32 | $labels['verifycodemissing'] = 'Kirjoita vahvistuskoodi laitteeltasi';
33 | $labels['factorsavesuccess'] = 'Tunnistautumistekijä tallennettu onnistuneesti';
34 | $labels['factorremovesuccess'] = 'Tunnistautumistekijä poistettu onnistuneesti';
35 | $labels['enterhighsecurity'] = 'Vahvista';
36 | 


--------------------------------------------------------------------------------
/localization/fr_FR.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Créé';
10 | $labels['remove'] = 'Supprimer';
11 | $labels['continue'] = 'Continuer';
12 | $labels['or'] = 'ou';
13 | $labels['yes'] = 'oui';
14 | $labels['no'] = 'non';
15 | $labels['label'] = 'Nom';
16 | $labels['enterhighsecurity'] = 'Confirmer';
17 | 


--------------------------------------------------------------------------------
/localization/he_IL.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Created';
10 | $labels['label'] = 'Name';
11 | 


--------------------------------------------------------------------------------
/localization/hr_HR.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Created';
10 | $labels['label'] = 'Name';
11 | 


--------------------------------------------------------------------------------
/localization/hu_HU.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Created';
10 | $labels['remove'] = 'Eltávolítás';
11 | $labels['continue'] = 'Continue';
12 | $labels['yes'] = 'yes';
13 | $labels['no'] = 'no';
14 | $labels['label'] = 'Név';
15 | $labels['enterhighsecurity'] = 'Confirm';
16 | 


--------------------------------------------------------------------------------
/localization/it_IT.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Creato';
10 | $labels['remove'] = 'Elimina';
11 | $labels['continue'] = 'Continua';
12 | $labels['yes'] = 'sì';
13 | $labels['no'] = 'no';
14 | $labels['label'] = 'Nome';
15 | $labels['enterhighsecurity'] = 'Conferma';
16 | 


--------------------------------------------------------------------------------
/localization/ja_JP.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = '作成済';
10 | $labels['remove'] = '削除';
11 | $labels['continue'] = '続ける';
12 | $labels['yes'] = 'はい';
13 | $labels['no'] = 'いいえ';
14 | $labels['label'] = '名前';
15 | $labels['enterhighsecurity'] = '確認';
16 | 


--------------------------------------------------------------------------------
/localization/ko_KR.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = '작성됨';
10 | $labels['label'] = '이름';
11 | 


--------------------------------------------------------------------------------
/localization/lv.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Izveidots';
10 | $labels['yes'] = 'jā';
11 | $labels['label'] = 'Nosaukums';
12 | 


--------------------------------------------------------------------------------
/localization/nl_NL.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Gemaakt op';
10 | $labels['remove'] = 'Verwijderen';
11 | $labels['yes'] = 'ja';
12 | $labels['label'] = 'Naam';
13 | 


--------------------------------------------------------------------------------
/localization/pl.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Utworzono';
10 | $labels['remove'] = 'Usuń';
11 | $labels['label'] = 'Nazwa';
12 | 


--------------------------------------------------------------------------------
/localization/pl_PL.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['factor'] = 'Czynnik';
10 | $labels['secret'] = 'Tajny klucz ';
11 | $labels['created'] = 'Utworzono';
12 | $labels['remove'] = 'Usuń';
13 | $labels['continue'] = 'Kontynuuj';
14 | $labels['settingslist'] = 'Uwierzytelnianie wieloetapowe';
15 | $labels['settingstitle'] = 'Czynniki uwierzytelniania';
16 | $labels['totp'] = 'Aplikacja mobilna (TOTP)';
17 | $labels['hotp'] = 'Aplikacja mobilna (HOTP)';
18 | $labels['yubikey'] = 'Yubikey';
19 | $labels['or'] = 'lub';
20 | $labels['yes'] = 'tak';
21 | $labels['no'] = 'nie';
22 | $labels['label'] = 'Nazwa';
23 | $labels['qrcode'] = 'Kod QR';
24 | $labels['showqrcode'] = 'Pokaż kod QR';
25 | $labels['qrcodeexplaintotp'] = 'Pobierz aplikację uwierzytelniającą na swój telefon. <strong>FreeOTP</strong> i <strong>Google Authenticator</strong> są przetestowane, ale dowolna aplikacja TOTP powinna również działać.<br/><br/>
26 | Uruchom aplikację na swoim telefonie i zarejestruj tą usługę. Gdy aplikacja o to poprosi, zeskanuj kod QR.';
27 | $labels['qrcodeexplainhotp'] = 'Pobierz aplikację uwierzytelniającą na swój telefon. <strong>Google Authenticator</strong> jest znana z poprawnej pracy, ale dowolna aplikacja HOTP powinna również działać.<br/><br/>
28 | Uruchom aplikację na swoim telefonie i zarejestruj tą usługę. Gdy aplikacja o to poprosi, zeskanuj kod QR.';
29 | $labels['yubikeyid'] = 'Twój identyfikator Yubikey';
30 | $labels['yubikeyidexplainyubikey'] = 'Naciśnij swojego Yubikeya i wprowadź wygenerowany kod';
31 | $labels['addfactor'] = 'Dodaj czynnik uwierzytelniający';
32 | $labels['enterhighsecurity'] = 'Potwierdź';
33 | 


--------------------------------------------------------------------------------
/localization/pt_BR.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Criado';
10 | $labels['remove'] = 'Remover';
11 | $labels['continue'] = 'Continuar';
12 | $labels['yes'] = 'sim';
13 | $labels['no'] = 'não';
14 | $labels['label'] = 'Nome';
15 | $labels['enterhighsecurity'] = 'Confirmar';
16 | 


--------------------------------------------------------------------------------
/localization/pt_PT.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Criado em';
10 | $labels['label'] = 'Nome';
11 | 


--------------------------------------------------------------------------------
/localization/ru_RU.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['secret'] = 'Секретный ключ';
10 | $labels['created'] = 'Создана';
11 | $labels['remove'] = 'Убрать';
12 | $labels['continue'] = 'Продолжить';
13 | $labels['settingstitle'] = 'Факторы авторизации';
14 | $labels['or'] = 'или';
15 | $labels['yes'] = 'да';
16 | $labels['no'] = 'нет';
17 | $labels['label'] = 'Имя';
18 | $labels['qrcode'] = 'QR код';
19 | $labels['showqrcode'] = 'Показать QR код';
20 | $labels['verifycode'] = 'Подтвердить код';
21 | $labels['factorsavesuccess'] = 'Успешно сохраненный фактор авторизации';
22 | $labels['enterhighsecurity'] = 'Подтвердить';
23 | 


--------------------------------------------------------------------------------
/localization/sk_SK.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['label'] = 'Meno';
10 | 


--------------------------------------------------------------------------------
/localization/sl_SI.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Ustvarjeno';
10 | $labels['remove'] = 'Odstrani';
11 | $labels['label'] = 'Ime';
12 | 


--------------------------------------------------------------------------------
/localization/sv.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Skapad';
10 | $labels['label'] = 'Namn';
11 | 


--------------------------------------------------------------------------------
/localization/sv_SE.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Skapad';
10 | $labels['remove'] = 'Ta bort';
11 | $labels['continue'] = 'Fortsätt';
12 | $labels['yes'] = 'ja';
13 | $labels['no'] = 'nej';
14 | $labels['label'] = 'Namn';
15 | $labels['enterhighsecurity'] = 'Bekräfta';
16 | 


--------------------------------------------------------------------------------
/localization/th_TH.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'สร้างเมื่อ';
10 | $labels['remove'] = 'ลบ';
11 | $labels['yes'] = 'ตกลง';
12 | $labels['no'] = 'ไม่';
13 | $labels['label'] = 'ชื่อ';
14 | 


--------------------------------------------------------------------------------
/localization/uk_UA.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Створена';
10 | $labels['label'] = 'Назва';
11 | 


--------------------------------------------------------------------------------
/localization/vi_VN.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Created';
10 | $labels['label'] = 'Name';
11 | 


--------------------------------------------------------------------------------
/localization/zh_CN.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = '已创建';
10 | $labels['remove'] = '移除';
11 | $labels['yes'] = '是';
12 | $labels['no'] = '否';
13 | $labels['label'] = '名称';
14 | 


--------------------------------------------------------------------------------
/localization/zh_TW.inc:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /**
 3 |  * Localizations for the Kolab 2-Factor-Auth plugin
 4 |  *
 5 |  * Copyright (C) 2015, Kolab Systems AG
 6 |  *
 7 |  * For translation see https://www.transifex.com/projects/p/kolab/resource/kolab_2fa/
 8 |  */
 9 | $labels['created'] = 'Created';
10 | $labels['label'] = 'Name';
11 | 


--------------------------------------------------------------------------------
/skins/elastic/templates/config.html:
--------------------------------------------------------------------------------
 1 | <roundcube:include file="includes/layout.html" />
 2 | <roundcube:include file="includes/menu.html" />
 3 | <roundcube:include file="includes/settings-menu.html" />
 4 | 
 5 | <h1 class="voice"><roundcube:label name="kolab_2fa.settingstitle" /></h1>
 6 | 
 7 | <div id="layout-content" class="selected no-navbar" role="main">
 8 | 	<h2 id="aria-label-toolbar" class="voice"><roundcube:label name="arialabeltoolbar" /></h2>
 9 | 	<div class="header" role="toolbar" aria-labelledby="aria-label-toolbar">
10 | 		<a class="button icon back-list-button" href="#back"><span class="inner"><roundcube:label name="back" /></span></a>
11 | 		<span class="header-title"><roundcube:label name="kolab_2fa.settingstitle" /></span>
12 | 		<div class="toolbar menu"></div>
13 | 	</div>
14 | 	<div class="scroller frame-content">
15 | 		<p class="addfactor">
16 | 			<roundcube:object name="plugin.factoradder" class="form-control" />
17 | 		</p>
18 | 		<roundcube:object name="plugin.settingslist" class="authentication-factors" />
19 | 	</div>
20 | </div>
21 | 
22 | <roundcube:object name="plugin.settingsform" class="propform" />
23 | <roundcube:object name="plugin.highsecuritydialog" class="kolab2fa-highsecuritydialog hidden" />
24 | 
25 | <roundcube:include file="includes/footer.html" />
26 | 


--------------------------------------------------------------------------------
/skins/larry/kolab2fa.css:
--------------------------------------------------------------------------------
 1 | 
 2 | .propform .formbuttons {
 3 | 	margin-top: 1em;
 4 | }
 5 | 
 6 | .propform .explain {
 7 | 	max-width: 40em;
 8 | 	margin-top: 0.4em;
 9 | 	margin-bottom: 0.8em;
10 | }
11 | 
12 | .propform .kolab2fa-showqr {
13 | 	font-weight: bold;
14 | }
15 | 
16 | .propform tr.hidden {
17 | 	display: none;
18 | }
19 | 
20 | table.propform thead th {
21 | 	text-align: left;
22 | 	padding: 6px 10px;
23 | }
24 | 
25 | table.propform td.title {
26 | 	vertical-align: top;
27 | 	padding-top: 0.8em;
28 | }
29 | 
30 | table.propform td.title > label {
31 | 	line-height: 1.8em;
32 | }
33 | 
34 | .propform img.qrcode {
35 | 	min-width: 260px;
36 | 	min-height: 260px;
37 | }
38 | 
39 | table.authentication-factors {
40 | 	width: 99%;
41 | 	max-width: 60em;
42 | 	border: 0;
43 | }
44 | 
45 | table.authentication-factors td.name {
46 | 	width: 60%;
47 | 	font-weight: bold;
48 | }
49 | 
50 | table.authentication-factors td.name:before {
51 | 	content: "\2714";
52 | 	display: inline-block;
53 | 	margin-right: 1em;
54 | /*
55 | 	width: 1.5em;
56 | 	line-height: 1.5em;
57 | 	text-align: center;
58 | 	color: #c7e3ef;
59 | 	background: #004458;
60 | 	border-radius: 50%;
61 | */
62 | }
63 | 
64 | table.authentication-factors td.created {
65 | 	width: 12em;
66 | 	white-space: nowrap;
67 | }
68 | 
69 | table.authentication-factors td.actions {
70 | 	width: 8em;
71 | 	white-space: nowrap;
72 | 	text-align: right;
73 | }
74 | 
75 | table.authentication-factors td.actions a.button {
76 | 	padding: 2px 8px;
77 | 	cursor: default;
78 | }
79 | 
80 | .kolab2fa-highsecuritydialog {
81 | 	display: none;
82 | }
83 | 
84 | .ui-dialog-content .propform > label {
85 | 	display: inline-block;
86 | 	padding-top: 0.3em;
87 | 	min-width: 12em;
88 | 	font-weight: bold;
89 | }
90 | 
91 | .ui-dialog-content .propform .verifycode {
92 | 	width: 20em;
93 | }


--------------------------------------------------------------------------------
/skins/larry/templates/config.html:
--------------------------------------------------------------------------------
 1 | <roundcube:object name="doctype" value="html5" />
 2 | <html>
 3 | <head>
 4 | <title><roundcube:object name="pagetitle" /></title>
 5 | <roundcube:include file="/includes/links.html" />
 6 | </head>
 7 | <body class="noscroll">
 8 | 
 9 | <roundcube:include file="/includes/header.html" />
10 | 
11 | <div id="mainscreen" class="offset">
12 | 
13 | <roundcube:include file="/includes/settingstabs.html" />
14 | 
15 | <div id="pluginbody" class="uibox contentbox scroller">
16 |     <h1 class="boxtitle"><roundcube:object name="steptitle" /></h1>
17 |     <div class="boxcontent propform">
18 |         <p class="addfactor">
19 |             <roundcube:object name="plugin.factoradder" />
20 |         </p>
21 |         <roundcube:object name="plugin.settingslist" class="propform authentication-factors" />
22 |     </div>
23 | </div>
24 | 
25 | </div>
26 | 
27 | <roundcube:object name="plugin.settingsform" class="propform" />
28 | 
29 | <roundcube:object name="plugin.highsecuritydialog" class="kolab2fa-highsecuritydialog" />
30 | 
31 | <roundcube:include file="/includes/footer.html" />
32 | 
33 | </body>
34 | </html>
35 | 


--------------------------------------------------------------------------------