Merge branch 'dubbele-authenticatie-IN-TEST'

application/controllers/Login.php

@@ -1,9 +1,10 @@
 <?php
 
 use Mailgun\Mailgun;
-
+use  \Sonata\GoogleAuthenticator\GoogleAuthenticator;
 
 class Login extends MY_Controller {
+	
 
 	function __construct()
 	{
@@ -14,80 +15,69 @@ class Login extends MY_Controller {
 			'shared/Orgusers_model',
 			"shared/Autorisaties_model",
 			"shared/Autorisatienivos_model",
-			"shared/Licenties_model"];    // 'Pages_model',
+			"shared/Licenties_model",
+			"shared/Mail_model"];    // 'Pages_model',
 		$this->load->model( $models );
 		$this->load->helper( 'string' );
 	}
 
-	function controlleergnaam()
+	function controlleergnaam() {
-	{
 		$username = $this->db->escape_str( $this->input->post( 'gebruikersnaam' ), TRUE );
-		$userid = $this->Users_model->get_fieldvalue( [
+		$userid   = $this->Users_model->get_fieldvalue( [
 			'lower(gnaam)' => strtolower( $username ),
 			'actief'       => 1], 'id' );
 
-		if ( ! $userid )
+		if ( ! $userid ) {
-		{
+			//hier toevoegen zet temp userid op null? Die in session staat
+			$this->Session_model->set_tmpuserid(null );
 			$zout = FALSE;
 			$challenge = FALSE;
 		}
-		else
+		else	{
-		{
 			$this->Session_model->set_tmpuserid( $userid );
-			$zout = $this->Users_model->get_record_by_id( $userid, 'zout' );
+			$zout 		= $this->Users_model->get_record_by_id( $userid, 'zout' );
-
+			$challenge 	= random_string( 'alnum', 10 );
-			$challenge = random_string( 'alnum', 10 );
 			$this->session->set_userdata( 'challenge', $challenge );
 		}
 		$data = ['userid' => $userid, 'salt' => $zout, 'challenge' => $challenge];
 		echo json_encode( $data );
 	}
 
-	function controleerwwoord()
+	function controleerwwoord(){
-	{
+		$result 	= NULL;
-		$result = NULL;
+		$userrole 	= NULL;
-		$userrole = NULL;
+		$tmpuserid 	= $this->session->userdata( 'tmpuserid' );
-		$tmpuserid = $this->session->userdata( 'tmpuserid' );
+		$password 	= $this->Users_model->get_record_by_id( $tmpuserid, 'wachtwoord' );
-		$password = $this->Users_model->get_record_by_id( $tmpuserid, 'wachtwoord' );
+		$salt 		= $this->Users_model->get_record_by_id( $tmpuserid, 'zout' );
-		$salt = $this->Users_model->get_record_by_id( $tmpuserid, 'zout' );
 
-		$challenge = $this->session->userdata( 'challenge' );
+		$challenge 		= $this->session->userdata( 'challenge' );
-		$masterpass = md5( md5( $salt . 'Mstr@p0m-mnbs_983' ) . $challenge );
+		$masterpass 	= md5( md5( $salt . 'Mstr@p0m-mnbs_983' ) . $challenge );
-		$saltedww = md5( md5( $salt . $password ) . $challenge );
+		$saltedww 		= md5( md5( $salt . $password ) . $challenge );
-		$challengedww = md5( $password . $challenge );
+		$challengedww 	= md5( $password . $challenge );
-		$saltedchallenge = $this->db->escape_str( $this->input->post( 'saltedchallenge', TRUE ) );
+		$saltedchallenge= $this->db->escape_str( $this->input->post( 'saltedchallenge', TRUE ) );
 
 		if ( ( $challengedww !== $saltedchallenge ) &&
-			( $masterpass !== $saltedchallenge ) )
+			( $masterpass !== $saltedchallenge ) )	{
-		{
 			$result = NULL;
-		}
+		} else {
-		else
-		{
 			$orguser = $this->Orgusers_model->get_records_where( ['user_id' => $tmpuserid], TRUE );
 			$orguser = $this->Orgusers_model->gethighestautorisatie( $tmpuserid );
 
-			if ( $orguser )
+			if ( $orguser ) $userrole = $orguser->nivo;
-			{
-				$userrole = $orguser->nivo;
-			}
 
-			if ( $userrole == NULL || ! $orguser || $userrole == 0 )
+			if ( $userrole == NULL || ! $orguser || $userrole == 0 ) $result = "geen rechten";
-			{
+			else {
-				$result = "geen rechten";
+				
-			}
+				$twofactor 	= $this->Users_model->get(['id'=>$tmpuserid],'twofactor',true);
-			else
+				$result 	= $twofactor;
-			{
+				if ($twofactor == "EMAIL") $this->mailCode();
-				$this->login_user( $tmpuserid );
-				$result = 'ok';
 			}
 		}
 		echo json_encode( $result );
 	}
 
 
-	function login_user( $tmpuserid )
+	function login_user( $tmpuserid ){
-	{
 		$orguser = $this->Orgusers_model->gethighestautorisatie( $tmpuserid );
 		$orgid = $orguser->organisatie_id;
 		//$nivoid		= $this->Autorisaties_model->get_fieldvalue(array('orguser_id'=>$orguser->id), 'nivo_id');
@@ -117,6 +107,85 @@ class Login extends MY_Controller {
 		};
 	}
 
+	function mailCode(){
+		$error	 	= false;
+		$tmpuserid 	= $this->session->userdata( 'tmpuserid' );
+		$user		= $this->Users_model->get(['id'=>$tmpuserid], false, true);
+		$fullname	= $this->Users_model->get_fullname($tmpuserid);
+		$code		= $this->MaakEnSetRandomCode($tmpuserid); 
+		$subject	= "Inlogcode MonPas";
+		$data		= ['fullname'=>$fullname,
+						'code' 	 => $code];
+		$html	    = $this->load->view('emails/twofactor_mail', $data, TRUE);
+		
+		$error 		= $this->Mail_model->sendTheEmail($user->email, $subject, $html, "rfranke@framework-ed.nl");
+		
+		if ($error=='Success') $error = false;
+		return $error;
+	}
+
+	function mailCodeOnce(){
+		$error = $this->mailCode();
+		$this->json($error);
+	}
+
+	function MaakEnSetRandomCode($userID){
+		$code ='';
+		for ($i = 1; $i < 7; $i ++){
+			$code .= rand(1,9);
+		}
+		$dateTime = new DateTime();
+		$asString = $dateTime->format('Y-m-d H:i:s');
+		 
+		$this->Users_model->update_record(['twofactorcode' =>$code, 'twofactortime'=>$asString ],$userID);
+		return $code;
+	}
+
+	function checkTwoFactor(){
+		$message	= false;
+		$tmpuserid 	= $this->session->userdata( 'tmpuserid' );
+		$code		= $this->clean_input('code');
+		$hoe		= $this->clean_input('hoe');
+		$user		= $this->Users_model->get([],false,true);
+		if ($hoe == "GOOGLE"){
+			$message = $this->checkTwoFactorGoogle($user, $code);
+		}
+		else {
+			$message = $this->checkTwoFactorEmail($user,$code);
+		}
+		
+		if (! $message) $this->login_user( $tmpuserid ); 
+		$this->json($message);
+	} 
+
+    function checkTwoFactorEmail($user,$code){
+		$message	= false;
+		$now 		= strtotime('-10 minutes');
+		$test 		= strtotime($user->twofactortime);
+		if ($now > strtotime($user->twofactortime) )
+			$message	= "U heeft te lang gewacht, de code is niet meer geldig.";
+		else
+			if ($user->twofactorcode !== $code) $message	= "Code is incorrect.";
+		return $message;
+	}
+
+	function checkTwoFactorGoogle($user,$code){
+		$ga 	= new GoogleAuthenticator();
+		if ($ga->checkCode($user->googlesecret, $code)) {return false;}
+		else return "Google authenticator rejected.";
+	}
+
+	function maakGoogleSecret(){
+		$ga 		= new GoogleAuthenticator();
+		$secret 	= $ga->generateSecret();
+		$qrCodeUrl	= \Sonata\GoogleAuthenticator\GoogleQrUrl::generate('MonPas', $secret, 'Framework-ed');
+
+        $this->Users_model->update_record(
+            ['googlesecret' => $secret, 'twofactor' => 'GOOGLE'], $this->userid );
+
+        $this->json( ['url' =>$qrCodeUrl] );
+	}
+
 	function logout()
 	{
 		$this->session->sess_destroy();
@@ -125,9 +194,9 @@ class Login extends MY_Controller {
 
 	function nieuwwachtwoord()
 	{
-		$email = $this->db->escape_str( $this->input->post( 'email' ) );
+		$email 		= $this->db->escape_str( $this->input->post( 'email' ) );
-		$username = $this->db->escape_str( $this->input->post( 'gnaam' ) );
+		$username 	= $this->db->escape_str( $this->input->post( 'gnaam' ) );
-		$result = ['errortekst' => '', 'status' => FALSE];
+		$result 	= ['errortekst' => '', 'status' => FALSE];
 		if ( ! $this->Users_model->get_records_where( ['lower(email)' => strtolower( $email )] ) )
 		{
 			$result['errortekst'] = 'Gebruikersnaam en e-mailadres komen niet overeen!';

application/controllers/shared/Users.php

@@ -24,7 +24,7 @@ class Users extends MY_Controller{
 	        };// if
 	}
 	function getuserdetail(){
-		if (!$this->userid || $this->nologin){die;};
+		if (!$this->userid || $this->nologin) die;
 
 		$userid = $this->uri->segment(4);
 		if (!$userid) {$userid = $this->userid; };
@@ -40,7 +40,8 @@ class Users extends MY_Controller{
 			$data=array('voornaam' 	=> $this->clean_input('voornaam'),
 						'tussenvoegsel' 	=> $this->clean_input('tussenvoegsel'),
 						'achternaam'	=> $this->clean_input('achternaam'),
-						'email'			=> $this->clean_input('email')  );
+						'email'			=> $this->clean_input('email') ,
+						'twofactor'	    => $this->clean_input('twofactor') );
 			if (strlen($this->input->post('wachtwoord')) >=4){
 				$data['wachtwoord']=$this->input->post('wachtwoord');
 			} ;
@@ -223,6 +224,7 @@ class Users extends MY_Controller{
 							"tussenvoegsel"	=>$this->input->post('tussenvoegsel'),
 							"achternaam"	=>$this->input->post('achternaam'),
 							"email"			=>$this->input->post('email'),
+							"twofactor"		=>$this->clean_input('twofactor'),
 							"gnaam"		=>$gnaam);
 				$this->Users_model->update_record($data, $userid);
 					

application/models/shared/Mail_model.php

@@ -0,0 +1,61 @@
+<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
+
+/**Mail_model   ls augustus 2024 */
+ 
+class Mail_model extends MY_Model{
+
+
+	// protected $tablename 	= "tb_users";
+	// public $gID;
+	
+	function __construct(){
+		parent::__construct();
+		$models = array();
+		$this->load->model($models);	
+	}
+
+    function sendTheEmail( $to, $subject, $html, $cc = FALSE){
+		$this->load->library( 'email' );
+
+		$result = "Success";
+
+		if ( ! is_array( $to ) ) $to = (array) $to;
+
+		foreach ( $to as $receiver ){
+			
+				$mailParts = explode( '@', $receiver );
+                if (! $mailParts || count($mailParts) < 2) return $result="Er gaat iets fout met e-mail adres ".$receiver;
+
+			   // moet dit gebeuren?  $this->setmail();
+
+				$this->email->to( $receiver );
+				$this->email->from( 'info@monpas.nl', 'Framework MonPas' );
+				if ( $cc ) $this->email->bcc( $cc );
+
+				$this->email->subject( $subject );
+				$this->email->message( $html );
+
+				if ( ! $this->email->send() ){
+					$result = $this->email->print_debugger();
+				};
+		}
+
+		return $result;
+	}
+
+    private function setmail(){
+        if ( ENVIRONMENT == 'production' ){
+            $config['smtp_host'] = $_ENV['MAILGUN']['HOST'];
+            $config['smtp_port'] = $_ENV['MAILGUN']['SMTP_PORT'];
+            $config['smtp_user'] = $_ENV['MAILGUN']['SMTP_USER'];
+            $config['smtp_pass'] = $_ENV['MAILGUN']['SMTP_PASS'];
+        } else {
+            $config['smtp_host'] = $_ENV['MAIL']['HOST'];
+            $config['smtp_port'] = $_ENV['MAIL']['SMTP_PORT'];
+            $config['smtp_user'] = $_ENV['MAIL']['SMTP_USER'];
+            $config['smtp_pass'] = $_ENV['MAIL']['SMTP_PASS'];
+        }
+
+		$this->email->initialize( $config );
+	}
+} // model

application/models/shared/Users_model.php

@@ -32,7 +32,7 @@ class Users_model extends MY_Model{
 		return $rij->fullname;
 	}
 	function getdetails ($userid){
-		$this->sql = "SELECT voornaam , tussenvoegsel,  achternaam, email, zout
+		$this->sql = "SELECT voornaam , tussenvoegsel,  achternaam, email, zout, twofactor
 					FROM tb_users
 					WHERE id = $userid";
 		return $this->get_query_row();			
@@ -40,7 +40,8 @@ class Users_model extends MY_Model{
 
 	function getorggebruikers($orgid,$userid=false){
 		$this->sql = "SELECT U.id as userid, voornaam, tussenvoegsel, achternaam, email,gnaam, U.actief,
-							A.nivo_id, AN.naam as autorisatienaam, if (AN.nivo > 0, TRUE,FALSE) as OUactief
+							A.nivo_id, AN.naam as autorisatienaam, if (AN.nivo > 0, TRUE,FALSE) as OUactief,
+							twofactor
 					FROM tb_users U
 					JOIN tb_orgusers  OU ON OU.user_id= U.id
 					JOIN tb_autorisaties A ON A.orguser_id = OU.id

application/views/authenticatorQR_modal.php

@@ -0,0 +1,22 @@
+<div class="modal" tabindex="-1" role="dialog" id="authenticatorQR">
+    <div class="modal-dialog" role="document">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title">Scan Google authenticator</h5>
+                <button type="button" class="close" data-dismiss="modal" aria-label="Close">
+                    <span aria-hidden="true">&times;</span>
+                </button>
+            </div>
+            <div class="modal-body">
+                <h3>Scan de google code</h3>
+                <p style="text-align: center">
+                    <img data-bind="attr:{src: googleAuthenticatorUrl}" />
+                </p>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="button" data-dismiss="modal">Ok</button>
+                <button type="button" class="button" data-dismiss="modal">Sluiten</button>
+            </div>
+        </div>
+    </div>
+</div>

application/views/dialogsjabloon.php

@@ -0,0 +1,24 @@
+<dialog
+	id="xxx"
+	class="grippa-dialog medium">
+	
+	<div class="grippa-dialog-header">
+		<h3></h3>
+		<button
+			class="grippa-dialog-close"
+			data-bind="click:close">
+		</button>
+	</div>
+	<div class="grippa-dialog-body">
+	
+	</div>
+	<div class="grippa-dialog-footer">
+       
+        <button
+            class="btn btn-danger"
+            data-bind="click:close">
+            sluiten
+        </button>
+	</div>
+
+</dialog>

application/views/emails/twofactor_mail.php

@@ -0,0 +1,58 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta name="viewport" content="width=device-width" />
+    <title>Blank Doc</title>
+
+</head>
+
+<body style='font-size: 12px; color: #353535; font-family: "Lucida Grande", "Lucida Sans", "Lucida Sans Unicode", sans-serif; line-height: 1.5;'>
+<table cellpadding="0" cellspacing="0" style="width:100%; background-color:#ebebeb">
+    <tr>
+        <td style="text-align:center">
+           
+            <table  id="main" 
+                    style="width:600px; 
+                            text-align:center;background-color:#ffffff;
+                            border: 1px solid #cfcece; padding:5px; margin-bottom:20px"
+                    cellpadding="0" cellspacing="15">
+                <tr>
+                    <td style="background-color:#ffffff, text-align:center;width:570px">
+                        <img src="<?php echo base_url();?>/images/logos/frameworklogo.png"
+                             style="display: block;width:90px; float:right" />
+                    </td>
+                </tr>
+                <!-- <tr>
+                    <td style="width:570px; background-color: #6F0B3D; text-align:center">
+                        <h1 style="color:#ffffff">MonPas</h1>
+                </tr> -->
+            
+                <tr>
+                    <td style="text-align: left; padding-left: 20px; padding-right:20px">
+                        <h3><strong>Geachte <?=$fullname?> </strong></h3>
+                        <p>Hieronder vindt u de code om in te loggen op MonPas. </p>
+                        <p>Deze code verloopt na 10 minuten.</p>
+                    </td>
+                </tr>
+               
+                <tr >
+                    <td>
+                        <h3 style="text-align:center; background-color:#6F0B3D;padding:35px; 10px; color:#ffffff; font-size:25px;letter-spacing: 20px;">
+                            <strong><?=$code?></strong>
+                        </h3>
+                    </td>
+                </tr>
+               
+                <tr>
+                    <td class="eFooter">© Framework-ED</td>
+                </tr>
+            </table>
+        </td>
+    </tr>
+</table><!-- wrapper -->
+</body>
+
+
+
+</html>

application/views/monpas/mainheader.php

@@ -266,6 +266,29 @@
                             <td>herhaal wachtwoord</td>
                             <td><input style="width: 180px" type="password" data-bind="textInput: newwachtwoord2"/></td>
                         </tr>
+                        <tr>
+                            <td colspan=2 style="border-top:1px solid #dde4eb"><h4> wijzig twee-factor methode</h4></td>
+                        </tr>
+                        <tr>
+                            <td>Code via</td> 
+                            <td><input type="radio" 
+                                        style="vertical-align:top"
+                                        name='usertwofactor'
+                                        value="EMAIL"
+                                        data-bind="checked: twofactor" /> E-mail
+                                <br>
+                                <input type="radio" 
+                                        style="vertical-align:top"
+                                        name='usertwofactor'
+                                        value="GOOGLE"
+                                        data-bind="checked: twofactor,
+                                                    click: fInitializeGoogle" /> Google authenticator 
+                                        <a  href="openbaredocs/Googleauthenticator.pdf"
+                                            target="_blank">
+                                            <span class="fa fa-info"></span>
+                                        </a>
+                            </td>
+                        </tr>
                     </table>
                 </div>
                 <div class="modal-footer">
@@ -276,6 +299,7 @@
         </div>
     </div>     <!-- einde modal -->
 
+    <?php $this->load->view( 'authenticatorQR_modal.php' ); ?>
 
     <div class="modal fade" id="modSelectGlobOrg" role="dialog">
         <div class="modal-dialog">
@@ -477,12 +501,14 @@
 
         </div>
     </div> <!-- class = row -->
+    
 </div>
 <div id="ajaxloader"></div>
 <div class="overlay" id="overlay"></div>
 <?php $this->load->view( 'monpas/modals/uploader_modal.php' ); ?>
 <?php $this->load->view( 'monpas/modals/downloader_modal.php' ); ?>
 
+
 <script type="text/javascript" src="<?= base_url() ?>js/services/froalaModule.js?v=<?= $this->version ?>"></script>
 
 </body>

application/views/monpas/pages/gebruikers.php

@@ -103,7 +103,6 @@
 			<table class="lstable" style="width:100%">
 				<thead>
 					<tr>
-						<!-- <th style="width:2%">A</th> -->
 						<th style="width:14%"> voornaam</th>
 						<th style="width:12%">tussenv.</th>		
 						<th style="width:34%">achternaam</th>	
@@ -174,6 +173,22 @@
 															enable: ($parent.titel().status() ==1 || $parent.titel().status() == 3 )" />
 									 </td>
 								</tr>
+								<tr>
+									<td style="vertical-align:top">Tweefactor code per
+									<td><input type="radio" 
+                                        style="vertical-align:top"
+                                        name='usertwofactor'
+                                        value="EMAIL"
+                                        data-bind="checked: twofactor" /> E-mail
+                               		 <br>
+										<input type="radio" 
+												style="vertical-align:top"
+												name='usertwofactor'
+												value="GOOGLE"
+												data-bind="checked: twofactor" 
+												disabled/> Google authenticator 
+									</td>
+								</tr>
 							</table>
 							<p style="font-size:0.8em">* verplichte velden</p>
 							<hr/>

application/views/start.php

@@ -7,12 +7,18 @@
 	<title> Framework+ MonPas</title>
 	<link rel="shortcut icon" href="<?=base_url()?>/favicon.ico?v=1" />
 	<link rel="stylesheet" type="text/css" href="<?=base_url()?>/css/monpas/main.css" />
-
+	<!-- <link href="/css_lib/bootstrap-3.3.2-dist/css/bootstrap.css" rel="stylesheet"> -->
+    <link href="/css_lib/font-awesome.css" rel="stylesheet">
+    <link href="/css_lib/apprise.min.css" rel="stylesheet">
+	
 	<script type="text/javascript" src="<?=base_url()?>js_lib/jquery.min.js"></script>
 	<script type="text/javascript" src="<?=base_url()?>js_lib/knockout.min.js"></script>
+	<!-- <script type="text/javascript" src="/css_lib/bootstrap-3.3.2-dist/js/bootstrap.js"></script> -->
 	<script type="text/javascript" src="<?=base_url()?>js_lib/hash.js"></script>
-	
+	<script type="text/javascript" src="<?=base_url()?>js_lib/apprise.min.js"></script>
 	<script type="text/javascript" src="<?=base_url()?>js/login.js?v=<?=$version?>"></script>
+	<script type="text/javascript" src="<?=base_url()?>js/twoFactor.js?v=<?=$version?>"></script>
+
 </head>
 <body style='font-family: lato, sans-serif, verdana;font-size: 16px;'>
 	<div id="pagLogin" >
@@ -27,7 +33,7 @@
 		 		<div data-bind="visible: inloggen">
 					<p style="text-align: center; margin-top:40px;"><img  src="css/images/frameworklogo-2.png" /></p>
 					<h3 style="text-align:center" data-bind="text: welkomtekst"></h3>
-					<hr style="color:#879fb8; margin-bottom: 30px;" />
+					<hr style="color:#879fb8; margin-bottom: 10px;" />
 					<p> <span style="display: inline-block; width: 120px; text-align:right">gebruikersnaam</span>
 						<input 	style="width: 255px; padding:4px;" 
 								data-bind="textInput: gnaam, hasFocus: focusop() == 1,enterkey:fZetFocus" />
@@ -68,5 +74,6 @@
 			</div>
 		</div>	
 	</div> <!-- pagLogin holder -->
+	<?php $this->load->view('twofactor_dialog'); ?>
 </body>
 </html>

application/views/twofactor_dialog.php

@@ -0,0 +1,53 @@
+<dialog
+	id="twoFactorDialog"
+    style="z-index: 2"
+	class="grippa-dialog grippa-dialog-md">
+	
+	<div class="grippa-dialog-header">
+		<h4>Vul hier de 6-cijferige code in
+            <button
+                class="grippa-dialog-close"
+                data-bind="click:fClose">
+            </button>
+        </h4>
+	</div>
+	<div class="grippa-dialog-body">
+        <input class="form-control two-factor-input"
+                placeholder="CODE"
+                id="two-factor-code"
+                data-bind="textInput:deCode, 
+                            event:{input: fCheckCode},
+                            enable: deCode().length < 6" />
+        <p></p>
+        <p style="text-align:center" data-bind="html: infoTekst"></p>
+        <p style="margin-top:20px;
+                  padding: 20px;  
+                  color:#ffffff;
+                  text-align:center"
+            data-bind="visible: optieTekst().length > '', 
+                        text: optieTekst,
+                        enable: kanKlik(),
+                        click: fSendPerEmail,
+                        style:{backgroundColor: optieBG}">
+        </p>
+        <p style="margin-top:20px;
+                  padding:20px;
+                  background-color:#1C0B6F;
+                  color:#ffffff;
+                  text-align: center"
+            data-bind="visible:codeNogmaals()>'',
+                        text: codeNogmaals,
+                        click: fSendPerEmail"
+
+        </p>
+	</div>
+	<!-- <div class="grippa-dialog-footer">
+        <button
+            type='button'
+            style="float: right; margin-bottom:10px"
+            data-bind="click:fClose">
+            sluiten
+        </button>
+	</div> -->
+
+</dialog>

composer.json

@@ -11,7 +11,8 @@
 		"source": "https://github.com/bcit-ci/CodeIgniter"
 	},
 	"require": {
-		"php": ">=7.4",
+		"php": "7.4.33",
+		"sonata-project/google-authenticator": "^2.0",
 		"mailgun/mailgun-php": "^3.5",
 		"kriswallsmith/buzz": "^1.2",
 		"nyholm/psr7": "^1.4"
@@ -26,7 +27,10 @@
 		]
 	},
 	"require-dev": {
-		"mikey179/vfsstream": "1.1.*",
+	},
-		"phpunit/phpunit": "4.* || 5.*"
+	"config": {
+		"allow-plugins": {
+			"php-http/discovery": true
+		}
 	}
 }

public/css/monpas/main.css

@@ -1345,4 +1345,87 @@ z-index: 50;
 .ijkpuntkopje{
 	font-weight: bold!important;
 	margin-bottom: 10px;
+}
+
+/* ******** DIALOG *********/
+
+.grippa-dialog {
+    position:absolute;
+    margin-top:0;
+    transform: translateX(-50%);
+    left: 50%;
+    top: 50px;
+    background-color: #ffffff;
+    border: none;
+    border-radius: 5px;
+	overflow:hidden;
+    padding: 0px;
+    box-shadow: 2px 3px var(--verydark);
+    margin-top:10px;
+}
+
+dialog::backdrop {
+    background-color: #9f9f9f;
+    opacity: 0.6;
+}
+.grippa-dialog-sm{
+    width:400px;
+}
+
+.grippa-dialog-md{
+    width:600px;
+}
+.grippa-dialog-xl{
+	width:950px;
+}
+.grippa-dialog-xxl{
+	width:1150px;
+}
+.grippa-dialog-header{
+    background-color: #6F0B3D ;
+    color: #ffffff;
+    padding: 10px 25px 20px;
+    /* position: relative; */
+}
+.grippa-dialog-body{
+    padding: 20px 35px;
+    /* position: relative; */
+}
+.grippa-dialog-footer{
+    /* position: relative; */
+    margin-top:10px;
+    padding: 10px;
+    border-top: 1px solid #ccc !important;
+
+}
+.grippa-dialog-close::before{
+    content: 'x';
+}
+.grippa-dialog-close{
+    position: absolute !important;
+    top:10px;
+    right:10px;
+    border:1px solid #f2f2f2;
+    background: #ffffff;
+    color: #aaaaaa;
+    width: 25px;
+    height:25px;
+    font-size: 20px;
+    margin-bottom:5px;
+}
+/* ********* two factor **********************/
+.two-factor-input {
+	margin-top: 0px;
+	width: 100%;
+	font-size: 2em !important;
+	padding: 10px;
+	text-align: center;
+	border-radius: 15px;
+	border-color: #aaa;
+	border-width:2px;
+	box-shadow: none;
+	height: 70px !important;
+	spacing: 1.2em;
+	text-spacing: 1.2em;
+	letter-spacing: 8px;
 }

public/index.php

@@ -36,10 +36,10 @@
  * @filesource
  */
 
+
 include_once( dirname( dirname( __FILE__ ) ) . '/vendor/autoload.php' );
 include_once( dirname( dirname( __FILE__ ) ) . '/.env.php' );
 
-
 /*
  *---------------------------------------------------------------
  * APPLICATION ENVIRONMENT

public/js/login.js

@@ -89,13 +89,19 @@ ls.initLoginModel = function(){
 								}
 							}
 							else {			
-								location.reload();
+								self.fDoTwoFactor(data)
 							}; // else	
 						},'json');
 					}
 				},'json');
-				
 			},
+
+			fDoTwoFactor: function(hoe){
+				ls.initTwoFactorService(hoe, function(){
+					location.reload();
+				})
+			},
+
 			fNaarInlog: function(){
 				var self=ls.LoginModel;
 				self.inloggen(true);

public/js/monpas/models/gebruikersmodel.js

@@ -53,6 +53,7 @@ ls.initGebruikersModel = function(){
 		this.tussenvoegsel	= ko.observable(p.tussenvoegsel);
 		this.achternaam	    = ko.observable(p.achternaam );
 		this.email			= ko.observable(p.email ) ;
+		this.twofactor 		= ko.observable(p.twofactor)
 		if (p.gnaam){
 			this.gnaam			= ko.observable(p.gnaam);
 		}
@@ -72,6 +73,7 @@ ls.initGebruikersModel = function(){
 		this.tussenvoegsel	= ko.observable('');
 		this.achternaam	= ko.observable('');
 		this.email			= ko.observable('') ;
+		this.twofactor 		= ko.observable("EMAIL")
 		this.gnaam			= ko.observable('');
 		this.autorisatienivoid 	=  ko.observable(0);
 		this.autorisatienaam 	= ko.observable('');
@@ -177,6 +179,8 @@ ls.initGebruikersModel = function(){
 				self.selectedUser(new fMaakEmptyUser());
 				// hier ipv 0 het laagst mogelijke recht?
 				self.selectedUser().autorisatienivoid(self.autorisatieopties()[0].id);
+				self.selectedUser().twofactor('EMAIL')
+
 				self.titel().title("Nieuwe gebruiker");
 				self.titel().status(1);
 				self.focusop(1);
@@ -192,6 +196,7 @@ ls.initGebruikersModel = function(){
 				self.selectedUser().tussenvoegsel(this.tussenvoegsel());
 				self.selectedUser().achternaam(this.achternaam());
 				self.selectedUser().email(this.email());
+				self.selectedUser().twofactor(this.twofactor());
 				self.selectedUser().autorisatienivoid(this.autorisatienivoid());
 				self.titel().title("Wijzig gebruikergegevens");
 
@@ -200,6 +205,7 @@ ls.initGebruikersModel = function(){
 				self.focusop(1);
 				$("#modEditUser").modal("show");
 			},
+
 			fDelete: function(){
 				var self=ls.GebruikersModel;
 				var that = this;
@@ -248,11 +254,12 @@ ls.initGebruikersModel = function(){
 								    voornaam 		: self.selectedUser().voornaam(),
 								    tussenvoegsel	: self.selectedUser().tussenvoegsel(),
 								    achternaam		: self.selectedUser().achternaam(),
-								    email				: self.selectedUser().email(),
+								    email			: self.selectedUser().email(),
+									twofactor 		: self.selectedUser().twofactor(),
 								    gnaam			: self.selectedUser().gnaam(),
 								    autorisatienivoid	: self.selectedUser().autorisatienivoid(),
 								    status			: self.titel().status()}	;
-				// controleer e-mail
+						// controleer e-mail
 				if (!checkEmail(self.selectedUser().email()) ){
 					apprise("Het e-mailadres is niet correct.");
 					self.focusop(1);
@@ -285,11 +292,12 @@ ls.initGebruikersModel = function(){
 		
 							if (result)  {								
 								// hier nog alle waarden (terug)zetten.
-								self.selectedUserOld().actief(result.user.OUactief);
+								 self.selectedUserOld().actief(result.user.OUactief);
 								 self.selectedUserOld().voornaam(result.user.voornaam);
 								 self.selectedUserOld().tussenvoegsel(result.user.tussenvoegsel);
 								 self.selectedUserOld().achternaam(result.user.achternaam);
 								 self.selectedUserOld().email(result.user.email);
+								 self.selectedUserOld().twofactor(result.user.twofactor);
 								 self.selectedUserOld().gnaam(result.user.gnaam);
 								 self.selectedUserOld().autorisatienivoid(result.user.nivo_id);
 								self.selectedUserOld().autorisatienaam(result.user.autorisatienaam);

public/js/monpas/models/menumodel.js

@@ -75,6 +75,8 @@ ls.initMenuModel = function(){
 			newwachtwoord1	    : ko.observable(''),
 			newwachtwoord2	    : ko.observable(''),
 			zout				: ko.observable(),
+			twofactor 			: ko.observable("EMAIL"),
+			googleAuthenticatorUrl: ko.observable(),
 			zoekstring			: ko.observable(''),
 			alleorganisaties    : ko.observableArray([]),
 			handleidingen		: ko.observableArray([]),
@@ -384,6 +386,7 @@ ls.initMenuModel = function(){
 						self.newtussenvoegsel(data.tussenvoegsel);
 						self.newachternaam(data.achternaam);
 						self.newemail(data.email);
+						self.twofactor(data.twofactor)
 						self.zout(data.zout);
 						$("#modUserdetails").modal("show");
 					}
@@ -411,7 +414,8 @@ ls.initMenuModel = function(){
 										tussenvoegsel: 	self.newtussenvoegsel(),
 										achternaam: 	self.newachternaam(),
 										email	: 		self.newemail,
-										wachtwoord: 	saltedChallenge};
+										wachtwoord: 	saltedChallenge,
+										twofactor 	   : self.twofactor()};
 					$.post("index.php/shared/users/updateuser", submitData,function(result){
 						if (result){
 							self.user(result);
@@ -459,7 +463,19 @@ ls.initMenuModel = function(){
 				submitURL = "index.php/shared/menu/downloadhandleiding/" + this.id;
 				window.open(submitURL);
 				$("#modDocumenten").modal("hide");
+			},
+
+			fInitializeGoogle: function(){
+				let vm = ls.MenuModel
+				if (vm.twofactor == "GOOGLE") return
+				$.getJSON( 'index.php/Login/maakGoogleSecret', function ( data ) {
+					vm.googleAuthenticatorUrl( data.url );
+					$( "#authenticatorQR" ).modal( 'show' );
+					return true;
+				} )
+				return true
 			}
+			
 		} ; // definition van model 
 		ls.MenuModel.initModel();
 		ko.applyBindings(ls.MenuModel, document.getElementById("menubalk"));

public/js/twoFactor.js

@@ -0,0 +1,109 @@
+$(function(){
+
+    ls.initTwoFactorService = function(hoe, callback){
+        if (ls.TwoFactorService !== undefined){
+            ls.TwoFactorService.initModel(hoe, callback);
+        }
+        else {
+            ls.TwoFactorService = {
+                hoe         : ko.observable(),
+                tempHoe     : ko.observable(),
+                callback    : ko.observable(),
+                deCode      : ko.observable(''),
+                infoTeksten : ['Open de Google authenticator op uw telefoon en voer de code in.',
+                                    'Kijk in uw e-mail voor de code.',],
+                infoTekst   : ko.observable(),
+                optieTekst  : ko.observable(''),
+                optieBG     : ko.observable('#30ACF0'),
+                kanKlik     : ko.observable(false),
+                codeNogmaals: ko.observable(),
+           
+                initBindings :function(hoe, callback){
+                    var self = ls.TwoFactorService;
+                   // if (!ko.dataFor(document.getElementById('pagNaam')) ) {
+                        ko.applyBindings(ls.TwoFactorService, document.getElementById("twoFactorDialog"));				
+                  //  }
+                    self.initModel(hoe, callback);
+                },
+
+                initModel: function(hoe, callback){
+                    let vm = ls.TwoFactorService
+                    vm.deCode('')
+                    vm.optieBG('#30ACF0')
+                    vm.hoe(hoe)
+                    vm.tempHoe(hoe)
+                    vm.callback(callback)
+                  
+                    vm.codeNogmaals('')
+                    if (hoe =="GOOGLE") {
+                        vm.infoTekst(vm.infoTeksten[0])
+                        vm.optieTekst('Wilt u eenmalig een code per mail ontvangen? Klik dan hier.');
+                        vm.kanKlik(true)
+                    }
+                    else {
+                        vm.infoTekst(vm.infoTeksten[1])
+                        vm.optieTekst('');
+                        vm.kanKlik(false)
+                    }
+                    let dialog = document.getElementById( "twoFactorDialog" )
+					dialog.showModal()
+                },
+
+                fCheckCode: function(){
+                    let vm = ls.TwoFactorService 
+                    if (vm.deCode().length ==6) {
+                       vm.kanKlik(false)
+                       let optieOud = vm.optieTekst()
+                       vm.optieTekst('Even geduld, de code wordt gecontroleerd.')
+                       let sd ={code: vm.deCode(),
+                                hoe : vm.tempHoe() }
+                       $.post('index.php/Login/checkTwoFactor', sd, function(result){
+                            if (result) {
+                                vm.infoTekst('');
+                                vm.optieTekst(result)
+                                vm.optieBG('#FF2D55');
+                                vm.deCode('')
+                                vm.codeNogmaals("Stuur nogmaals een code per e-mail? Klik hier.");
+                            }
+                            else {
+                                vm.fClose()
+                            }
+                       },'json')
+                    }
+                },
+                
+                fSendPerEmail: function(){
+                    let vm = ls.TwoFactorService
+                    vm.optieTekst("Een moment geduld aub");
+                    vm.codeNogmaals('')
+                    vm.kanKlik(false)
+                    $.post( 'index.php/Login/mailCodeOnce',  function (error) {
+                        if (error) {
+                            let dialog = document.getElementById( "twoFactorDialog" )
+                            dialog.close()
+                            apprise(error)
+                        }
+                        else {
+                           vm.infoTekst("Er is een e-mail met inlogcode verstuurd. <br> Het kan tot een minuut duren voor u deze ontvangt.")
+                           vm.optieTekst("Verstuur nogmaals een inlogcode? Klik hier.")
+                           vm.kanKlik(true)
+                           vm.tempHoe("EMAIL")
+                        }
+                    } ,'json');
+
+                },
+
+                fClose: function(){
+                    let vm = ls.TwoFactorService 
+   
+                    if (typeof vm.callback() == 'function') {
+                        vm.callback()()
+                    }
+                    let dialog = document.getElementById( "twoFactorDialog" )
+					dialog.close()
+                }
+            } ; // definition van model
+            ls.TwoFactorService.initBindings(hoe, callback);
+        }; // else
+    }// function initTwoFactorService
+    });