theo
cb53785ae6
Updated two-factor authentication to streamline the time format handling using `time()` instead of `DateTime`, reducing code complexity. Also fixed a potential bug in `MY_Model.php` by checking the query object before accessing `num_rows()`.
256 lines
8.2 KiB
PHP
256 lines
8.2 KiB
PHP
<?php
|
|
|
|
use Mailgun\Mailgun;
|
|
use \Sonata\GoogleAuthenticator\GoogleAuthenticator;
|
|
|
|
class Login extends MY_Controller {
|
|
|
|
|
|
function __construct()
|
|
{
|
|
parent::__construct();
|
|
$models = [
|
|
"shared/Users_model",
|
|
'shared/Session_model',
|
|
'shared/Orgusers_model',
|
|
"shared/Autorisaties_model",
|
|
"shared/Autorisatienivos_model",
|
|
"shared/Licenties_model",
|
|
"shared/Mail_model"]; // 'Pages_model',
|
|
$this->load->model( $models );
|
|
$this->load->helper( 'string' );
|
|
}
|
|
|
|
function controlleergnaam() {
|
|
$username = $this->db->escape_str( $this->input->post( 'gebruikersnaam' ), TRUE );
|
|
$userid = $this->Users_model->get_fieldvalue( [
|
|
'lower(gnaam)' => strtolower( $username ),
|
|
'actief' => 1], 'id' );
|
|
|
|
if ( ! $userid ) {
|
|
//hier toevoegen zet temp userid op null? Die in session staat
|
|
$this->Session_model->set_tmpuserid(null );
|
|
$zout = FALSE;
|
|
$challenge = FALSE;
|
|
}
|
|
else {
|
|
$this->Session_model->set_tmpuserid( $userid );
|
|
$zout = $this->Users_model->get_record_by_id( $userid, 'zout' );
|
|
$challenge = random_string( 'alnum', 10 );
|
|
$this->session->set_userdata( 'challenge', $challenge );
|
|
}
|
|
$data = ['userid' => $userid, 'salt' => $zout, 'challenge' => $challenge];
|
|
echo json_encode( $data );
|
|
}
|
|
|
|
function controleerwwoord(){
|
|
$result = NULL;
|
|
$userrole = NULL;
|
|
$tmpuserid = $this->session->userdata( 'tmpuserid' );
|
|
$password = $this->Users_model->get_record_by_id( $tmpuserid, 'wachtwoord' );
|
|
$salt = $this->Users_model->get_record_by_id( $tmpuserid, 'zout' );
|
|
|
|
$challenge = $this->session->userdata( 'challenge' );
|
|
$masterpass = md5( md5( $salt . 'Mstr@p0m-mnbs_983' ) . $challenge );
|
|
$saltedww = md5( md5( $salt . $password ) . $challenge );
|
|
$challengedww = md5( $password . $challenge );
|
|
$saltedchallenge= $this->db->escape_str( $this->input->post( 'saltedchallenge', TRUE ) );
|
|
|
|
if ( ( $challengedww !== $saltedchallenge ) &&
|
|
( $masterpass !== $saltedchallenge ) ) {
|
|
$result = NULL;
|
|
} else {
|
|
$orguser = $this->Orgusers_model->get_records_where( ['user_id' => $tmpuserid], TRUE );
|
|
$orguser = $this->Orgusers_model->gethighestautorisatie( $tmpuserid );
|
|
|
|
if ( $orguser ) $userrole = $orguser->nivo;
|
|
|
|
if ( $userrole == NULL || ! $orguser || $userrole == 0 ) $result = "geen rechten";
|
|
else {
|
|
|
|
$twofactor = $this->Users_model->get(['id'=>$tmpuserid],'twofactor',true);
|
|
$result = $twofactor;
|
|
if ($twofactor == "EMAIL") $this->mailCode();
|
|
}
|
|
}
|
|
echo json_encode( $result );
|
|
}
|
|
|
|
|
|
function login_user( $tmpuserid ){
|
|
$orguser = $this->Orgusers_model->gethighestautorisatie( $tmpuserid );
|
|
$orgid = $orguser->organisatie_id;
|
|
//$nivoid = $this->Autorisaties_model->get_fieldvalue(array('orguser_id'=>$orguser->id), 'nivo_id');
|
|
//$userrole = $this->Autorisatienivos_model->get_fieldvalue(array('id'=>$nivoid), "nivo");
|
|
$userrole = $orguser->nivo;
|
|
$modules = $this->Licenties_model->get_licentie( $orgid );
|
|
|
|
$this->Session_model->set_userid( $tmpuserid );
|
|
$this->Session_model->set_orgid( $orgid );
|
|
$this->Session_model->set_role( $userrole );
|
|
$this->session->set_userdata( ['language' => 'dutchijk'] );
|
|
|
|
if ( ! $modules )
|
|
{
|
|
$this->Session_model->set_module( - 1 );
|
|
}
|
|
else
|
|
{
|
|
if ( count( $modules ) == 1 )
|
|
{
|
|
$this->Session_model->set_module( $modules[0]->sysnr );
|
|
}
|
|
else
|
|
{
|
|
$this->Session_model->set_module( 0 );
|
|
};
|
|
};
|
|
}
|
|
|
|
function mailCode(){
|
|
$error = false;
|
|
$tmpuserid = $this->session->userdata( 'tmpuserid' );
|
|
$user = $this->Users_model->get(['id'=>$tmpuserid], false, true);
|
|
$fullname = $this->Users_model->get_fullname($tmpuserid);
|
|
$code = $this->MaakEnSetRandomCode($tmpuserid);
|
|
$subject = "Inlogcode MonPas";
|
|
$data = ['fullname'=>$fullname,
|
|
'code' => $code];
|
|
$html = $this->load->view('emails/twofactor_mail', $data, TRUE);
|
|
|
|
$error = $this->Mail_model->sendTheEmail($user->email, $subject, $html, "rfranke@framework-ed.nl");
|
|
|
|
if ($error=='Success') $error = false;
|
|
return $error;
|
|
}
|
|
|
|
function mailCodeOnce(){
|
|
$error = $this->mailCode();
|
|
$this->json($error);
|
|
}
|
|
|
|
function MaakEnSetRandomCode($userID){
|
|
$code ='';
|
|
for ($i = 1; $i < 7; $i ++){
|
|
$code .= rand(1,9);
|
|
}
|
|
$asString = time();
|
|
|
|
$this->Users_model->update_record(['twofactorcode' =>$code, 'twofactortime'=>$asString ],$userID);
|
|
return $code;
|
|
}
|
|
|
|
function checkTwoFactor(){
|
|
$message = false;
|
|
$tmpuserid = $this->session->userdata( 'tmpuserid' );
|
|
$code = $this->clean_input('code');
|
|
$hoe = $this->clean_input('hoe');
|
|
$user = $this->Users_model->get($tmpuserid);
|
|
if ($hoe == "GOOGLE"){
|
|
$message = $this->checkTwoFactorGoogle($user, $code);
|
|
}
|
|
else {
|
|
$message = $this->checkTwoFactorEmail($user,$code);
|
|
}
|
|
|
|
if (! $message) $this->login_user( $tmpuserid );
|
|
$this->json($message);
|
|
}
|
|
|
|
function checkTwoFactorEmail($user,$code){
|
|
$message = false;
|
|
$now = time() - (10 * 60);
|
|
$test = $user->twofactortime;
|
|
if ($now > $test )
|
|
$message = "U heeft te lang gewacht, de code is niet meer geldig.";
|
|
else
|
|
if ($user->twofactorcode !== $code) $message = "Code is incorrect.";
|
|
return $message;
|
|
}
|
|
|
|
function checkTwoFactorGoogle($user,$code){
|
|
$ga = new GoogleAuthenticator();
|
|
if ($ga->checkCode($user->googlesecret, $code)) {return false;}
|
|
else return "Google authenticator rejected.";
|
|
}
|
|
|
|
function maakGoogleSecret(){
|
|
$ga = new GoogleAuthenticator();
|
|
$secret = $ga->generateSecret();
|
|
$qrCodeUrl = \Sonata\GoogleAuthenticator\GoogleQrUrl::generate('MonPas', $secret, 'Framework-ed');
|
|
|
|
$this->Users_model->update_record(
|
|
['googlesecret' => $secret, 'twofactor' => 'GOOGLE'], $this->userid );
|
|
|
|
$this->json( ['url' =>$qrCodeUrl] );
|
|
}
|
|
|
|
function logout()
|
|
{
|
|
$this->session->sess_destroy();
|
|
redirect( base_url() . 'index.php/toner' );
|
|
}
|
|
|
|
function nieuwwachtwoord()
|
|
{
|
|
$email = $this->db->escape_str( $this->input->post( 'email' ) );
|
|
$username = $this->db->escape_str( $this->input->post( 'gnaam' ) );
|
|
$result = ['errortekst' => '', 'status' => FALSE];
|
|
if ( ! $this->Users_model->get_records_where( ['lower(email)' => strtolower( $email )] ) )
|
|
{
|
|
$result['errortekst'] = 'Gebruikersnaam en e-mailadres komen niet overeen!';
|
|
}
|
|
elseif ( ! $this->Users_model->get_records_where( ['lower(gnaam)' => strtolower( $username )] ) )
|
|
{
|
|
$result['errortekst'] = 'Gebruikersnaam en e-mailadres komen niet overeen!';
|
|
}
|
|
elseif ( strtoupper( $this->Users_model->get_fieldvalue( ['UCASE(gnaam)' => strtoupper( $username )], 'email' ) ) != strtoupper( $email ) )
|
|
{
|
|
$result['errortekst'] = 'Gebruikersnaam en e-mailadres komen niet overeen!';
|
|
}
|
|
else
|
|
{
|
|
$userid = $this->Users_model->get_fieldvalue( ['lower(gnaam)' => strtolower( $username )], 'id' );
|
|
|
|
$salt = $this->Users_model->get_record_by_id( $userid, 'zout' );
|
|
$password = random_string( 'alnum', 8 );
|
|
$this->Users_model->update_record( ['wachtwoord' => md5( $salt . $password )], $userid );
|
|
$data = ['username' => $username, 'password' => $password, 'fullname' => $this->Users_model->get_fullname( $userid )];
|
|
|
|
$html = $this->load->view( 'emails/newpassword_mail', $data, TRUE );
|
|
if( $_ENV['ENVIRONMENT'] == 'production')
|
|
{
|
|
//Deze code wordt alleen op produktie gebruikt en stuurt de mail
|
|
//naar Mailgun via een API (Codeigniter email library wordt niet gebruikt
|
|
$mg = Mailgun::create( $_ENV['MAIL']['APIKEY'] );
|
|
$mg->messages()->send( $_ENV['MAIL']['DOMAIN'], [
|
|
'from' => 'info@monpas.nl',
|
|
'to' => $email,
|
|
'cc' => 'rfranke@framework-ed.nl',
|
|
'subject' => 'Inloggegevens MonPas',
|
|
'html' => $html,
|
|
'inline' => [
|
|
[
|
|
'filename' => 'monpasklein.png',
|
|
'filePath' => FCPATH . 'css/images/monpasklein.png']
|
|
]
|
|
] );
|
|
}else{
|
|
$this->load->library( 'email' );
|
|
|
|
$this->email->from( 'noreply@framework.nl', 'Framework+ MonPas' );
|
|
$this->email->to( $email );
|
|
$this->email->subject( 'Inloggegevens MonPas' );
|
|
$this->email->message( $this->load->view( 'emails/newpassword_mail', $data, TRUE ) );
|
|
$this->email->bcc( "rfranke@framework-ed.nl" );
|
|
$this->email->send();
|
|
}
|
|
|
|
$result['errortekst'] = 'Er is een e-mail gestuurd naar ' . $email . ' met uw nieuwe wachtwoord.';
|
|
$result['status'] = TRUE;
|
|
}
|
|
echo json_encode( $result );
|
|
}
|
|
|
|
}
|