index.php 4.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119
  1. <?php declare(strict_types=1);
  2. ob_start(); //i'm too lazy to check when is sent what ;)
  3. //set session cookie to be read only via http and not by JavaScript
  4. ini_set('session.cookie_httponly', '1');
  5. include_once __DIR__.'/../../src/GoogleAuthenticator.php';
  6. include_once __DIR__.'/../../src/GoogleQrUrl.php';
  7. include_once __DIR__.'/../../src/FixedBitNotation.php';
  8. include_once 'Users.php';
  9. ?>
  10. <!DOCTYPE HTML>
  11. <html>
  12. <head>
  13. <title>Google Authenticator in PHP demo</title>
  14. </head>
  15. <body>
  16. <?php
  17. //set this to false, if you don't want the token prefilled
  18. $debug = true;
  19. $users = new Users();
  20. //check if the user has a session, if not, show the login screen
  21. if ($username = $users->hasSession()) {
  22. //load the user data from the json storage.
  23. $user = $users->loadUser($username);
  24. //if he clicked logout, destroy the session and redirect to the startscreen.
  25. if (isset($_GET['logout'])) {
  26. session_destroy();
  27. header('Location: ./');
  28. }
  29. // check if the user is logged in.
  30. if ($user->isLoggedIn()) {
  31. include __DIR__.'/../tmpl/loggedin.php';
  32. //show the QR code if whished so
  33. if (isset($_GET['showqr'])) {
  34. $secret = $user->getSecret();
  35. include __DIR__.'/../tmpl/show-qr.php';
  36. }
  37. }
  38. //if the user is in the OTP phase and submit the OTP.
  39. else {
  40. if ($user->isOTP() && isset($_POST['otp'])) {
  41. $g = new \Google\Authenticator\GoogleAuthenticator();
  42. // check if the submitted token is the right one and log in
  43. if ($g->checkCode($user->getSecret(), $_POST['otp'])) {
  44. // do log-in the user
  45. $user->doLogin();
  46. //if the user clicked the "remember the token" checkbox, set the cookie
  47. if (isset($_POST['remember']) && $_POST['remember']) {
  48. $user->setOTPCookie();
  49. }
  50. include __DIR__.'/../tmpl/loggedin.php';
  51. }
  52. //if the OTP is wrong, destroy the session and tell the user to try again
  53. else {
  54. session_destroy();
  55. include __DIR__.'/../tmpl/login-error.php';
  56. }
  57. }
  58. // if the user is neither logged in nor in the OTP phase, show the login form
  59. else {
  60. session_destroy();
  61. include __DIR__.'/../tmpl/login.php';
  62. }
  63. }
  64. die();
  65. }
  66. //if the username is set in _POST, then we assume the user filled in the login form.
  67. if (isset($_POST['username'])) {
  68. // check if we can load the user (ie. the user exists in our db)
  69. $user = $users->loadUser($_POST['username']);
  70. if ($user) {
  71. //try to authenticate the password and start the session if it's correct.
  72. if ($user->auth($_POST['password'])) {
  73. $user->startSession();
  74. //check if the user has a valid OTP cookie, so we don't have to
  75. // ask for the current token and can directly log in
  76. if ($user->hasValidOTPCookie()) {
  77. include __DIR__.'/../tmpl/loggedin.php';
  78. $user->doLogin();
  79. }
  80. // try to get the users' secret from the db,
  81. // if he doesn't have one, generate one, store it and show it.
  82. else {
  83. if (!$user->getSecret()) {
  84. include __DIR__.'/../tmpl/loggedin.php';
  85. $secret = $user->generateSecret();
  86. $users->storeData($user);
  87. $user->doLogin();
  88. include __DIR__.'/../tmpl/show-qr.php';
  89. }
  90. // if the user neither has a valid OTP cookie nor it's the first login
  91. // ask for the OTP
  92. else {
  93. $user->doOTP();
  94. include __DIR__.'/../tmpl/ask-for-otp.php';
  95. }
  96. }
  97. die();
  98. }
  99. }
  100. // if we're here, something went wrong, destroy the session and show a login error
  101. session_destroy();
  102. include __DIR__.'/../tmpl/login-error.php';
  103. die();
  104. }
  105. // if neither a session nor tried to submit the login credentials -> login screen
  106. include __DIR__.'/../tmpl/login.php';
  107. ?>
  108. </body>
  109. </html>