2021-07-02 21:53:33 +02:00
|
|
|
<?php
|
|
|
|
|
|
|
|
namespace BookStack\Http\Controllers\Auth;
|
|
|
|
|
|
|
|
use BookStack\Actions\ActivityType;
|
2021-08-02 17:35:37 +02:00
|
|
|
use BookStack\Auth\Access\LoginService;
|
2021-07-02 21:53:33 +02:00
|
|
|
use BookStack\Auth\Access\Mfa\BackupCodeService;
|
2021-08-02 17:35:37 +02:00
|
|
|
use BookStack\Auth\Access\Mfa\MfaSession;
|
2021-07-02 21:53:33 +02:00
|
|
|
use BookStack\Auth\Access\Mfa\MfaValue;
|
2021-08-02 17:35:37 +02:00
|
|
|
use BookStack\Exceptions\NotFoundException;
|
2021-07-02 21:53:33 +02:00
|
|
|
use BookStack\Http\Controllers\Controller;
|
|
|
|
use Exception;
|
2021-08-02 17:35:37 +02:00
|
|
|
use Illuminate\Http\Request;
|
|
|
|
use Illuminate\Validation\ValidationException;
|
2021-07-02 21:53:33 +02:00
|
|
|
|
|
|
|
class MfaBackupCodesController extends Controller
|
|
|
|
{
|
2021-07-18 17:52:31 +02:00
|
|
|
use HandlesPartialLogins;
|
|
|
|
|
2021-07-02 21:53:33 +02:00
|
|
|
protected const SETUP_SECRET_SESSION_KEY = 'mfa-setup-backup-codes';
|
|
|
|
|
|
|
|
/**
|
2021-08-21 16:49:40 +02:00
|
|
|
* Show a view that generates and displays backup codes.
|
2021-07-02 21:53:33 +02:00
|
|
|
*/
|
|
|
|
public function generate(BackupCodeService $codeService)
|
|
|
|
{
|
|
|
|
$codes = $codeService->generateNewSet();
|
|
|
|
session()->put(self::SETUP_SECRET_SESSION_KEY, encrypt($codes));
|
|
|
|
|
|
|
|
$downloadUrl = 'data:application/octet-stream;base64,' . base64_encode(implode("\n\n", $codes));
|
|
|
|
|
2022-01-04 14:33:24 +01:00
|
|
|
$this->setPageTitle(trans('auth.mfa_gen_backup_codes_title'));
|
|
|
|
|
2021-07-02 21:53:33 +02:00
|
|
|
return view('mfa.backup-codes-generate', [
|
2021-08-21 16:49:40 +02:00
|
|
|
'codes' => $codes,
|
2021-07-02 21:53:33 +02:00
|
|
|
'downloadUrl' => $downloadUrl,
|
|
|
|
]);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Confirm the setup of backup codes, storing them against the user.
|
2021-08-21 16:49:40 +02:00
|
|
|
*
|
2021-07-02 21:53:33 +02:00
|
|
|
* @throws Exception
|
|
|
|
*/
|
|
|
|
public function confirm()
|
|
|
|
{
|
|
|
|
if (!session()->has(self::SETUP_SECRET_SESSION_KEY)) {
|
|
|
|
return response('No generated codes found in the session', 500);
|
|
|
|
}
|
|
|
|
|
|
|
|
$codes = decrypt(session()->pull(self::SETUP_SECRET_SESSION_KEY));
|
2021-07-18 17:52:31 +02:00
|
|
|
MfaValue::upsertWithValue($this->currentOrLastAttemptedUser(), MfaValue::METHOD_BACKUP_CODES, json_encode($codes));
|
2021-07-02 21:53:33 +02:00
|
|
|
|
|
|
|
$this->logActivity(ActivityType::MFA_SETUP_METHOD, 'backup-codes');
|
2021-08-21 16:14:24 +02:00
|
|
|
|
|
|
|
if (!auth()->check()) {
|
|
|
|
$this->showSuccessNotification(trans('auth.mfa_setup_login_notification'));
|
2021-08-31 23:03:51 +02:00
|
|
|
|
2021-08-21 16:14:24 +02:00
|
|
|
return redirect('/login');
|
|
|
|
}
|
|
|
|
|
2021-07-02 21:53:33 +02:00
|
|
|
return redirect('/mfa/setup');
|
|
|
|
}
|
2021-08-02 17:35:37 +02:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Verify the MFA method submission on check.
|
2021-08-21 16:49:40 +02:00
|
|
|
*
|
2021-08-02 17:35:37 +02:00
|
|
|
* @throws NotFoundException
|
|
|
|
* @throws ValidationException
|
|
|
|
*/
|
|
|
|
public function verify(Request $request, BackupCodeService $codeService, MfaSession $mfaSession, LoginService $loginService)
|
|
|
|
{
|
|
|
|
$user = $this->currentOrLastAttemptedUser();
|
|
|
|
$codes = MfaValue::getValueForUser($user, MfaValue::METHOD_BACKUP_CODES) ?? '[]';
|
|
|
|
|
|
|
|
$this->validate($request, [
|
|
|
|
'code' => [
|
2021-11-05 01:26:55 +01:00
|
|
|
'required', 'max:12', 'min:8',
|
2021-08-02 17:35:37 +02:00
|
|
|
function ($attribute, $value, $fail) use ($codeService, $codes) {
|
|
|
|
if (!$codeService->inputCodeExistsInSet($value, $codes)) {
|
|
|
|
$fail(trans('validation.backup_codes'));
|
|
|
|
}
|
2021-08-21 16:49:40 +02:00
|
|
|
},
|
|
|
|
],
|
2021-08-02 17:35:37 +02:00
|
|
|
]);
|
|
|
|
|
|
|
|
$updatedCodes = $codeService->removeInputCodeFromSet($request->get('code'), $codes);
|
|
|
|
MfaValue::upsertWithValue($user, MfaValue::METHOD_BACKUP_CODES, $updatedCodes);
|
|
|
|
|
|
|
|
$mfaSession->markVerifiedForUser($user);
|
2021-08-02 23:02:25 +02:00
|
|
|
$loginService->reattemptLoginFor($user);
|
2021-08-02 17:35:37 +02:00
|
|
|
|
|
|
|
if ($codeService->countCodesInSet($updatedCodes) < 5) {
|
2021-08-08 15:24:44 +02:00
|
|
|
$this->showWarningNotification(trans('auth.mfa_backup_codes_usage_limit_warning'));
|
2021-08-02 17:35:37 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return redirect()->intended();
|
|
|
|
}
|
2021-07-02 21:53:33 +02:00
|
|
|
}
|