mirror of
https://github.com/invoiceninja/invoiceninja.git
synced 2024-11-14 07:02:34 +01:00
19080933b6
Shift automatically applies the Laravel coding style - which uses the PSR-2 coding style as a base with some minor additions. You may customize the code style applied by adding a [PHP CS Fixer][1] or [PHP CodeSniffer][2] ruleset to your project root. Feel free to use [Shift's Laravel ruleset][3] to help you get started. For more information on customizing the code style applied by Shift, [watch this short video][4]. [1]: https://github.com/FriendsOfPHP/PHP-CS-Fixer [2]: https://github.com/squizlabs/PHP_CodeSniffer [3]: https://gist.github.com/laravel-shift/cab527923ed2a109dda047b97d53c200 [4]: https://laravelshift.com/videos/shift-code-style
99 lines
3.6 KiB
PHP
99 lines
3.6 KiB
PHP
<?php
|
|
/**
|
|
* Invoice Ninja (https://invoiceninja.com).
|
|
*
|
|
* @link https://github.com/invoiceninja/invoiceninja source repository
|
|
*
|
|
* @copyright Copyright (c) 2022. Invoice Ninja LLC (https://invoiceninja.com)
|
|
*
|
|
* @license https://www.elastic.co/licensing/elastic-license
|
|
*/
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Libraries\MultiDB;
|
|
use App\Libraries\OAuth\Providers\Google;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Cache;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Illuminate\Support\Str;
|
|
use stdClass;
|
|
|
|
class PasswordProtection
|
|
{
|
|
/**
|
|
* Handle an incoming request.
|
|
*
|
|
* @param Request $request
|
|
* @param Closure $next
|
|
* @return mixed
|
|
*/
|
|
public function handle($request, Closure $next)
|
|
{
|
|
$error = [
|
|
'message' => 'Invalid Password',
|
|
'errors' => new stdClass,
|
|
];
|
|
|
|
$timeout = auth()->user()->company()->default_password_timeout;
|
|
|
|
if ($timeout == 0) {
|
|
$timeout = 30 * 60 * 1000 * 1000;
|
|
} else {
|
|
$timeout = $timeout / 1000;
|
|
}
|
|
|
|
//test if password if base64 encoded
|
|
$x_api_password = $request->header('X-API-PASSWORD');
|
|
|
|
if ($request->header('X-API-PASSWORD-BASE64')) {
|
|
$x_api_password = base64_decode($request->header('X-API-PASSWORD-BASE64'));
|
|
}
|
|
|
|
// If no password supplied - then we just check if their authentication is in cache //
|
|
if (Cache::get(auth()->user()->hashed_id.'_'.auth()->user()->account_id.'_logged_in') && ! $x_api_password) {
|
|
Cache::put(auth()->user()->hashed_id.'_'.auth()->user()->account_id.'_logged_in', Str::random(64), $timeout);
|
|
|
|
return $next($request);
|
|
} elseif ($request->header('X-API-OAUTH-PASSWORD') && strlen($request->header('X-API-OAUTH-PASSWORD')) >= 1) {
|
|
|
|
//user is attempting to reauth with OAuth - check the token value
|
|
//todo expand this to include all OAuth providers
|
|
$user = false;
|
|
$google = new Google();
|
|
$user = $google->getTokenResponse(request()->header('X-API-OAUTH-PASSWORD'));
|
|
|
|
if (is_array($user)) {
|
|
$query = [
|
|
'oauth_user_id' => $google->harvestSubField($user),
|
|
'oauth_provider_id'=> 'google',
|
|
];
|
|
|
|
//If OAuth and user also has a password set - check both
|
|
if ($existing_user = MultiDB::hasUser($query) && auth()->user()->company()->oauth_password_required && auth()->user()->has_password && Hash::check(auth()->user()->password, $x_api_password)) {
|
|
nlog('existing user with password');
|
|
|
|
Cache::put(auth()->user()->hashed_id.'_'.auth()->user()->account_id.'_logged_in', Str::random(64), $timeout);
|
|
|
|
return $next($request);
|
|
} elseif ($existing_user = MultiDB::hasUser($query) && ! auth()->user()->company()->oauth_password_required) {
|
|
nlog('existing user without password');
|
|
|
|
Cache::put(auth()->user()->hashed_id.'_'.auth()->user()->account_id.'_logged_in', Str::random(64), $timeout);
|
|
|
|
return $next($request);
|
|
}
|
|
}
|
|
|
|
return response()->json($error, 412);
|
|
} elseif ($x_api_password && Hash::check($x_api_password, auth()->user()->password)) {
|
|
Cache::put(auth()->user()->hashed_id.'_'.auth()->user()->account_id.'_logged_in', Str::random(64), $timeout);
|
|
|
|
return $next($request);
|
|
} else {
|
|
return response()->json($error, 412);
|
|
}
|
|
}
|
|
}
|