Skip to content

Commit 5e8f5c9

Browse files
jaapmarcusjaapmarcus
committed
Allow Skip 2FA fuction for xx Days
With the new propsed system you are forced to login again every 1 hour after no use... With this function you are allowed to skip the 2FA Step for a xx period (Default 1 day)
1 parent 1a5e1d5 commit 5e8f5c9

File tree

9 files changed

+55
-23
lines changed

9 files changed

+55
-23
lines changed

‎install/hst-install-debian.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1665,6 +1665,7 @@ fi
16651665
#----------------------------------------------------------#
16661666

16671667
echo "INACTIVE_SESSION_TIMEOUT='60'" >> $HESTIA/conf/hestia.conf
1668+
echo "TWOFA_VALID_LENGTH='1'" >> $HESTIA/conf/hestia.conf
16681669

16691670
#----------------------------------------------------------#
16701671
# Configure Admin User #

‎install/hst-install-ubuntu.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1688,6 +1688,7 @@ fi
16881688
#----------------------------------------------------------#
16891689

16901690
echo "INACTIVE_SESSION_TIMEOUT='60'" >> $HESTIA/conf/hestia.conf
1691+
echo "TWOFA_VALID_LENGTH='1'" >> $HESTIA/conf/hestia.conf
16911692

16921693
#----------------------------------------------------------#
16931694
# Fix phpmyadmin #

‎install/upgrade/versions/latest.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,4 +58,5 @@ if [ -f "$apt/postgresql.list" ]; then
5858
fi
5959

6060
# Limit PHP Session Live time
61-
echo "INACTIVE_SESSION_TIMEOUT='60'" >> $HESTIA/conf/hestia.conf
61+
echo "INACTIVE_SESSION_TIMEOUT='60'" >> $HESTIA/conf/hestia.conf
62+
echo "TWOFA_VALID_LENGTH='1'" >> $HESTIA/conf/hestia.conf

‎web/js/fingerprint2.min.js‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎web/login/index.php‎

Lines changed: 23 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88

99
// Logout
1010
if (isset($_GET['logout'])) {
11+
setcookie('limit2fa','',time() - 3600,"/");
1112
session_destroy();
1213
}
1314

@@ -86,33 +87,38 @@ function authenticate_user(){
8687
$error = "<a class=\"error\">".__('Invalid username or password')."</a>";
8788
return $error;
8889
} else {
89-
9090
// Make root admin user
9191
if ($_POST['user'] == 'root') $v_user = 'admin';
92-
9392
// Get user speciefic parameters
9493
exec (HESTIA_CMD . "v-list-user ".$v_user." json", $output, $return_var);
9594
$data = json_decode(implode('', $output), true);
96-
97-
// Check if 2FA is active
98-
if ($data[$_POST['user']]['TWOFA'] != '') {
99-
if (empty($_POST['twofa'])){
100-
return false;
101-
}else{
102-
$v_twofa = $_POST['twofa'];
103-
exec(HESTIA_CMD ."v-check-user-2fa ".$v_user." ".$v_twofa, $output, $return_var);
104-
unset($output);
105-
if ( $return_var > 0 ) {
106-
sleep(2);
107-
$error = "<a class=\"error\">".__('Invalid or missing 2FA token')."</a>";
108-
return $error;
109-
unset($_POST['twofa']);
95+
if ($data[$user]['TWOFA'] != '') {
96+
if(password_hash($data[$user]['TWOFA'].$_POST['murmur'],PASSWORD_BCRYPT) == $_COOKIE['limit2fa']){
97+
98+
}else{
99+
setcookie('limit2fa','',time() - 3600,"/");
100+
if(empty($_POST['twofa'])){
101+
return false;
102+
}else{
103+
$v_twofa = $_POST['twofa'];
104+
exec(HESTIA_CMD ."v-check-user-2fa ".$v_user." ".$v_twofa, $output, $return_var);
105+
unset($output);
106+
if ( $return_var > 0 ) {
107+
sleep(2);
108+
$error = "<a class=\"error\">".__('Invalid or missing 2FA token')."</a>";
109+
return $error;
110+
unset($_POST['twofa']);
111+
}
110112
}
111-
}
113+
114+
}
112115
}
113116
// Define session user
114117
$_SESSION['user'] = key($data);
115118
$v_user = $_SESSION['user'];
119+
if(empty($_COOKIE['limit2fa'])){
120+
setcookie('limit2fa',password_hash($data[$user]['TWOFA'].$_POST['murmur'],PASSWORD_BCRYPT),time()+60*60*24*$_SESSION['TWOFA_VALID_LENGTH'],"/");
121+
};
116122
$_SESSION['LAST_ACTIVITY'] = time();
117123
// Define language
118124
$output = '';
@@ -123,7 +129,6 @@ function authenticate_user(){
123129
} else {
124130
$_SESSION['language'] = 'en';
125131
}
126-
127132
// Regenerate session id to prevent session fixation
128133
session_regenerate_id();
129134

‎web/templates/header.html‎

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,13 @@
44
<meta charset="utf-8">
55
<link rel="icon" href="/images/favicon.ico" type="image/x-icon">
66
<title><?php echo $_SERVER['HTTP_HOST']; ?> - <?=__($TAB)?> - <?=__('Hestia Control Panel');?></title>
7-
<link type="text/css" rel="stylesheet" href="/css/styles.min.css?1446554106" />
7+
<link type="text/css" rel="stylesheet" href="/css/styles.min.css?<?=JS_LATEST_UPDATE?>" />
88
<link type="text/css" rel="stylesheet" href="/css/active-theme.css?<?php echo rand(); ?>" />
9-
<link type="text/css" href="/css/animate.min.css?1446554103" rel="stylesheet" />
10-
<link type="text/css" href="/css/jquery-custom-dialogs.css?1446554103" rel="stylesheet" />
11-
<link type="text/css" href="/css/all.min.css?1446554103" rel="stylesheet" />
9+
<link type="text/css" href="/css/animate.min.css?<?=JS_LATEST_UPDATE?>" rel="stylesheet" />
10+
<link type="text/css" href="/css/jquery-custom-dialogs.css?<?=JS_LATEST_UPDATE?>" rel="stylesheet" />
11+
<link type="text/css" href="/css/all.min.css?<?=JS_LATEST_UPDATE?>" rel="stylesheet" />
1212
<script src="/inc/jquery/jquery-3.4.1.min.js"></script>
13+
<script type="text/javascript" src="/js/fingerprint2.min.js?<?=JS_LATEST_UPDATE?>"></script>
1314
<script>
1415
//
1516
// GLOBAL SETTINGS
@@ -19,6 +20,24 @@
1920
GLOBAL.DB_USER_PREFIX = 'admin_';
2021
GLOBAL.DB_DBNAME_PREFIX = 'admin_';
2122
GLOBAL.AJAX_URL = '';
23+
24+
if (window.requestIdleCallback) {
25+
requestIdleCallback(function () {
26+
Fingerprint2.get(function (components) {
27+
var values = components.map(function (component) { return component.value })
28+
var murmur = Fingerprint2.x64hash128(values.join(''), 31);
29+
$('#murmur').val(murmur);
30+
})
31+
})
32+
} else {
33+
setTimeout(function () {
34+
Fingerprint2.get(function (components) {
35+
var values = components.map(function (component) { return component.value })
36+
var murmur = Fingerprint2.x64hash128(values.join(''), 31);
37+
$('#murmur').val(murmur);
38+
})
39+
}, 500);
40+
}
2241
</script>
2342
</head>
2443
<body class="body-<?=strtolower($TAB)?> lang-<?=$_SESSION['language']?>">

‎web/templates/login.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
<td style="padding: 40px 60px 0 0;">
1111
<form method="post" action="/login/" id="form_login">
1212
<input type="hidden" name="token" value="<?php echo $_SESSION['token']; ?>">
13+
<input type="hidden" name="murmur" value="" id="murmur">
1314
<table class="login-box">
1415
<tr>
1516
<td style="padding: 12px 0 0 2px;" class="login-welcome">

‎web/templates/login_1.html‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111
<form method="post" action="/login/" id="form_login">
1212
<input type="hidden" name="token" value="<?php echo $_SESSION['token']; ?>">
1313
<input type="hidden" name="user" value="<?php echo $_POST['user']; ?>">
14+
<input type="hidden" name="murmur" value="<?php echo $_POST['murmur']; ?>" id="murmur">
15+
1416

1517
<table class="login-box">
1618
<tr>

‎web/templates/login_2.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
<input type="hidden" name="token" value="<?php echo $_SESSION['token']; ?>">
1313
<input type="hidden" name="user" value="<?php echo $_POST['user']; ?>">
1414
<input type="hidden" name="password" value="<?php echo $_POST['password']; ?>">
15+
<input type="hidden" name="murmur" value="" id="murmur">
1516
<table class="login-box">
1617
<tr>
1718
<td style="padding: 12px 0 0 2px;" class="login-welcome">

0 commit comments

Comments
 (0)