Skip to content

Commit 97d3b6e

Browse files
jaapmarcusjaapmarcus
committed
Fix issue with passwords with quotes
Close https://forum.hestiacp.com/t/two-factor-authentication-issue-with-standard-user/1652/
1 parent db4c08c commit 97d3b6e

File tree

2 files changed

+25
-26
lines changed

2 files changed

+25
-26
lines changed

‎web/login/index.php‎

Lines changed: 25 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,9 @@
3333
exit;
3434
}
3535

36-
function authenticate_user(){
36+
function authenticate_user($user, $password, $twofa = ''){
3737
if(isset($_SESSION['token']) && isset($_POST['token']) && $_POST['token'] == $_SESSION['token']) {
38-
$v_user = escapeshellarg($_POST['user']);
38+
$v_user = escapeshellarg($user);
3939
$v_ip = escapeshellarg($_SERVER['REMOTE_ADDR']);
4040
if(isset($_SERVER['HTTP_CF_CONNECTING_IP'])){
4141
if(!empty($_SERVER['HTTP_CF_CONNECTING_IP'])){
@@ -49,13 +49,9 @@ function authenticate_user(){
4949
$pam = json_decode(implode('', $output), true);
5050
if ( $return_var > 0 ) {
5151
sleep(2);
52-
unset($_POST['password']);
53-
unset($_POST['user']);
5452
$error = "<a class=\"error\">"._('Invalid username or password')."</a>";
5553
return $error;
5654
} else {
57-
$user = $_POST['user'];
58-
$password = $_POST['password'];
5955
$salt = $pam[$user]['SALT'];
6056
$method = $pam[$user]['METHOD'];
6157

@@ -86,7 +82,6 @@ function authenticate_user(){
8682
// Check API answer
8783
if ( $return_var > 0 ) {
8884
sleep(2);
89-
unset($_POST['password']);
9085
$error = "<a class=\"error\">"._('Invalid username or password')."</a>";
9186
return $error;
9287
} else {
@@ -95,23 +90,26 @@ function authenticate_user(){
9590
$data = json_decode(implode('', $output), true);
9691
unset($output);
9792
// Check if 2FA is active
98-
if ($data[$_POST['user']]['TWOFA'] != '') {
99-
if (empty($_POST['twofa'])){
100-
return false;
93+
if ($data[$user]['TWOFA'] != '') {
94+
if (empty($twofa)){
95+
$_SESSION['login']['username'] = $user;
96+
$_SESSION['login']['password'] = $password;
97+
return false;
10198
} else {
102-
$v_twofa = $_POST['twofa'];
99+
$v_twofa = escapeshellarg($twofa);
103100
exec(HESTIA_CMD ."v-check-user-2fa ".$v_user." ".$v_twofa, $output, $return_var);
104101
unset($output);
105102
if ( $return_var > 0 ) {
106-
sleep(2);
103+
//sleep(2);
107104
$error = "<a class=\"error\">"._('Invalid or missing 2FA token')."</a>";
105+
$_SESSION['login']['username'] = $user;
106+
$_SESSION['login']['password'] = $password;
108107
return $error;
109-
unset($_POST['twofa']);
110108
}
111109
}
112110
}
113111

114-
if ($data[$_POST['user']]['ROLE'] == 'admin'){
112+
if ($data[$user]['ROLE'] == 'admin'){
115113
exec (HESTIA_CMD . "v-list-user admin json", $output, $return_var);
116114
$data = json_decode(implode('', $output), true);
117115
unset($output);
@@ -125,7 +123,7 @@ function authenticate_user(){
125123
exec (HESTIA_CMD."v-list-sys-languages json", $output, $return_var);
126124
$languages = json_decode(implode('', $output), true);
127125
if (in_array($data[$v_user]['LANGUAGE'], $languages)){
128-
$_SESSION['language'] = $data[$v_user]['LANGUAGE'];
126+
$_SESSION['language'] = $data[$user]['LANGUAGE'];
129127
} else {
130128
$_SESSION['language'] = 'en';
131129
}
@@ -139,7 +137,7 @@ function authenticate_user(){
139137
unset($_SESSION['request_uri']);
140138
exit;
141139
} else {
142-
if ($v_user == 'admin') {
140+
if ($user == 'admin') {
143141
header("Location: /list/user/");
144142
} else {
145143
header("Location: /list/web/");
@@ -157,11 +155,14 @@ function authenticate_user(){
157155
return false;
158156
}
159157
}
160-
161-
if (!empty($_POST['user']) && !empty($_POST['password']) && !empty($_POST['twofa'])){
162-
$error = authenticate_user();
158+
if (!empty($_SESSION['login']['username']) && !empty($_SESSION['login']['password']) && !empty($_POST['twofa'])){
159+
$error = authenticate_user($_SESSION['login']['username'], $_SESSION['login']['password'], $_POST['twofa']);
160+
unset($_POST);
163161
} else if (!empty($_POST['user']) && !empty($_POST['password'])) {
164-
$error = authenticate_user();
162+
$error = authenticate_user($_POST['user'], $_POST['password']);
163+
unset($_POST);
164+
}else{
165+
unset($_SESSION['login']);
165166
}
166167
// Check system configuration
167168
load_hestia_config();
@@ -188,13 +189,13 @@ function authenticate_user(){
188189
$_SESSION['token'] = md5(uniqid(mt_rand(), true));
189190

190191
require_once('../templates/header.html');
191-
if (empty($_POST['user'])) {
192+
if(!empty($_SESSION['login'])){
193+
require_once('../templates/login_2.html');
194+
}else if (empty($_POST['user'])) {
192195
require_once('../templates/login.html');
193196
}else if (empty($_POST['password'])) {
194197
require_once('../templates/login_1.html');
195-
}else if (empty($_POST['twofa'])) {
196-
require_once('../templates/login_2.html');
197-
} else {
198+
}else{
198199
require_once('../templates/login.html');
199200
}
200201
?>

‎web/templates/login_2.html‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@
1010
<td style="padding: 40px 60px 0 0;" class="animated fadeIn">
1111
<form method="post" action="/login/" id="form_login">
1212
<input type="hidden" name="token" value="<?php echo $_SESSION['token']; ?>">
13-
<input type="hidden" name="user" value="<?php echo $_POST['user']; ?>">
14-
<input type="hidden" name="password" value="<?php echo $_POST['password']; ?>">
1513
<table class="login-box">
1614
<tr>
1715
<td style="padding: 12px 0 0 2px;" class="login-welcome">

0 commit comments

Comments
 (0)