diff --git a/cp/app/Auth/Auth.php b/cp/app/Auth/Auth.php index 73060f5..611e051 100644 --- a/cp/app/Auth/Auth.php +++ b/cp/app/Auth/Auth.php @@ -142,25 +142,31 @@ class Auth $auth->login($email, $password, $rememberDuration); + // check if a valid code is provided global $container; $db = $container->get('db'); - $tfa = $db->selectRow('SELECT tfa_enabled, tfa_secret FROM users WHERE id = ?', [$auth->getUserId()]); + $tfa_secret = $db->selectValue('SELECT tfa_secret FROM users WHERE id = ?', [$auth->getUserId()]); - if ($tfa) { - if ($tfa['tfa_enabled'] == 1) { - $tfaService = new \RobThree\Auth\TwoFactorAuth('Namingo'); - if ($tfaService->verifyCode($tfa['tfa_secret'], $code) === true) { - return true; - } else { - self::$auth->logOut(); - redirect()->route('login')->with('error','Incorrect 2FA Code. Please check and enter the correct code. 2FA codes are time-sensitive. For continuous issues, contact support.'); - } - } elseif ($tfa['tfa_enabled'] == 0) { - return true; + if (!is_null($tfa_secret)) { + if (!is_null($code) && $code !== "" && preg_match('/^\d{6}$/', $code)) { + // If tfa_secret exists and is not empty, verify the 2FA code + $tfaService = new \RobThree\Auth\TwoFactorAuth('Namingo'); + if ($tfaService->verifyCode($tfa_secret, $code) === true) { + // 2FA verification successful + return true; + } else { + // 2FA verification failed + self::$auth->logOut(); + redirect()->route('login')->with('error','Incorrect 2FA Code. Please check and enter the correct code. 2FA codes are time-sensitive. For continuous issues, contact support.'); + //return false; // Ensure to return false or handle accordingly + } + } else { + self::$auth->logOut(); + redirect()->route('login')->with('error','2FA Code Required. Please enter your 6-digit 2FA code to proceed with the login.'); + //return false; } } else { - self::$auth->logOut(); - redirect()->route('login')->with('error','Temporary Database Issue. Please try again shortly. If this problem persists, kindly reach out to our support team for assistance.'); + return true; } } catch (InvalidEmailException $e) { diff --git a/cp/app/Controllers/Auth/AuthController.php b/cp/app/Controllers/Auth/AuthController.php index 47c5e29..9f72ab8 100644 --- a/cp/app/Controllers/Auth/AuthController.php +++ b/cp/app/Controllers/Auth/AuthController.php @@ -33,6 +33,21 @@ class AuthController extends Controller public function createLogin(Request $request, Response $response){ return view($response,'auth/login.twig'); } + + /** + * Show 2FA verification form. + * + * @param Request $request + * @param Response $response + * @return mixed + */ + public function verify2FA(Request $request, Response $response){ + if (isset($_SESSION['is2FAEnabled']) && $_SESSION['is2FAEnabled'] === true) { + return view($response, 'auth/verify2fa.twig'); + } else { + return $response->withHeader('Location', '/login')->withStatus(302); + } + } /** * @param Request $request @@ -42,20 +57,34 @@ class AuthController extends Controller */ public function login(Request $request, Response $response){ global $container; - $data = $request->getParsedBody(); - if(isset($data['remember'])){ - $remember = $data['remember']; - }else{ - $remember = null; + $db = $container->get('db'); + $is2FAEnabled = $db->selectValue('SELECT tfa_enabled, tfa_secret FROM users WHERE email = ?', [$data['email']]); + + // If 2FA is enabled and no code is provided, redirect to 2FA code entry + if($is2FAEnabled && !isset($data['code'])) { + $_SESSION['2fa_email'] = $data['email']; + $_SESSION['2fa_password'] = $data['password']; + $_SESSION['is2FAEnabled'] = true; + return $response->withHeader('Location', '/login/verify')->withStatus(302); + } else { + $email = $data['email']; + $password = $data['password']; + $_SESSION['is2FAEnabled'] = false; } - if(isset($data['code'])){ - $code = $data['code']; - }else{ - $code = null; + + // If the 2FA code is present, this might be a 2FA verification attempt + if (isset($data['code']) && isset($_SESSION['2fa_email']) && isset($_SESSION['2fa_password'])) { + $email = $_SESSION['2fa_email']; + $password = $_SESSION['2fa_password']; + // Clear the session variables immediately after use + unset($_SESSION['2fa_email'], $_SESSION['2fa_password'], $_SESSION['is2FAEnabled']); } - $login = Auth::login($data['email'], $data['password'], $remember, $code); - if($login===true) { + + $login = Auth::login($email, $password, $data['remember'] ?? null, $data['code'] ?? null); + unset($_SESSION['2fa_email'], $_SESSION['2fa_password'], $_SESSION['is2FAEnabled']); + + if ($login===true) { $db = $container->get('db'); $currentDateTime = new \DateTime(); $currentDate = $currentDateTime->format('Y-m-d H:i:s.v'); // Current timestamp diff --git a/cp/resources/views/auth/login.twig b/cp/resources/views/auth/login.twig index ea458e6..987e0ff 100644 --- a/cp/resources/views/auth/login.twig +++ b/cp/resources/views/auth/login.twig @@ -33,10 +33,6 @@ -
- - -