forge-joniko/ldc-web
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update OTP Code

Browse source
This commit is contained in:
Vincent BRIDIER 2022-09-19 13:21:10 +02:00
parent 746e502b49
commit 96683a0f5a
No known key found for this signature in database
GPG key ID: 8571BFA20420D512
3 changed files with 12 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
.env.example
View file

@ -44,4 +44,7 @@ MAILJET_SMSENDPOINT=
MAILJET_SMSFROM=
WEBHOOKS_GITLAB_NOTIFY=
WEBHOOKS_GITLAB_TOKEN=
WEBHOOKS_GITLAB_TOKEN=
MEMCACHED_HOST=
MEMCACHED_PORT=

7
app/Http/Controllers/OTPController.php
View file

@ -35,12 +35,7 @@ class OTPController extends Controller
public function check(ValidateOtpRequest $request)
{
//phpcs:enable
$user = session()->get('tmpUserOTP');
if (!$user) {
return \response()->redirectTo(RouteServiceProvider::HOME);
}
Auth::login($user);
Auth::login(session()->get('tmpUserOTP'));
return \response()->redirectTo(RouteServiceProvider::HOME);
}

11
app/Http/Requests/ValidateOtpRequest.php
View file

@ -4,7 +4,6 @@ namespace App\Http\Requests;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Support\Carbon;
use Illuminate\Support\Facades\Auth;
use lfkeitel\phptotp\Base32;
use lfkeitel\phptotp\Totp;
@ -17,7 +16,10 @@ class ValidateOtpRequest extends FormRequest
*/
public function authorize()
{
return Auth::check();
if (!session()->get('tmpUserOTP')) {
return false;
}
return true;
}
/**
@ -32,11 +34,12 @@ class ValidateOtpRequest extends FormRequest
'string',
'required',
function ($attribute, $value, $fail) {
$user = session()->get('tmpUserOTP');
$lastCode = (new Totp())->GenerateToken(
Base32::decode(Auth::user()->totp_secret),
Base32::decode($user->totp_secret),
Carbon::now()->subSeconds(30)->timestamp
);
$code = (new Totp())->GenerateToken(Base32::decode(Auth::user()->totp_secret));
$code = (new Totp())->GenerateToken(Base32::decode($user->totp_secret));
if (!($value === $code || $value === $lastCode)) {
$fail("Code de vérification $attribute invalide.");