WordPress.org
Get WordPress

Plugin Directory

Changeset 1325628


Ignore:
Timestamp:
01/11/2016 07:29:35 AM (10 years ago)
Author:
2fa
Message:

Plugin update

Location:
cryptophoto-two-and-multi-factor-authentication/trunk
Files:
1 added
9 edited

Legend:

Unmodified
Added
Removed

  • cryptophoto-two-and-multi-factor-authentication/trunk/Readme.txt

    r791114 r1325628  
    44Tags: crypto, photo, 2-factor, multi-factor, authentication, token, password, security, login, phishing, keylogger, secure
    55Requires at least: 3.5
    6 Tested up to: 3.6.1
     6Tested up to: 4.3
    77Stable tag: 1.0
    88License: GPLv2 or later
    … …  
    4343MANUAL INSTALLATION
    4444
    45 1. Download and extract the "cryptophoto-1.20131017.wordpress.zip" archive
     451. Download and extract the "cryptophoto-1.20150909.wordpress.zip" archive
    46462. Upload* the extracted "cryptophoto.zip" file using the regular "Add New" and "Upload" options of your "Plugins" menu
    4747
    … …  
    9090== Changelog ==
    9191
     92= 1.20150909 =
     93* UI Changes
     94* CryptoPhoto lib update
     95
    9296= 1.20131021 =
    9397* Prevented possible conflicts with other plugins or themes
    … …  
    103107== Upgrade Notice ==
    104108
     109= 1.20150909 =
     110UI Changes. CryptoPhoto lib update
     111
    105112= 1.20131021 =
    106113Randomized the Cryptophoto menu position

  • cryptophoto-two-and-multi-factor-authentication/trunk/cryptophoto.php

    r791114 r1325628  
    55Plugin URI: https://github.com/cryptophoto/cryptophoto_wordpress
    66Description: This plugin enables CryptoPhoto authentication for WordPress logins.
    7 Version: 1.20131021
     7Version: 1.20150909
    88Author: CryptoPhoto
    99Author URI: http://cryptophoto.com
    … …  
    3535    $exptime = time() + 1800; // let the duo login form expire within 1 hour
    3636    if(isset($err) && $err) {
    37       $err = '<div id="login_error">'.$err.'</div>';
     37      $err = '<div id="login_error" style="width:320px;">'.$err.'</div>';
    3838    } else {
    3939      $err = "";
    4040    }       
    41 ?>
    42   <html>
    43       <head>
    44           <?php
    45               global $wp_version;
    46               // select the CSS based on the current WP version
    47               if(version_compare($wp_version, "3.3", "<=")){
    48           ?>
    49                   <link rel="stylesheet" type="text/css" href="<?php echo admin_url('css/login.css'); ?>" />
    50           <?php
    51               }
    52               else{
    53           ?>
    54                   <link rel="stylesheet" type="text/css" href="<?php echo admin_url('css/wp-admin.css'); ?>" />
    55                   <link rel="stylesheet" type="text/css" href="<?php echo admin_url('css/colors-fresh.css'); ?>" />
    56           <?php
    57               }
    58           ?>
    59 
    60           <style>
    61               body {
    62                   background:#F9F9F9;
    63               }
    64               div {
    65                   background: transparent;
    66               }
    67           </style>
    68       </head>
    69            
    70 <body class="login">
    71 <div id="login">
    72 <h1><a href="http://wordpress.org/" title="Powered by WordPress"><?php echo get_bloginfo('name'); ?></a></h1>
     41?><!DOCTYPE html>
     42  <!--[if IE 8]>
     43    <html xmlns="http://www.w3.org/1999/xhtml" class="ie8" <?php language_attributes(); ?>>
     44  <![endif]-->
     45  <!--[if !(IE 8) ]><!-->
     46    <html xmlns="http://www.w3.org/1999/xhtml" <?php language_attributes(); ?>>
     47  <!--<![endif]-->
     48  <head>
     49  <meta http-equiv="Content-Type" content="<?php bloginfo('html_type'); ?>; charset=<?php bloginfo('charset'); ?>" />
     50  <title><?php bloginfo('name'); ?> &rsaquo; <?php echo $title; ?></title>
     51  <?php
     52
     53  wp_admin_css( 'login', true );
     54
     55  do_action( 'login_enqueue_scripts' );
     56  do_action( 'login_head' );
     57
     58  if ( is_multisite() ) {
     59    $login_header_url   = network_home_url();
     60    $login_header_title = get_current_site()->site_name;
     61  } else {
     62    $login_header_url   = __( 'https://wordpress.org/' );
     63    $login_header_title = __( 'Powered by WordPress' );
     64  }
     65
     66  $login_header_url = apply_filters( 'login_headerurl', $login_header_url );
     67  $login_header_title = apply_filters( 'login_headertitle', $login_header_title );
     68
     69  $classes = array( 'login-action-' . $action, 'wp-core-ui' );
     70  if ( wp_is_mobile() )
     71    $classes[] = 'mobile';
     72  if ( is_rtl() )
     73    $classes[] = 'rtl';
     74  if ( $interim_login ) {
     75    $classes[] = 'interim-login';
     76    ?>
     77    <style type="text/css">html{background-color: transparent;}</style>
     78    <?php
     79
     80    if ( 'success' ===  $interim_login )
     81      $classes[] = 'interim-login-success';
     82  }
     83  $classes[] =' locale-' . sanitize_html_class( strtolower( str_replace( '_', '-', get_locale() ) ) );
     84  $classes = apply_filters( 'login_body_class', $classes, $action );
     85  ?>
     86  </head>
     87
     88<body class="login <?php echo esc_attr( implode( ' ', $classes ) ); ?>">
     89  <div id="login">
     90    <h1><a href="<?php echo esc_url( $login_header_url ); ?>" title="<?php echo esc_attr( $login_header_title ); ?>" tabindex="-1"><?php bloginfo( 'name' ); ?></a></h1>
     91             
    7392<?php echo $err;
    7493
    … …  
    7796<form method="post" style='width:300px'>
    7897  <?php echo $widget; ?>
    79   <p class="submit">
    80     <input type="submit" name="cp_auth" id="cp_auth" class="button-primary" value="Authenticate" tabindex="100" />
     98  <p class="submit" style="text-align:center">
     99    <input type="submit" name="cp_auth" id="cp_auth" class="button-primary" value="Authenticate" tabindex="100" style="float:none" />
    81100    <input type="hidden" name="redirect_to" value="<?php echo esc_attr($redirect); ?>" />
    82101    <input type="hidden" name="u" value="<?php echo esc_attr($username); ?>" />
    … …  
    85104  </p>
    86105</form>
    87 </div>
    88 </body>
    89 </html>
     106<?php if ( ! $interim_login ): ?>
     107  <p id="backtoblog"><a href="<?php echo esc_url( home_url( '/' ) ); ?>" title="<?php esc_attr_e( 'Are you lost?' ); ?>"><?php printf( __( '&larr; Back to %s' ), get_bloginfo( 'title', 'display' ) ); ?></a></p>
     108<?php endif; ?>
     109
     110  </div>
     111<?php do_action( 'login_footer' ); ?>
     112  <div class="clear"></div>
     113  </body>
     114  </html>
    90115<?php
    91116  }//"
    … …  
    120145    $privatekey = get_option("cryptophoto_privatekey", "");
    121146    $salt = get_option("cryptophoto_salt", "");
     147    $server = get_option("cryptophoto_server", "");
    122148
    123149    // CryptoPhoto isn't set up for this certain site
    … …  
    128154    // check for non-empty CryptoPhoto authentication fields
    129155    if (isset($_POST['cp_auth']) || isset($_POST["cp_phc"])) {
    130       error_log('isset($_POST["cp_auth"])');
    131156
    132157      // forcefully log the current user out
    … …  
    145170          $user = get_user_by('login', $username);
    146171          // new CryptoPhoto class instance
    147           $cp = new CryptoPhotoUtils($privatekey, $publickey, md5($salt . $user->ID));
     172          $cp = new CryptoPhotoUtils($server, $privatekey, $publickey, md5($salt . $user->ID));
    148173
    149174          // check for posted token
    … …  
    153178          else {
    154179            if((isset($_POST["token_response_field_col"]) || isset($_POST["token_response_field_row"])) && (isset($_POST["cp_phc"])) ) {
    155               $err = "Invalid authentication";
     180              $err = "Missing required codes. Invalid authentication";
    156181            }
    157182          }
    … …  
    182207              if($cperror == "incorrect-retry-count") {
    183208                $err = "";
    184               }
    185 
    186               if($cperror == "incorrect-verify-call") {
     209              } else {
    187210                $err = "Codes don't match";//'
    188               }
     211              }             
    189212            }
    190213          }
    … …  
    224247      // get the CryptoPhoto status of a user, by ID
    225248      $isactive = get_user_option("cryptophoto_enabled", $user->ID);
    226       error_log("isactive=$isactive",0);
    227249     
    228250      // check the user's CryptoPhoto status
    … …  
    235257      if ($cryptophoto_auth == true) {
    236258        // start new CryptoPhoto session
    237         $cp = new CryptoPhotoUtils($privatekey, $publickey, md5($salt . $user->ID));
     259        $cp = new CryptoPhotoUtils($server, $privatekey, $publickey, md5($salt . $user->ID));
    238260        $cp->start_session($_SERVER['REMOTE_ADDR']);
    239261        $cryptophoto_auth = $cp->has_token == 'true' ? true : false;
    240         error_log("has_token=".$cp->has_token, 0);
    241262      }
    242263     
    … …  
    287308    // render the CryptoPhoto settings page
    288309    else {
     310
     311      $ip = file_get_contents('http://cryptophoto.com/show_my_ip');
     312
    289313?>
    290 
    291314
    292315      <form action="options.php" method="post">
    293316        <?php settings_fields('cryptophoto_settings'); ?>
    294317        <?php do_settings_sections('cryptophoto_settings'); ?>
    295         <p class="submit">
    296           <input name="Submit" type="submit" value="<?php esc_attr_e("Save Changes"); ?>" />         
    297           <input style="margin:25px 135px;" name="Test" type="button" onclick="return testConfig()" value="<?php esc_attr_e("Test Configuration"); ?>" />
     318        <div style="margin:0 10px;" style="font-size:12px; font-weight:bold;">
     319            <div id='testconfig'> </div>
     320        </div>
     321        <p class="submit" style="margin-top:0">
     322          <input style="margin:15px 10px 0 10px;" name="Submit" type="submit" value="<?php esc_attr_e("Save Settings"); ?>" />
     323          <input style="margin:15px 10px 0 10px;" name="Wizard" type="button" onclick="return CPPluginWizard.start_wizard()" value="<?php esc_attr_e("Wizard"); ?>" />
     324          <input style="margin:15px 10px 0 10px;" name="Test" type="button" onclick="return testConfig()" value="<?php esc_attr_e("Test Configuration"); ?>" />
     325          <span id="cpspinner" class="spinner" style="float:none;margin-bottom:10px;"></span>
    298326        </p>
    299327      </form>
    300328
    301 
    302       <div style="margin:0px 235px; font-size:12px; font-weight:bold;">
    303         <div id='testconfig'> </div>
    304       </div>
    305 
     329     
     330      <p class='description' id='tagline-description'><strong>Note:</strong> Save your changes then click on "Test Configuration" in order to do a test CryptoPhoto API call.</p>
    306331
    307332<script type="text/javascript">
     333
     334if (typeof CPPluginWizard !== 'object') CPPluginWizard = {};
     335
     336CPPluginWizard.serverip = "<?php echo $ip ?>";
     337CPPluginWizard.callback = function(keys) {
     338
     339  if(keys.PRIVATE_KEY && keys.PUBLIC_KEY) {
     340    document.getElementById("cryptophoto_publickey").value = keys.PUBLIC_KEY;
     341    document.getElementById("cryptophoto_privatekey").value = keys.PRIVATE_KEY;
     342    if (!!!document.getElementById("cryptophoto_salt").value) {
     343      document.getElementById("cryptophoto_salt").value = guid();
     344    }
     345    testConfig();
     346  }
     347
     348};
    308349
    309350//Browser Support Code
    310351function testConfig() {
     352
     353  document.getElementById("cpspinner").className = "spinner is-active";
     354
    311355  var ajaxRequest;  // The variable that makes Ajax possible!
    312356
    … …  
    333377    if(ajaxRequest.readyState == 4 && ajaxRequest.status == 200) {
    334378     
     379      document.getElementById("cpspinner").className = "spinner";
     380
    335381      if(ajaxRequest.responseText.indexOf('success') > -1) {
    336         document.getElementById("testconfig").innerHTML="Cryptophoto plugin is configured properly.";
     382        document.getElementById("testconfig").innerHTML="CryptoPhoto plugin is configured properly. You can save your settings now.";
    337383        document.getElementById("testconfig").setAttribute("style","color:green");
    338384      }
    … …  
    369415    }
    370416  }
    371  
    372417  var data = "action=cryptophoto_test&test=true";
     418
     419  data += "&cryptophoto_publickey=" + encodeURIComponent(document.getElementById("cryptophoto_publickey").value);
     420  data += "&cryptophoto_privatekey=" + encodeURIComponent(document.getElementById("cryptophoto_privatekey").value);
     421  data += "&cryptophoto_salt=" + encodeURIComponent(document.getElementById("cryptophoto_salt").value);
     422  data += "&cryptophoto_server=" + encodeURIComponent(document.getElementById("cryptophoto_server").value);
     423 
    373424  ajaxRequest.open("POST", ajaxurl, true);
    374425  ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
    … …  
    378429}
    379430
     431function guid() {
     432  var chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'.split('');
     433  var uuid = new Array(36), rnd=0, r;
     434  for (var i = 0; i < 36; i++) {
     435    if (i==8 || i==13 ||  i==18 || i==23) {
     436      uuid[i] = '';
     437    } else if (i==14) {
     438      uuid[i] = '4';
     439    } else {
     440      if (rnd <= 0x02) rnd = 0x2000000 + (Math.random()*0x1000000)|0;
     441      r = rnd & 0xf;
     442      rnd = rnd >> 4;
     443      uuid[i] = chars[(i == 19) ? (r & 0x3) | 0x8 : r];
     444    }
     445  }
     446  return uuid.join('');
     447}
     448
     449function add_script (a) {
     450  var b = document.createElement("script");
     451  b.type = "text/javascript";
     452  b.src = a;
     453  document.body.appendChild(b);
     454}
     455
     456var server = document.getElementById("cryptophoto_server").value;
     457if(server.indexOf("http") > -1) {
     458  add_script(server+"/api/plugin/config.js");
     459}
     460
    380461</script>
    381462
    … …  
    394475    if(isset($_POST['test'])) {
    395476     
    396       $publickey = esc_attr(get_option('cryptophoto_publickey'));
    397       $privatekey = esc_attr(get_option('cryptophoto_privatekey'));
    398       $salt = esc_attr(get_option('cryptophoto_salt'));
     477      $publickey = $_POST['cryptophoto_publickey'];
     478      $privatekey = $_POST['cryptophoto_privatekey'];
     479      $salt = $_POST['cryptophoto_salt'];
     480      $server = $_POST['cryptophoto_server'];
    399481     
    400482      // check that all parameters are set
    401483      if($publickey != "" && isset($publickey) && $privatekey != "" && isset($privatekey) && $salt != "" && isset($salt)) {
    402484
    403 
    404485        // new CP instance
    405         $cp = new CryptoPhotoUtils($privatekey, $publickey, md5($salt . $userid));
     486        $cp = new CryptoPhotoUtils($server, $privatekey, $publickey, md5($salt . $userid));
    406487        $session = $cp->start_session($_SERVER['REMOTE_ADDR']);
    407488
    408489        // new session started successfully
    409490        if($session[0] == TRUE) {
     491          update_option('cryptophoto_publickey', $publickey);
     492          update_option('cryptophoto_privatekey', $privatekey);
     493          update_option('cryptophoto_salt', $salt);
     494          $server = $server ? $server : "https://cryptophoto.com";
     495          update_option('cryptophoto_server', $server);
    410496          $result = "success";
    411497        }
    … …  
    445531      $publickey = esc_attr(get_option('cryptophoto_publickey'));
    446532      echo "<input id='cryptophoto_publickey' name='cryptophoto_publickey' size='40' type='text' value='$publickey' />";
     533      echo "<p class='description' id='tagline-description'>You CryptoPhoto API Public Key.</p>";
    447534  }
    448535
    … …  
    452539      $privatekey = esc_attr(get_option('cryptophoto_privatekey'));
    453540      echo "<input id='cryptophoto_privatekey' name='cryptophoto_privatekey' size='40' type='text' value='$privatekey' />";
     541      echo "<p class='description' id='tagline-description'>You CryptoPhoto API Private Key.</p>";
    454542  }
    455543
    … …  
    459547      $salt = esc_attr(get_option('cryptophoto_salt'));
    460548      echo "<input id='cryptophoto_salt' name='cryptophoto_salt' size='40' type='text' value='$salt' />";
     549      echo "<p class='description' id='tagline-description'>The \"Salt\" is used to create unique user IDs. It is recomended to use a random string and once set, not to change it, otherwise the CryptoPhoto settings of each of your users will be reset.</p>";
     550  }
     551
     552  // the salt text input
     553  function cryptophoto_settings_server() {
     554      $server = esc_attr(get_option('cryptophoto_server'));
     555      $server = $server ? $server : "https://cryptophoto.com";
     556      echo "<input id='cryptophoto_server' name='cryptophoto_server' size='40' type='text' value='$server' />";
     557      echo "<p class='description' id='tagline-description'>Set a server url if you're using a CryptoPhoto appliance, otherwise leave this field as is.</p>";
    461558  }
    462559
    … …  
    536633  }
    537634
     635  // validate salt
     636  function cryptophoto_server_validate($server) {
     637      if (strlen($server) == 0 || !preg_match('|^http(s)?://[a-z0-9-]+(.[a-z0-9-]+)*(:[0-9]+)?(/.*)?$|i', $server)) {
     638          add_settings_error('cryptophoto_server', '', 'Server is not valid');
     639          return "";
     640      }
     641      else {
     642          return $server;
     643      }
     644  }
     645
    538646
    539647  // register fields to pages, settings and callbacks
    540648  function cryptophoto_admin_init() {
    541649      add_settings_section('cryptophoto_settings', 'Plugin Settings', 'cryptophoto_settings_text', 'cryptophoto_settings');
    542       add_settings_field('cryptophoto_publickey', 'Public Key', 'cryptophoto_settings_publickey', 'cryptophoto_settings', 'cryptophoto_settings');
    543       add_settings_field('cryptophoto_privatekey', 'Private Key', 'cryptophoto_settings_privatekey', 'cryptophoto_settings', 'cryptophoto_settings');
     650      add_settings_field('cryptophoto_publickey', 'Public Key:', 'cryptophoto_settings_publickey', 'cryptophoto_settings', 'cryptophoto_settings');
     651      add_settings_field('cryptophoto_privatekey', 'Private Key:', 'cryptophoto_settings_privatekey', 'cryptophoto_settings', 'cryptophoto_settings');
    544652      add_settings_field('cryptophoto_salt', 'Salt:', 'cryptophoto_settings_salt', 'cryptophoto_settings', 'cryptophoto_settings');
     653      add_settings_field('cryptophoto_server', 'Server:', 'cryptophoto_settings_server', 'cryptophoto_settings', 'cryptophoto_settings');
    545654      add_settings_field('cryptophoto_roles', 'Enable for roles:', 'cryptophoto_settings_roles', 'cryptophoto_settings', 'cryptophoto_settings');
    546655      register_setting('cryptophoto_settings', 'cryptophoto_publickey', 'cryptophoto_publickey_validate');
    547656      register_setting('cryptophoto_settings', 'cryptophoto_privatekey', 'cryptophoto_privatekey_validate');
    548657      register_setting('cryptophoto_settings', 'cryptophoto_salt', 'cryptophoto_salt_validate');
     658      register_setting('cryptophoto_settings', 'cryptophoto_server', 'cryptophoto_server_validate');
    549659      register_setting('cryptophoto_settings', 'cryptophoto_roles', 'cryptophoto_roles_validate');
    550660  }
    … …  
    589699    if (!$this_plugin) $this_plugin = plugin_basename(__FILE__);
    590700    if ($file == $this_plugin) {
    591       $settings_link = '<a href="options-general.php?page=cryptophoto_wordpress">'.__("Settings", "cryptophoto_wordpress").'</a>';
     701      $settings_link = '<a href="'.get_admin_url(null, 'options-general.php?page=cryptophoto_wordpress').'">'.__("Settings", "cryptophoto_wordpress").'</a>';
    592702      array_unshift($links, $settings_link);
    593703    }
    … …  
    601711    global $usersListTable;
    602712
    603     if(isset($_POST['s'])) {
     713    if(isset($_POST['s']) && $_POST['s'] != "") {
    604714      $filter = 'WHERE user_nicename LIKE "%' . $_POST['s'] . '%" OR user_login LIKE "%' . $_POST['s'] . '%" OR user_email LIKE "%' . $_POST['s'] . '%"';
    605715    }
    … …  
    651761
    652762    // a valid action was posted
    653     if(isset($_POST['action']) && $_POST['action'] != -1) {
    654       if($_POST['action'] == 'disable' || $_POST['action'] == 'enable') {
     763    if((isset($_POST['action']) && $_POST['action'] != -1) || (isset($_POST['action2']) && $_POST['action2'] != -1)) {
     764      if($_POST['action'] == 'disable' || $_POST['action'] == 'enable' || $_POST['action2'] == 'disable' || $_POST['action2'] == 'enable') {
    655765        // there were selected users
    656766        if(isset($_POST['user'])) {
    … …  
    662772            $cp_status = get_user_option("cryptophoto_enabled", intval($multiusers[$i]));
    663773
    664             if($_POST['action'] == 'disable') {
     774            if($_POST['action'] == 'disable' || $_POST['action2'] == 'disable') {
    665775              if($cp_status == 1) {
    666776                update_user_option ( intval($multiusers[$i]), "cryptophoto_enabled", 0);
    … …  
    668778            }
    669779
    670             if($_POST['action'] == 'enable') {
     780            if($_POST['action'] == 'enable' || $_POST['action2'] == 'enable') {
    671781              if($cp_status == 0) {
    672782                update_user_option ( intval($multiusers[$i]), "cryptophoto_enabled", 1);
    … …  
    726836      $usersListTable->res[$key]['cryptophoto'] = '<a align="left" href="#" title="' . $title . '" ' . 
    727837                                                  'onclick="return switchStatus(this, ' . $row['id'] . ')">' .
    728                                                   '<img src="' . $image . '">'.
     838                                                  '<img style="position:relative;top:5px;" src="' . $image . '">'.
    729839                                                  '</a>';
    730840    }
    … …  
    855965    if (!$this_plugin) $this_plugin = plugin_basename(__FILE__);
    856966    if ($file == $this_plugin) {
    857       $users_link = '<a href="options-general.php?page=cryptophoto_wordpress&tab=users">'.__("Users", "cryptophotousers_wordpress").'</a>';
     967      $users_link = '<a href="'.get_admin_url(null, 'options-general.php?page=cryptophoto_wordpress&tab=users').'">'.__("Users", "cryptophotousers_wordpress").'</a>';
    858968      array_unshift($links, $users_link);
    859969    }
    … …  
    868978    $privatekey = get_option('cryptophoto_privatekey');
    869979    $publickey   = get_option('cryptophoto_publickey');
    870     $salt = get_option('cryptophoto_salt');       
     980    $salt = get_option('cryptophoto_salt');
     981    $server = get_option('cryptophoto_server');       
    871982
    872983    // check for valid CryptoPhoto configuration
    … …  
    874985     echo '<p class="submit"> The plugin is not properly configured. ';
    875986     if (current_user_can( "administrator" )) {
    876        echo 'You can configure it <a href="http://wplocal.com/wp-admin/options-general.php?page=cryptophoto_wordpress">here</a>.';
     987       echo 'You can configure it <a href="'.get_admin_url(null, 'options-general.php?page=cryptophoto_wordpress').'">here</a>.';
    877988     } else {
    878989       echo 'Contact your administrator.';
    … …  
    9051016<?php
    9061017     //"
    907      $cp = new CryptoPhotoUtils($privatekey,  $publickey, md5($salt . $userid));
     1018     $cp = new CryptoPhotoUtils($server, $privatekey,  $publickey, md5($salt . $userid));
    9081019     $rv = $cp->start_session($_SERVER['REMOTE_ADDR']);
    9091020     

  • cryptophoto-two-and-multi-factor-authentication/trunk/include/CryptoPhotoUsersListTable.php

    r791114 r1325628  
    150150    $filter = "";
    151151    if ($this->filter) {
    152       $filter = $this->filter;
     152      $filter = " " . $this->filter;
    153153    }
    154154
    155155    $current_page = $this->get_pagenum();
    156156
    157     $this->res = $wpdb->get_results("SELECT id, user_nicename, user_login, user_email, user_status FROM wp_users " . $filter .
    158                  " LIMIT " . ( ( $current_page-1 ) * $per_page ) . "," . $per_page, ARRAY_A);
     157    $sql_query = "SELECT id, user_nicename, user_login, user_email, user_status FROM ".$wpdb->users. $filter .
     158                 " LIMIT " . ( ( $current_page-1 ) * $per_page ) . "," . $per_page;
     159
     160    $this->res = $wpdb->get_results($sql_query, ARRAY_A);
    159161    usort( $this->res, array( &$this, 'usort_reorder' ) );
    160162
    … …  
    164166    $this->_column_headers = array( $columns, $hidden, $sortable );
    165167
    166     $total_items = $wpdb->get_results("SELECT COUNT(id) FROM wp_users " . $filter, ARRAY_N);
     168    $total_items = $wpdb->get_results("SELECT COUNT(id) FROM ".$wpdb->users. $filter, ARRAY_N);
    167169    $total_items = $total_items[0][0];
    168170

  • cryptophoto-two-and-multi-factor-authentication/trunk/include/CryptoPhotoUtils.php

    r791114 r1325628  
    1010 *        http://cryptophoto.com/register/
    1111 *
    12  * VERSION: 1.20131017
    13  * COPYRIGHT(c) 2013 CryptoPhoto -- http://cryptophoto.com/
     12 * VERSION: 1.20150825
     13 * COPYRIGHT(c) 2015 CryptoPhoto -- http://cryptophoto.com/
    1414 * AUTHOR: CryptoPhoto
    1515 *
    … …  
    3535
    3636
    37 //server URLs
    38 define("CRYPTO_SERVER", "cryptophoto.com/api/");
    39 define("SERVER_ERROR", "error-cryptophoto-not-reachable");
     37//server
     38define("SERVER_ERROR", "error-server-not-reachable");
    4039define("REQUEST_ERROR", "error-bad-request");
    4140define("PORT", 80);
    … …  
    4544
    4645  //userdata
     46  var $server;
    4747  var $privatekey;
    4848  var $publickey;
    … …  
    5656
    5757  //constructor
    58   function CryptoPhotoUtils($privatekey, $publickey, $uid) {
     58  function CryptoPhotoUtils($server, $privatekey="", $publickey="", $uid="") {
    5959    $this->privatekey = $privatekey;
    6060    $this->publickey = $publickey;
    6161    $this->uid = $uid;
    62   }
     62   
     63    if(!empty($server)) {
     64      $this->server = $server;     
     65      $this->server = rtrim($this->server, '/');   
     66
     67      if( ( strcmp(substr($server, 0, 7), "http://") != 0 ) && (strcmp(substr($server, 0, 8), "https://") != 0)) {
     68        $this->server = "http://" . $server;         
     69      }
     70    }
     71    else {
     72      $this->server = "https://cryptophoto.com"; 
     73    }
     74  }
     75
    6376
    6477  /**
    … …  
    8699
    87100    if(function_exists('curl_init')) {
     101
    88102      $req = $this->string_encode($udata);
    89103      $cookies = "";
    90104      $response = "";
    91 
    92105      $data = array (
    93106                  'http' => array (
    … …  
    101114
    102115      $ch = curl_init ($url);
     116      curl_setopt ($ch, CURLOPT_CAINFO, dirname(__FILE__) . '/cacert.pem');
    103117      curl_setopt ($ch, CURLOPT_POST, true);
    104118      curl_setopt ($ch, CURLOPT_POSTFIELDS, $req);
    105119      curl_setopt ($ch, CURLOPT_RETURNTRANSFER, true);
    106120      $response = curl_exec($ch);
     121      if(curl_errno($ch)) { error_log("CURL error: " . curl_error ($ch)); }
    107122    }
    108123
    … …  
    151166      $response = explode("\r\n\r\n", $response, 2);
    152167    }
    153 
     168   
    154169    return $response;
    155170}
    … …  
    168183    $data['signature'] = $this->make_signature($this->uid, $this->publickey, $this->privatekey, $time);
    169184    $data['ip'] = $ip;
    170  
    171     if(function_exists('curl_init')) {
    172       $response = $this->post_request("https://".CRYPTO_SERVER."get/session", $data);
    173     }
    174     else {
    175       $response = $this->post_request("http://".CRYPTO_SERVER."get/session", $data);
    176     }
     185
     186    $scheme = parse_url($this->server);
     187       
     188    if($scheme['scheme'] == 'https') {
     189      if(function_exists('curl_init')) {
     190        $response = $this->post_request($this->server . "/api/get/session", $data);
     191      }
     192      else {
     193        $this->server = str_replace("https://", "http://" , $this->server);
     194        $response = $this->post_request($this->server . "/api/get/session", $data);
     195      }
     196    }   
     197    else {
     198      $response = $this->post_request($this->server . "/api/get/session", $data);
     199    }   
    177200
    178201    if($response != null && $response != '') {
    … …  
    217240  function get_gen_widget() {
    218241    if($this->sid != null && $this->sid != '') {
    219       return '<script type="text/javascript" src="https://'.CRYPTO_SERVER.'token?sd='.$this->sid.'"></script>';
     242      return '<script type="text/javascript" src="' . $this->server . '/api/token?sd=' . $this->sid . '"></script>';
    220243    }
    221244    else {
    … …  
    229252  function get_auth_widget() {
    230253    if($this->sid != null && $this->sid != '') {
    231       return '<script type="text/javascript" src="https://'.CRYPTO_SERVER.'challenge?sd='.$this->sid.'"></script>';
     254      return '<script type="text/javascript" src="' . $this->server . '/api/challenge?sd=' . $this->sid . '"></script>';
    232255    }
    233256    else {
    … …  
    260283    }
    261284
    262     $time = time();  
     285    $time = time();
    263286    //compose userdata
    264287    $data['publickey'] = $this->publickey;
    … …  
    272295    $data['ip'] = $ip;
    273296
    274     //post userdata and his challenge response
    275     if(function_exists('curl_init')) {
    276       $resp = $this->post_request("https://".CRYPTO_SERVER."verify", $data);
    277     }
    278     else {
    279       $resp = $this->post_request("http://".CRYPTO_SERVER."verify", $data);
    280     }
    281 
    282     if($resp != null && $resp !='') {
    283 
     297    $scheme = parse_url($this->server);
     298       
     299    if($scheme['scheme'] == 'https') {
    284300      if(function_exists('curl_init')) {
    285         $answer = explode("\n", $resp);
     301        $response = $this->post_request($this->server . "/api/verify", $data);
    286302      }
    287303      else {
    288         $answer = explode("\n", $resp[1]);
     304        $this->server = str_replace("https://", "http://", $this->server);
     305        $response = $this->post_request($this->server . "/api/verify", $data);
     306      }
     307    }   
     308    else {
     309      $response = $this->post_request($this->server . "/api/verify", $data);
     310    }   
     311   
     312    if($response != null && $response !='') {
     313
     314      if(function_exists('curl_init')) {
     315        $answer = explode("\n", $response);
     316      }
     317      else {
     318        $answer = explode("\n", $response[1]);
    289319      }
    290320
    … …  
    311341  }
    312342
    313   /**
    314   * creates the user signature
    315   * @param string $uid
    316   * @param string $publickey
    317   * @param string $privatekey
    318   * @param string $time
    319   * @return string */
    320   function make_signature($uid, $publickey, $privatekey, $time) {
    321     if(function_exists("hash_hmac")) {
    322       return hash_hmac("sha1", $privatekey . $time . $uid . $publickey, $privatekey, false);
    323     }
    324     else {
    325       $this->hmac($privatekey . $time . $uid . $publickey, $privatekey);
    326     }
    327   }
    328  
    329   // RFC 2104 HMAC implementation for php.
    330   function hmac ($key, $data) {
    331     $b = 64; // byte length for md5
    332     if (strlen($key) > $b) {
    333         $key = pack("H*",md5($key));
    334     }
    335     $key  = str_pad($key, $b, chr(0x00));
    336     $ipad = str_pad('', $b, chr(0x36));
    337     $opad = str_pad('', $b, chr(0x5c));
    338     $k_ipad = $key ^ $ipad ;
    339     $k_opad = $key ^ $opad;
     343
     344  /**
     345  * creates the user signature 
     346  * @param string $uid
     347  * @param string $publickey
     348  * @param string $privatekey
     349  * @param string $time
     350  * @return string */
     351  function make_signature($uid, $publickey, $privatekey, $time) {
     352
     353    if (function_exists("hash_hmac")) {
     354      return hash_hmac("sha1", $privatekey . $time . $uid . $publickey, $privatekey, false);
     355    }
     356    else {
     357      return $this->hmac("sha1", $privatekey . $time . $uid . $publickey, $privatekey, false);
     358    }
     359  }
     360   
     361   
     362  function hmac($algo, $data, $key, $raw_output = false) {
     363    $algo = strtolower($algo);
     364    $pack = 'H'.strlen($algo('test'));
     365    $size = 64;
     366    $opad = str_repeat(chr(0x5C), $size);
     367    $ipad = str_repeat(chr(0x36), $size);
    340368 
    341     return md5($k_opad  . pack("H*",md5($k_ipad . $data)));
    342   }
    343  
    344 }
     369    if (strlen($key) > $size) {
     370        $key = str_pad(pack($pack, $algo($key)), $size, chr(0x00));
     371    } else {
     372        $key = str_pad($key, $size, chr(0x00));
     373    }
     374 
     375    for ($i = 0; $i < strlen($key) - 1; $i++) {
     376        $opad[$i] = $opad[$i] ^ $key[$i];
     377        $ipad[$i] = $ipad[$i] ^ $key[$i];
     378    }
     379 
     380    $output = $algo($opad.pack($pack, $algo($ipad.$data)));
     381 
     382    return ($raw_output) ? pack($pack, $output) : $output;
     383  }
     384
     385  function verify_cptv_response ($parms) {
     386
     387     if (isset($parms['cpJWSrfc7515'])) {
     388
     389       $scheme = parse_url($this->server);
     390
     391       $data['token'] = $parms['cpJWSrfc7515'];
     392
     393       if ($scheme['scheme'] == 'https') {
     394         if (function_exists('curl_init')) {
     395           $response = $this->post_request($this->server . "/api/verify/cptv.json", $data);
     396         }
     397         else {
     398           $this->server = str_replace("https://", "http://", $this->server);
     399           $response = $this->post_request($this->server . "/api/verify/cptv.json", $data);
     400         }
     401       }
     402       else {
     403         $response = $this->post_request($this->server . "/api/verify/cptv.json", $data);
     404       }
     405
     406       if ($response != null && $response != '') {
     407         $obj = $this->jsonDecode($response);
     408
     409         if ($obj != null) {
     410
     411           if ($this->property_exists($obj, "success") && $obj->success) {
     412
     413             $jwt = $parms['cpJWSrfc7515'];
     414
     415             $tks = explode('.', $jwt);
     416
     417             $payload = $this->jsonDecode($this->urlsafeB64Decode($tks[1]));
     418
     419             if ($payload != null && $this->property_exists($payload, "fieldsOrder") && $this->property_exists($payload, "fieldsSha256")) {
     420
     421               $fieldsOrder = $payload->fieldsOrder;
     422               $fieldsSha256 = $payload->fieldsSha256;
     423
     424               $fields = explode(",", $fieldsOrder);
     425
     426               $shacontent="";
     427
     428               foreach ($fields as $field) {
     429                 if(isset($parms[$field]) && $parms[$field]) $shacontent .= $parms[$field];
     430               }
     431
     432               $shacontent = base64_encode($this->hash256($shacontent));
     433               $shacontent = str_replace('=', '', $shacontent); // remove the padding bit, they might not match because of it
     434               $fieldsSha256 = str_replace('=', '', $fieldsSha256);
     435
     436               if ($fieldsSha256 == $shacontent) {
     437                 return array("is_valid" => TRUE);
     438               } else {
     439                 return array("is_valid" => FALSE, "error" => "POSTed field values have been changed");
     440               }
     441
     442             }
     443
     444           } else {
     445             return array("is_valid" => FALSE, "error" => $obj->description);
     446           }
     447       
     448         } else {
     449           return array("is_valid" => FALSE, "error" => "CRYPTOPHOTO responded with invalid format");
     450         }
     451         
     452       } else {
     453         return array("is_valid" => FALSE, "error" => SERVER_ERROR);
     454       }
     455    } 
     456
     457    return array("is_valid" => FALSE, "error" => "JWT token not provided");
     458
     459  }
     460
     461  function property_exists ($obj, $property) {
     462    if ( !function_exists( 'property_exists' ) ) {
     463      if ( is_object( $obj ) ) {
     464        $vars = get_object_vars( $obj );
     465      } else {
     466        $vars = get_class_vars( $obj );
     467      }
     468      return array_key_exists( $property, $vars );
     469    }
     470    return property_exists($obj, $property);
     471  }
     472
     473  function hash256($input) {
     474    if ( !function_exists('hash') ) {
     475      require_once("sha256.php");
     476      return SHA256::hash($input, "bin");
     477    }
     478
     479    return hash("sha256", $input, True);
     480  }
     481
     482  function jsonDecode($input) {
     483
     484    if ( !function_exists('json_decode') ) {
     485      require_once("JSON.php");
     486      $json = new Services_JSON();
     487      return $json->decode($input);
     488    }
     489
     490    if (version_compare(PHP_VERSION, '5.4.0', '>=') && !(defined('JSON_C_VERSION') && PHP_INT_SIZE > 4)) {
     491      $obj = json_decode($input, false, 512, JSON_BIGINT_AS_STRING);
     492    } else {
     493      $max_int_length = strlen((string) PHP_INT_MAX) - 1;
     494      $json_without_bigints = preg_replace('/:\s*(-?\d{'.$max_int_length.',})/', ': "$1"', $input);
     495      $obj = json_decode($json_without_bigints);
     496    }
     497    if (function_exists('json_last_error') && $errno = json_last_error()) {
     498      return null;
     499    } elseif ($obj === null && $input !== 'null') {
     500      return null;
     501    }
     502    return $obj;
     503  }
     504
     505  function urlsafeB64Decode($input) {
     506    $remainder = strlen($input) % 4;
     507    if ($remainder) {
     508      $padlen = 4 - $remainder;
     509      $input .= str_repeat('=', $padlen);
     510    }
     511    return base64_decode(strtr($input, '-_', '+/'));
     512  }
     513   
     514}
    345515
    346516?>
Note: See TracChangeset for help on using the changeset viewer.