From 8c9abb9888b37a3550ec80e87b7bbdc122d5ccf7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Tue, 31 Oct 2017 13:31:09 +0100
Subject: [PATCH] Add configuration for second authentication factor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/user_preferences.inc.php    |  8 ++++
 prefs_second.php                      | 63 +++++++++++++++++++++++++++
 templates/prefs_second.twig           | 53 ++++++++++++++++++++++
 templates/prefs_second_configure.twig | 13 ++++++
 templates/prefs_second_confirm.twig   | 12 +++++
 5 files changed, 149 insertions(+)
 create mode 100644 prefs_second.php
 create mode 100644 templates/prefs_second.twig
 create mode 100644 templates/prefs_second_configure.twig
 create mode 100644 templates/prefs_second_confirm.twig

diff --git a/libraries/user_preferences.inc.php b/libraries/user_preferences.inc.php
index 693c2538bc..eabe371b94 100644
--- a/libraries/user_preferences.inc.php
+++ b/libraries/user_preferences.inc.php
@@ -9,6 +9,7 @@ use PhpMyAdmin\Config\Forms\User\UserFormList;
 use PhpMyAdmin\Message;
 use PhpMyAdmin\Relation;
 use PhpMyAdmin\Sanitize;
+use PhpMyAdmin\SecondFactor;
 
 if (!defined('PHPMYADMIN')) {
     exit;
@@ -30,6 +31,13 @@ $content = PhpMyAdmin\Util::getHtmlTab(
         'text' => __('Manage your settings')
     )
 ) . "\n";
+/* Second authentication factor */
+$content .= PhpMyAdmin\Util::getHtmlTab(
+    array(
+        'link' => 'prefs_second.php',
+        'text' => __('Two-factor authentication')
+    )
+) . "\n";
 $script_name = basename($GLOBALS['PMA_PHP_SELF']);
 foreach (UserFormList::getAll() as $formset) {
     $formset_class = UserFormList::get($formset);
diff --git a/prefs_second.php b/prefs_second.php
new file mode 100644
index 0000000000..27e626a387
--- /dev/null
+++ b/prefs_second.php
@@ -0,0 +1,63 @@
+<?php
+/* vim: set expandtab sw=4 ts=4 sts=4: */
+/**
+ * User preferences management page
+ *
+ * @package PhpMyAdmin
+ */
+use PhpMyAdmin\Message;
+use PhpMyAdmin\SecondFactor;
+use PhpMyAdmin\Template;
+
+/**
+ * Gets some core libraries and displays a top message if required
+ */
+require_once 'libraries/common.inc.php';
+
+require 'libraries/user_preferences.inc.php';
+
+$second_factor = new SecondFactor($GLOBALS['cfg']['Server']['user']);
+
+if (isset($_POST['2fa_remove'])) {
+    if (! $second_factor->check(true)) {
+        echo Template::get('prefs_second_confirm')->render([
+            'form' => $second_factor->render(),
+        ]);
+        exit;
+    } else {
+        $second_factor->configure('');
+        Message::rawNotice(__('Two-factor authentication has been removed.'))->display();
+    }
+} elseif (isset($_POST['2fa_configure'])) {
+    if (! $second_factor->configure($_POST['2fa_configure'])) {
+        echo Template::get('prefs_second_configure')->render([
+            'form' => $second_factor->setup(),
+            'configure' => $_POST['2fa_configure'],
+        ]);
+        exit;
+    } else {
+        Message::rawNotice(__('Two-factor authentication has been configured.'))->display();
+    }
+}
+
+$all = array_merge([''], $second_factor->available);
+$backends = [];
+foreach ($all as $name) {
+    $cls = $second_factor->getBackendClass($name);
+    $backends[] = [
+        'id' => $cls::$id,
+        'name' => $cls::getName(),
+        'description' => $cls::getDescription(),
+    ];
+}
+
+
+$backend = $second_factor->backend;
+echo Template::get('prefs_second')->render([
+    'enabled' => $second_factor->writable,
+    'num_backends' => count($second_factor->available),
+    'backend_id' => $backend::$id,
+    'backend_name' => $backend::getName(),
+    'backend_description' => $backend::getDescription(),
+    'backends' => $backends,
+]);
diff --git a/templates/prefs_second.twig b/templates/prefs_second.twig
new file mode 100644
index 0000000000..ef3b83204e
--- /dev/null
+++ b/templates/prefs_second.twig
@@ -0,0 +1,53 @@
+<div class="group">
+<h2>
+{% trans "Two-factor authentication status" %}
+{{ Util_showDocu('second_factor') }}
+</h2>
+<div class="group-cnt">
+{% if enabled %}
+{% if num_backends == 0 %}
+<p>{% trans "Two-factor authentication is not available, please install optional dependencies to enable authentication backends." %}</p>
+{% else %}
+{% if backend_id %}
+<p>{% trans "Two-factor authentication is available and configured for this account." %}</p>
+{% else %}
+<p>{% trans "Two-factor authentication is available, but not configured for this account." %}</p>
+{% endif %}
+{% endif %}
+{% else %}
+<p>{% trans "Two-factor authentication is not available, enable phpMyAdmin configuration storage to use it." %}</p>
+{% endif %}
+</div>
+</div>
+
+{% if backend_id %}
+<div class="group">
+<h2>{{ backend_name }}</h2>
+<div class="group-cnt">
+<p>{% trans "You have enabled two factor authentication." %}</p>
+<p>{{ backend_description }}</p>
+<form method="POST" action="prefs_second.php">
+{{ Url_getHiddenInputs() }}
+<input type="submit" name="2fa_remove" value="{% trans "Disable two-factor authentication" %}" />
+</form>
+</div>
+</div>
+{% else %}
+<div class="group">
+<h2>{% trans "Configure two-factor authentication" %}</h2>
+<div class="group-cnt">
+<form method="POST" action="prefs_second.php">
+{{ Url_getHiddenInputs() }}
+<option name="2fa_configure">
+{% for backend in backends %}
+<label>
+<input type="radio" name="2fa_configure" {% if backend["id"] == "" %}checked="checked"{% endif %} value="{{ backend["id"] }}"/>
+<strong>{{ backend["name"] }}</strong>
+<p>{{ backend["description"] }}</p>
+</label>
+{% endfor %}
+<input type="submit" value="{% trans "Configure two-factor authentication" %}" />
+</form>
+</div>
+</div>
+{% endif %}
diff --git a/templates/prefs_second_configure.twig b/templates/prefs_second_configure.twig
new file mode 100644
index 0000000000..cffc6c9cc2
--- /dev/null
+++ b/templates/prefs_second_configure.twig
@@ -0,0 +1,13 @@
+<div class="group">
+<h2>{% trans "Configure two-factor authentication" %}</h2>
+<div class="group-cnt">
+<form method="POST" action="prefs_second.php">
+{{ Url_getHiddenInputs() }}
+<input type="hidden" name="2fa_configure" value="{{ configure }}" />
+{{ form|raw }}
+<input type="submit" value="{% trans "Enable two-factor authentication" %}" />
+</form>
+</div>
+</div>
+
+
diff --git a/templates/prefs_second_confirm.twig b/templates/prefs_second_confirm.twig
new file mode 100644
index 0000000000..091983e205
--- /dev/null
+++ b/templates/prefs_second_confirm.twig
@@ -0,0 +1,12 @@
+<div class="group">
+<h2>{% trans "Confirm disabling two-factor authentication" %}</h2>
+<div class="group-cnt">
+<form method="POST" action="prefs_second.php">
+{{ Message_notice("By disabling two factor authentication you will be again able to login using password only."|trans) }}
+{{ Url_getHiddenInputs() }}
+{{ form|raw }}
+<input type="hidden" name="2fa_remove" value="1" />
+<input type="submit" value="{% trans "Disable two-factor authentication" %}" />
+</form>
+</div>
+</div>