OAuth2 Saved Login Session Mechanism
This commit is contained in:
parent
101bfd0d30
commit
ca5bccce93
71
auth/api/index.php
Normal file
71
auth/api/index.php
Normal file
@ -0,0 +1,71 @@
|
|||||||
|
<?php
|
||||||
|
|
||||||
|
$config = json_decode(file_get_contents("/var/www/usergen/secret/config.json", true));
|
||||||
|
|
||||||
|
require_once("/var/www/usergen/secret/helpers.php");
|
||||||
|
require_once("/var/www/usergen/secret/oauth.php");
|
||||||
|
require_once("/var/www/usergen/secret/rsa.php");
|
||||||
|
|
||||||
|
if (isset($_REQUEST["act"])) {
|
||||||
|
// internal functions such as id request
|
||||||
|
switch($_REQUEST["act"]){
|
||||||
|
case "id":
|
||||||
|
// return OAUTH app ID
|
||||||
|
header('Content-type: application/json');
|
||||||
|
echo json_encode(array("id" => $config->oauth->key));
|
||||||
|
exit();
|
||||||
|
break;
|
||||||
|
case "login":
|
||||||
|
if (isset($_REQUEST["code"])){
|
||||||
|
// Mastodon callback (Authorization Code from /oauth/authorize)
|
||||||
|
$authCode = $_REQUEST["code"];
|
||||||
|
$Auth = oauthToken($authCode, $config);
|
||||||
|
if(isset($Auth->token_type)){
|
||||||
|
// Valid Auth?
|
||||||
|
$User = verifyCredentials($Auth->access_token);
|
||||||
|
if (gettype($User) == "object" && isset($User->id)) {
|
||||||
|
// Congrats!
|
||||||
|
returnSuccess($User, buildEncToken($Auth->access_token, $User->id, $_SERVER["REMOTE_ADDR"], $_SERVER["HTTP_USER_AGENT"]));
|
||||||
|
}else{
|
||||||
|
// invalid auth
|
||||||
|
// $User contains error string
|
||||||
|
returnError($User);
|
||||||
|
}
|
||||||
|
}else{
|
||||||
|
// invalid auth
|
||||||
|
returnError($Auth);
|
||||||
|
}
|
||||||
|
}else{
|
||||||
|
returnError("Incorrect Login Query");
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
case "verify":
|
||||||
|
if (isset($_REQUEST["token"])){
|
||||||
|
// Verify Encrypted Token
|
||||||
|
$EncTokenData = $_REQUEST["token"];
|
||||||
|
$TokenData = verifyEncToken($EncTokenData);
|
||||||
|
if (gettype($TokenData) == "string") {
|
||||||
|
// Invalid Token
|
||||||
|
returnError($TokenData);
|
||||||
|
}else{
|
||||||
|
// Valid Token
|
||||||
|
returnSuccess($TokenData["MastodonData"],
|
||||||
|
buildEncToken($TokenData["AuthToken"],
|
||||||
|
$TokenData["UserID"],
|
||||||
|
$_SERVER["REMOTE_ADDR"],
|
||||||
|
$_SERVER["HTTP_USER_AGENT"]
|
||||||
|
)
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}else{
|
||||||
|
returnError("Incorrect Verify Query");
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
returnError("Incorrect Action Query");
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}else {
|
||||||
|
returnError("Incorrect Empty Query");
|
||||||
|
}
|
||||||
|
?>
|
||||||
289
auth/auth.js
Normal file
289
auth/auth.js
Normal file
@ -0,0 +1,289 @@
|
|||||||
|
var DEBUG = false;
|
||||||
|
var isMobile = false;
|
||||||
|
var USE_ORIGIN = "";
|
||||||
|
|
||||||
|
const SwalConfig = {
|
||||||
|
color: "#79F257",
|
||||||
|
background: "#022601",
|
||||||
|
buttonsStyling: false,
|
||||||
|
};
|
||||||
|
|
||||||
|
const invalidChars = ["/", "\\", ">", "<", ":", "*", "|", '"', "'", "?", "\0"];
|
||||||
|
|
||||||
|
const failMsg = (msg) => {
|
||||||
|
Swal.fire({
|
||||||
|
...SwalConfig,
|
||||||
|
title: "Error!",
|
||||||
|
text: msg,
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
const replaceInvalid = (str) => {
|
||||||
|
var cache = str;
|
||||||
|
invalidChars.forEach((ch) => {
|
||||||
|
cache = cache.replaceAll(ch, "#");
|
||||||
|
});
|
||||||
|
return cache;
|
||||||
|
};
|
||||||
|
|
||||||
|
const post = (url, data, callback) => {
|
||||||
|
var settings = {
|
||||||
|
url: url,
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/x-www-form-urlencoded"
|
||||||
|
},
|
||||||
|
data: data
|
||||||
|
};
|
||||||
|
$.ajax(settings).done(callback);
|
||||||
|
};
|
||||||
|
|
||||||
|
const saveFile = (name, type, data) => {
|
||||||
|
if (data !== null && navigator.msSaveBlob)
|
||||||
|
return navigator.msSaveBlob(new Blob([data], { type: type }), name);
|
||||||
|
var a = $("<a style='display: none;'/>");
|
||||||
|
var url = window.URL.createObjectURL(new Blob([data], { type: type }));
|
||||||
|
a.attr("href", url);
|
||||||
|
a.attr("download", name);
|
||||||
|
$("body").append(a);
|
||||||
|
a[0].click();
|
||||||
|
window.URL.revokeObjectURL(url);
|
||||||
|
a.remove();
|
||||||
|
};
|
||||||
|
|
||||||
|
const validatePubKey = (key) => {
|
||||||
|
return /^(ssh-rsa AAAAB3NzaC1yc2|ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNT|ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzOD|ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1Mj|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5|ssh-dss AAAAB3NzaC1kc3)[0-9A-Za-z+\/]+[=]{0,3}( .*)?$/.test(
|
||||||
|
key
|
||||||
|
);
|
||||||
|
};
|
||||||
|
|
||||||
|
const sendSSH = (key, id, token) => {
|
||||||
|
var payload = {
|
||||||
|
pubkey: key,
|
||||||
|
token: token,
|
||||||
|
};
|
||||||
|
post(USE_ORIGIN + "/auth/setKey.php", payload, (response) => {
|
||||||
|
if (!response.error) {
|
||||||
|
localStorage.setItem("tty_token", response.refreshToken);
|
||||||
|
Swal.fire({
|
||||||
|
...SwalConfig,
|
||||||
|
title: "Success!",
|
||||||
|
text: "Your key has been uploaded to the server.",
|
||||||
|
});
|
||||||
|
} else {
|
||||||
|
Swal.fire({
|
||||||
|
...SwalConfig,
|
||||||
|
title: "Failed!",
|
||||||
|
text: response.error,
|
||||||
|
}).then(() => {
|
||||||
|
window.location.reload();
|
||||||
|
});
|
||||||
|
}
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
const generateSSH = async () => {
|
||||||
|
if (window.location.protocol === "http:") {
|
||||||
|
Swal.fire({
|
||||||
|
...SwalConfig,
|
||||||
|
title: "Error!",
|
||||||
|
text: "You must use HTTPS to generate keys.",
|
||||||
|
});
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
var token = localStorage.getItem("tty_token");
|
||||||
|
var userData = localStorage.getItem("tty_userData");
|
||||||
|
if (!token || !userData) {
|
||||||
|
failMsg("Not Logged In");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
userData = JSON.parse(userData);
|
||||||
|
generateKeyPair("RSASSA-PKCS1-v1_5", 4096, "WebGen " + Date())
|
||||||
|
.then((keys) => {
|
||||||
|
var KeyExport = new JSZip();
|
||||||
|
var name = replaceInvalid(userData.username);
|
||||||
|
KeyExport.file("HackersTownTTY-" + name, keys[0]);
|
||||||
|
KeyExport.file("HackersTownTTY-" + name + ".pub", keys[1]);
|
||||||
|
KeyExport.generateAsync({ type: "blob" }).then((content) => {
|
||||||
|
saveFile("HackersTownTTY-" + name + ".zip", "application/zip", content);
|
||||||
|
});
|
||||||
|
sendSSH(keys[1], userData.id, token);
|
||||||
|
})
|
||||||
|
.catch((err) => {
|
||||||
|
console.log(err);
|
||||||
|
failMsg("Failed to generate keypair locally.");
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
const testSwal = () => {
|
||||||
|
Swal.fire({
|
||||||
|
...SwalConfig,
|
||||||
|
title: "Success!",
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
const uploadSSH = () => {
|
||||||
|
var token = localStorage.getItem("tty_token");
|
||||||
|
var userData = localStorage.getItem("tty_userData");
|
||||||
|
if (!token || !userData) {
|
||||||
|
failMsg("Not Logged In");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
userData = JSON.parse(userData);
|
||||||
|
//request local file
|
||||||
|
var kf = document.getElementById("keyfile");
|
||||||
|
kf.onchange = function (e) {
|
||||||
|
// File selected
|
||||||
|
var file = e.target.files[0];
|
||||||
|
if (file) {
|
||||||
|
var reader = new FileReader();
|
||||||
|
reader.readAsText(file, "UTF-8");
|
||||||
|
reader.onload = function (evt) {
|
||||||
|
var pubkey = evt.target.result;
|
||||||
|
pubkey = pubkey.replace(/\r\n/g, "\n");
|
||||||
|
pubkey = pubkey.replace(/\n/g, "");
|
||||||
|
if (validatePubKey(pubkey)) {
|
||||||
|
sendSSH(pubkey, userData.id, token);
|
||||||
|
} else {
|
||||||
|
failMsg("Invalid key");
|
||||||
|
}
|
||||||
|
};
|
||||||
|
reader.onerror = function (evt) {
|
||||||
|
failMsg("Unable to load Keyfile");
|
||||||
|
};
|
||||||
|
}
|
||||||
|
};
|
||||||
|
kf.click();
|
||||||
|
};
|
||||||
|
|
||||||
|
const displayFingerprints = () => {
|
||||||
|
// Get SSH Fingerprints and display them
|
||||||
|
$.get(USE_ORIGIN + "/fingerprint.php", (response) => {
|
||||||
|
dbp(response);
|
||||||
|
if (response) {
|
||||||
|
var html =
|
||||||
|
'<div><table class="fingerprintTable"><tr><th>Bits</th><th>Fingerprint (SHA256)</th><th class="text-start">Algorithm</th></tr>';
|
||||||
|
response.split("\n").forEach((line) => {
|
||||||
|
var parts = line.split(" ");
|
||||||
|
if (parts.length === 4) {
|
||||||
|
html +=
|
||||||
|
'<tr><td class="fingerprintBit">' +
|
||||||
|
parts[0] +
|
||||||
|
'</td><td class="fingerprintData">' +
|
||||||
|
parts[1].replace("SHA256:", "") +
|
||||||
|
'</td><td class="fingerprintAlgo">' +
|
||||||
|
parts[3].replace("(", "").replace(")", "") +
|
||||||
|
"</td></tr>";
|
||||||
|
}
|
||||||
|
});
|
||||||
|
html += "</table></div>";
|
||||||
|
Swal.fire({
|
||||||
|
...SwalConfig,
|
||||||
|
title: "SSH Fingerprints",
|
||||||
|
html: html,
|
||||||
|
});
|
||||||
|
} else {
|
||||||
|
Swal.fire({
|
||||||
|
...SwalConfig,
|
||||||
|
title: "Unable to Lookup SSH Fingerprints",
|
||||||
|
text: response.error,
|
||||||
|
});
|
||||||
|
}
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
const checkLogin = () => {
|
||||||
|
// check login status
|
||||||
|
var token = localStorage.getItem("tty_token");
|
||||||
|
if (token){
|
||||||
|
var settings = {
|
||||||
|
url: USE_ORIGIN + "/auth/api/index.php",
|
||||||
|
method: "POST",
|
||||||
|
headers: {
|
||||||
|
"Content-Type": "application/x-www-form-urlencoded"
|
||||||
|
},
|
||||||
|
data: {
|
||||||
|
act: "verify",
|
||||||
|
token: token
|
||||||
|
}
|
||||||
|
};
|
||||||
|
$.ajax(settings).done(function (response) {
|
||||||
|
if(response.error){
|
||||||
|
localStorage.removeItem("tty_token");
|
||||||
|
localStorage.removeItem("tty_userData");
|
||||||
|
window.location.href = "/?error=" + response.error;
|
||||||
|
}else {
|
||||||
|
localStorage.setItem("tty_token", response.refreshToken);
|
||||||
|
localStorage.setItem("tty_userData", JSON.stringify(response.data));
|
||||||
|
document.getElementById("resizer").innerHTML = response.data.display_name;
|
||||||
|
}
|
||||||
|
});
|
||||||
|
}else {
|
||||||
|
window.location.href = "/";
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
const logout = () => {
|
||||||
|
localStorage.removeItem("tty_token");
|
||||||
|
localStorage.removeItem("tty_userData");
|
||||||
|
window.location.href = "/?msg=End%20Of%20Line.";
|
||||||
|
};
|
||||||
|
|
||||||
|
$(() => {
|
||||||
|
// On Page Load
|
||||||
|
// Override domain
|
||||||
|
$.get("/DOMAIN_OVERRIDE", function (data) {
|
||||||
|
USE_ORIGIN = data.replaceAll("\n", "");
|
||||||
|
DEBUG = true;
|
||||||
|
}).fail(() => {
|
||||||
|
USE_ORIGIN = "https://tty.hackers.town";
|
||||||
|
}).always(() => {
|
||||||
|
// Handle Mobile
|
||||||
|
if ( /(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|ipad|iris|kindle|Android|Silk|lge |maemo|midp|mmp|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows (ce|phone)|xda|xiino/i
|
||||||
|
.test(navigator.userAgent ) ||
|
||||||
|
/1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|yas\-|your|zeto|zte\-/i
|
||||||
|
.test(navigator.userAgent.substr(0, 4)
|
||||||
|
)) {
|
||||||
|
isMobile = true;
|
||||||
|
}
|
||||||
|
if (isMobile) {
|
||||||
|
disableNonDesktopElements();
|
||||||
|
}
|
||||||
|
// Handle Auth
|
||||||
|
var authCode = new URL(window.location.href).searchParams.get("code");
|
||||||
|
if (authCode) {
|
||||||
|
// Mastodon OAuth2 Redirected here
|
||||||
|
var settings = {
|
||||||
|
"url": USE_ORIGIN + "/auth/api/index.php",
|
||||||
|
"method": "POST",
|
||||||
|
"headers": {
|
||||||
|
"Content-Type": "application/x-www-form-urlencoded"
|
||||||
|
},
|
||||||
|
"data": {
|
||||||
|
act: "login",
|
||||||
|
code: authCode
|
||||||
|
}
|
||||||
|
};
|
||||||
|
$.ajax(settings).done(function (response) {
|
||||||
|
if(response.error){
|
||||||
|
checkLogin();
|
||||||
|
}else{
|
||||||
|
localStorage.setItem("tty_token", response.refreshToken);
|
||||||
|
localStorage.setItem("tty_userData", JSON.stringify(response.data));
|
||||||
|
document.getElementById("resizer").innerHTML = response.data.display_name;
|
||||||
|
}
|
||||||
|
});
|
||||||
|
} else {
|
||||||
|
// direct connect or from /
|
||||||
|
checkLogin();
|
||||||
|
}
|
||||||
|
// Console Welcome
|
||||||
|
console.log("%cWelcome Hacker!", "color: #ff0000; font-size: 7em; font-style: italic; font-family: 'Times New Roman', Times, serif;");
|
||||||
|
// Enable Extra Debug Stuff
|
||||||
|
if(DEBUG){
|
||||||
|
$('.debug').each((i,e)=>{
|
||||||
|
e.style.display = "unset";
|
||||||
|
});
|
||||||
|
}
|
||||||
|
});
|
||||||
|
});
|
||||||
134
auth/index.php
134
auth/index.php
@ -1,149 +1,43 @@
|
|||||||
<?php
|
<?php
|
||||||
$config = json_decode(file_get_contents("/var/www/usergen/secret/config.json", true));
|
$config = json_decode(file_get_contents("/var/www/usergen/secret/config.json", true));
|
||||||
|
require_once("/var/www/usergen/secret/helpers.php");
|
||||||
require_once("/var/www/usergen/secret/helpers.php");
|
|
||||||
|
|
||||||
require_once("/var/www/usergen/secret/oauth.php");
|
|
||||||
|
|
||||||
if (isset($_REQUEST["act"])){
|
|
||||||
// internal functions such as id request
|
|
||||||
switch($_REQUEST["act"]){
|
|
||||||
case "id":
|
|
||||||
// return OAUTH app ID
|
|
||||||
header('Content-type: application/json');
|
|
||||||
echo json_encode(array("id" => $config->oauth->key));
|
|
||||||
exit();
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}else if (isset($_REQUEST["code"])){
|
|
||||||
// Mastodon callback (Authorization Code from /oauth/authorize)
|
|
||||||
$MastCode = $_REQUEST["code"];
|
|
||||||
// var_dump($_REQUEST);
|
|
||||||
}
|
|
||||||
?>
|
?>
|
||||||
<!DOCTYPE html>
|
<!DOCTYPE html>
|
||||||
<HTML lang="en">
|
<HTML lang="en">
|
||||||
<Head>
|
<?php require("/var/www/usergen/elements/head.php"); ?>
|
||||||
<Title>HackersTown Server Access</Title>
|
<Body>
|
||||||
<meta charset="utf-8">
|
|
||||||
<base href="/auth"/>
|
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
||||||
<!-- Javascript -->
|
|
||||||
<script src="https://code.jquery.com/jquery-3.6.0.min.js" integrity="sha256-/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4=" crossorigin="anonymous"></script>
|
|
||||||
<script src="https://code.jquery.com/color/jquery.color.plus-names-2.1.2.min.js"></script>
|
|
||||||
<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
|
|
||||||
<script src="https://cdn.jsdelivr.net/npm/jszip@3.9.1/dist/jszip.min.js" integrity="sha256-aSPPIlJfSHQ5T7wunbPcp7tM0rlq5dHoUGeN8O5odMg=" crossorigin="anonymous"></script>
|
|
||||||
<script src="https://cdn.jsdelivr.net/npm/sweetalert2@11/dist/sweetalert2.all.min.js" crossorigin="anonymous"></script>
|
|
||||||
<script src="/base64url.js"></script>
|
<script src="/base64url.js"></script>
|
||||||
<script src="/ssh-util.js"></script>
|
<script src="/ssh-util.js"></script>
|
||||||
<script src="/keygen.js"></script>
|
<script src="/keygen.js"></script>
|
||||||
<script src="/fittext.js"></script>
|
<script src="/auth/auth.js"></script>
|
||||||
<script src="/index.js"></script>
|
|
||||||
<!-- Stylesheets -->
|
|
||||||
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">
|
|
||||||
<link href="/style.css" rel="stylesheet"/>
|
|
||||||
</Head>
|
|
||||||
<Body>
|
|
||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="desktopOnly col-4"></div>
|
<div class="desktopOnly col-4"></div>
|
||||||
<div id="content" class="col-4 center">
|
<div id="content" class="col-4 center">
|
||||||
|
<?php require("/var/www/usergen/elements/logo.php"); ?>
|
||||||
<div class="row">
|
<div class="row">
|
||||||
<?php if(file_exists("/var/www/usergen/DOMAIN_OVERRIDE")){
|
|
||||||
echo "<a href=\"".file_get_contents("/var/www/usergen/DOMAIN_OVERRIDE")."\">";
|
|
||||||
}else{
|
|
||||||
echo "<a href=\"https://tty.hackers.town\">";
|
|
||||||
}?>
|
|
||||||
<img src="/Assets/HTown.png" class="logo self-align-center mx-auto d-block" alt="Hacker Town logo in ASCII art. Rendered as image to force correct visualization."/>
|
|
||||||
</a>
|
|
||||||
</div>
|
|
||||||
<?php
|
|
||||||
// Query /oauth/token
|
|
||||||
$Auth = oauthToken($MastCode, $config);
|
|
||||||
if(isset($Auth->token_type)){
|
|
||||||
// Valid Auth?
|
|
||||||
$User = verifyCredentials($Auth->access_token);
|
|
||||||
if (gettype($User) == "object" && isset($User->id)) {
|
|
||||||
// Congrats!
|
|
||||||
$AuthToken = $Auth->access_token;
|
|
||||||
$UserName = $User->display_name;
|
|
||||||
$UserId = $User->id;
|
|
||||||
}else{
|
|
||||||
// invalid auth
|
|
||||||
$AuthToken = "BadUser";
|
|
||||||
$ErrorDesc = "User Not Found";
|
|
||||||
}
|
|
||||||
|
|
||||||
}else{
|
|
||||||
// invalid auth
|
|
||||||
// TODO: Replace with direct to index logout with error msg
|
|
||||||
if(isset($_COOKIE["oa_retries"])){
|
|
||||||
$retries = $_COOKIE["oa_retries"];
|
|
||||||
if($retries >= 3){
|
|
||||||
$AuthToken = "BadUser";
|
|
||||||
$ErrorDesc = "Invalid OAuth";
|
|
||||||
setcookie("oa_retries", 0, time()+3600);
|
|
||||||
}else{
|
|
||||||
$retries++;
|
|
||||||
setcookie("oa_retries", $retries, time()+3600);
|
|
||||||
$AuthToken = "BadOauthRetry";
|
|
||||||
$ErrorDesc = "Invalid OAuth Retry";
|
|
||||||
}
|
|
||||||
}else{
|
|
||||||
$AuthToken = "BadOauth";
|
|
||||||
$ErrorDesc = "Invalid OAuth Retry";
|
|
||||||
setcookie("oa_retries", 1, time()+3600);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// revoke token after usage
|
|
||||||
?>
|
|
||||||
<div id="usertoken" ><?php echo $AuthToken; ?></div>
|
|
||||||
<div class="row"<?php if(strpos($AuthToken, "Bad") === false){
|
|
||||||
echo "hidden";
|
|
||||||
}?>>
|
|
||||||
<span>
|
|
||||||
Invalid
|
|
||||||
</span>
|
|
||||||
<span>
|
|
||||||
try again
|
|
||||||
</span>
|
|
||||||
<div id="ErrorResult" class="message">
|
|
||||||
<?php echo $ErrorDesc; ?>
|
|
||||||
</div>
|
|
||||||
</div><div class="row button"<?php if(strpos($AuthToken, "Bad") === false){
|
|
||||||
echo "hidden";
|
|
||||||
}?>>
|
|
||||||
<button class="col keyButton" onclick="beginOauth()">Retry</button>
|
|
||||||
</div>
|
|
||||||
<div class="row"<?php if(strpos($AuthToken, "Bad") !== false){
|
|
||||||
echo "hidden";
|
|
||||||
}?>>
|
|
||||||
<span>
|
<span>
|
||||||
<?php
|
<?php
|
||||||
$Welcomes = array("Welcome", "Dobrodošli", "Vitejte", "Welkom", "Tervetuloa", "Willkommen", "Fáilte", "Benvenuto", "Bienvenidos", "Välkommen", "ようこそ");
|
echo getHello();
|
||||||
echo $Welcomes[array_rand($Welcomes)];
|
|
||||||
?>
|
?>
|
||||||
</span>
|
</span>
|
||||||
<span id="resizer">
|
<span id="resizer">
|
||||||
<?php echo $UserName; ?>
|
|
||||||
</span>
|
</span>
|
||||||
<div class="message">
|
<div class="message">
|
||||||
Setup an account SSH key
|
Setup an account SSH key
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
<div class="row button" <?php if(strpos($AuthToken, "Bad") !== false){
|
<div class="row button">
|
||||||
echo "hidden";
|
<button class="col keyButton" onclick="generateSSH()">Generate</button>
|
||||||
}?>>
|
<button class="col keyButton" onclick="uploadSSH()">Upload</button>
|
||||||
<button class="col keyButton" onclick="generateSSH('<?php echo $UserName; ?>', '<?php echo $UserId; ?>', '<?php echo $AuthToken; ?>')">Generate</button>
|
|
||||||
<button class="col keyButton" onclick="uploadSSH('<?php echo $UserId; ?>', '<?php echo $AuthToken; ?>' )">Upload</button>
|
|
||||||
<button class="col keyButton debug" onclick="testSwal()">Test Popup</button>
|
<button class="col keyButton debug" onclick="testSwal()">Test Popup</button>
|
||||||
<form id="uploadForm" enctype="multipart/form-data">
|
<form id="uploadForm" enctype="multipart/form-data">
|
||||||
<input id="keyfile" type="file" style="display: none;"/>
|
<input id="keyfile" type="file" style="display: none;"/>
|
||||||
</form>
|
</form>
|
||||||
</div>
|
</div>
|
||||||
<?php require("/var/www/usergen/footer.php"); ?>
|
<div class="row button">
|
||||||
|
<button class="col keyButton" onclick="logout()">Log Out</button>
|
||||||
|
</div>
|
||||||
|
<?php require("/var/www/usergen/elements/footer.php"); ?>
|
||||||
</div>
|
</div>
|
||||||
<div class="desktopOnly col-4"></div>
|
<div class="desktopOnly col-4"></div>
|
||||||
</div>
|
</div>
|
||||||
|
|||||||
@ -2,6 +2,10 @@
|
|||||||
// Create an account and apply SSH key
|
// Create an account and apply SSH key
|
||||||
$config = json_decode(file_get_contents("/var/www/usergen/secret/config.json", true));
|
$config = json_decode(file_get_contents("/var/www/usergen/secret/config.json", true));
|
||||||
|
|
||||||
|
require_once("/var/www/usergen/secret/helpers.php");
|
||||||
|
require_once("/var/www/usergen/secret/oauth.php");
|
||||||
|
require_once("/var/www/usergen/secret/rsa.php");
|
||||||
|
|
||||||
function checkParameters($parameterArray){
|
function checkParameters($parameterArray){
|
||||||
$error = false;
|
$error = false;
|
||||||
foreach($parameterArray as $parameter){
|
foreach($parameterArray as $parameter){
|
||||||
@ -18,12 +22,13 @@ function apiResult($result){
|
|||||||
exit();
|
exit();
|
||||||
}
|
}
|
||||||
|
|
||||||
function success(){
|
function success($encryptedToken){
|
||||||
apiResult(array("status" => true));
|
$Auth = verifyEncToken($encryptedToken);
|
||||||
|
returnSuccess(true, buildEncToken($Auth["AuthToken"], $Auth["UserID"], $_SERVER["REMOTE_ADDR"], $_SERVER["HTTP_USER_AGENT"]));
|
||||||
}
|
}
|
||||||
|
|
||||||
function error($error){
|
function error($error){
|
||||||
apiResult(array("status" => false, "error" => $error));
|
returnError($error);
|
||||||
}
|
}
|
||||||
|
|
||||||
function validateUsername($username){
|
function validateUsername($username){
|
||||||
@ -34,33 +39,30 @@ function validatePublicKey($key){
|
|||||||
return (preg_match("/^(ssh-rsa AAAAB3NzaC1yc2|ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNT|ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzOD|ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1Mj|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5|ssh-dss AAAAB3NzaC1kc3)[0-9A-Za-z+\/]+[=]{0,3}( .*)?$/", $key) == 1);
|
return (preg_match("/^(ssh-rsa AAAAB3NzaC1yc2|ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNT|ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzOD|ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1Mj|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5|ssh-dss AAAAB3NzaC1kc3)[0-9A-Za-z+\/]+[=]{0,3}( .*)?$/", $key) == 1);
|
||||||
}
|
}
|
||||||
|
|
||||||
if (checkParameters(array("pubkey", "userId", "authToken"))){
|
if (checkParameters(array("pubkey", "token"))){
|
||||||
error("Missing parameters");
|
error("Missing parameters");
|
||||||
}
|
}
|
||||||
|
|
||||||
$userToken = $_POST["authToken"];
|
$userToken = $_POST["token"];
|
||||||
$userId = $_POST["userId"];
|
|
||||||
$pubkey = $_POST["pubkey"];
|
$pubkey = $_POST["pubkey"];
|
||||||
|
|
||||||
if(!validatePublicKey($pubkey)){
|
if(!validatePublicKey($pubkey)){
|
||||||
error("Invalid public key");
|
error("Invalid public key");
|
||||||
}
|
}
|
||||||
|
|
||||||
$request = curl_init();
|
$User = verifyEncToken($userToken);
|
||||||
curl_setopt($request, CURLOPT_URL, "https://hackers.town/api/v1/accounts/verify_credentials");
|
|
||||||
curl_setopt($request, CURLOPT_RETURNTRANSFER, 1);
|
|
||||||
curl_setopt($request, CURLOPT_HTTPHEADER, array(
|
|
||||||
"Authorization: Bearer ".$userToken
|
|
||||||
));
|
|
||||||
$response = curl_exec($request);
|
|
||||||
curl_close($request);
|
|
||||||
$User = json_decode($response);
|
|
||||||
// Check User
|
// Check User
|
||||||
if($User->id != $userId){
|
|
||||||
error("User Mismatch");
|
if (gettype($User) == "string") {
|
||||||
|
// Invalid Token
|
||||||
|
error($User);
|
||||||
|
}else{
|
||||||
|
// Valid Token
|
||||||
|
$User = $User["MastodonData"];
|
||||||
}
|
}
|
||||||
|
|
||||||
if(!validateUsername($User->username)){
|
if(!validateUsername($User->username)){
|
||||||
error("Invalid Username");
|
error("Invalid POSIX Username");
|
||||||
}
|
}
|
||||||
// Create temporary pubkey holding file
|
// Create temporary pubkey holding file
|
||||||
$TempFileName = "/etc/ttyserver/tmp/".uniqid("ssh-", true).".pub";
|
$TempFileName = "/etc/ttyserver/tmp/".uniqid("ssh-", true).".pub";
|
||||||
@ -68,11 +70,11 @@ if(!file_put_contents($TempFileName, $pubkey."\n")){
|
|||||||
error("Key Addition Failed: Temp");
|
error("Key Addition Failed: Temp");
|
||||||
}
|
}
|
||||||
// Run User Generation Tool
|
// Run User Generation Tool
|
||||||
// TODO: Replace with custom Rust PHP Extension
|
// TODO: Replace with custom Rust PHP Extension?
|
||||||
$UserGenCode = shell_exec("/usr/bin/sudo /etc/ttyserver/bin/mkuser \"".$User->username."\" \"".$TempFileName."\" 2>&1; echo $?");
|
$UserGenCode = shell_exec("/usr/bin/sudo /etc/ttyserver/bin/mkuser \"".$User->username."\" \"".$TempFileName."\" 2>&1; echo $?");
|
||||||
if($UserGenCode != "0"){
|
if($UserGenCode != "0"){
|
||||||
error("Key Addition Failed: MK-".$UserGenCode);
|
error("Key Addition Failed: MK-".$UserGenCode);
|
||||||
}
|
}
|
||||||
success();
|
success($userToken);
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|||||||
16
elements/head.php
Normal file
16
elements/head.php
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
<Head>
|
||||||
|
<Title>HackersTown Server Access</Title>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
<base href="/auth"/>
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||||
|
<!-- Javascript -->
|
||||||
|
<script src="https://code.jquery.com/jquery-3.6.0.min.js" integrity="sha256-/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4=" crossorigin="anonymous"></script>
|
||||||
|
<script src="https://code.jquery.com/color/jquery.color.plus-names-2.1.2.min.js"></script>
|
||||||
|
<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
|
||||||
|
<script src="https://cdn.jsdelivr.net/npm/jszip@3.9.1/dist/jszip.min.js" integrity="sha256-aSPPIlJfSHQ5T7wunbPcp7tM0rlq5dHoUGeN8O5odMg=" crossorigin="anonymous"></script>
|
||||||
|
<script src="https://cdn.jsdelivr.net/npm/sweetalert2@11/dist/sweetalert2.all.min.js" crossorigin="anonymous"></script>
|
||||||
|
<script src="/fittext.js"></script>
|
||||||
|
<!-- Stylesheets -->
|
||||||
|
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">
|
||||||
|
<link href="/style.css" rel="stylesheet"/>
|
||||||
|
</Head>
|
||||||
9
elements/logo.php
Normal file
9
elements/logo.php
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
<div class="row">
|
||||||
|
<?php if(file_exists("/var/www/usergen/DOMAIN_OVERRIDE")){
|
||||||
|
echo "<a href=\"".file_get_contents("/var/www/usergen/DOMAIN_OVERRIDE")."\">";
|
||||||
|
}else{
|
||||||
|
echo "<a href=\"https://tty.hackers.town\">";
|
||||||
|
}?>
|
||||||
|
<img src="/Assets/HTown.png" class="logo self-align-center mx-auto d-block" alt="Hacker Town logo in ASCII art. Rendered as image to force correct visualization."/>
|
||||||
|
</a>
|
||||||
|
</div>
|
||||||
18
elements/oldError.php
Normal file
18
elements/oldError.php
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
<!-- Error Display -->
|
||||||
|
<div class="row"<?php if(strpos($AuthToken, "Bad") === false){
|
||||||
|
echo "hidden";
|
||||||
|
}?>>
|
||||||
|
<span>
|
||||||
|
Invalid
|
||||||
|
</span>
|
||||||
|
<span>
|
||||||
|
try again
|
||||||
|
</span>
|
||||||
|
<div id="ErrorResult" class="message">
|
||||||
|
<?php echo $ErrorDesc; ?>
|
||||||
|
</div>
|
||||||
|
</div><div class="row button"<?php if(strpos($AuthToken, "Bad") === false){
|
||||||
|
echo "hidden";
|
||||||
|
}?>>
|
||||||
|
<button class="col keyButton" onclick="beginOauth()">Retry</button>
|
||||||
|
</div>
|
||||||
8
elements/unauth.php
Normal file
8
elements/unauth.php
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
<div id="title" class="row center">
|
||||||
|
<span id="resizer">
|
||||||
|
<TTY ACCESS>
|
||||||
|
</span>
|
||||||
|
</div>
|
||||||
|
<div class="row button">
|
||||||
|
<button id="bttn" class="keyButton" onclick="beginOauth()">Log In With HTown <!-- img src="/Assets/HTown.png" class="emoji"/ --></button>
|
||||||
|
</div>
|
||||||
238
index.js
238
index.js
@ -2,50 +2,15 @@ var DEBUG = false;
|
|||||||
var isMobile = false;
|
var isMobile = false;
|
||||||
var USE_ORIGIN = "";
|
var USE_ORIGIN = "";
|
||||||
|
|
||||||
const dbp = (msg) => {
|
|
||||||
if(DEBUG){
|
|
||||||
console.log(msg);
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
const dbd = (msg) => {
|
|
||||||
if(DEBUG){
|
|
||||||
console.dir(msg);
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
const SwalConfig = {
|
const SwalConfig = {
|
||||||
color: "#79F257",
|
color: "#79F257",
|
||||||
background: "#022601",
|
background: "#022601",
|
||||||
buttonsStyling: false,
|
buttonsStyling: false,
|
||||||
}
|
}
|
||||||
|
|
||||||
const invalidChars = [
|
|
||||||
'/', '\\', '>',
|
|
||||||
'<', ':', '*',
|
|
||||||
'|', '"', '\'',
|
|
||||||
'?', '\0'
|
|
||||||
];
|
|
||||||
|
|
||||||
const replaceInvalid = (str) => {
|
|
||||||
var cache = str;
|
|
||||||
invalidChars.forEach(ch => {
|
|
||||||
cache = cache.replaceAll(ch, "#");
|
|
||||||
});
|
|
||||||
return cache;
|
|
||||||
}
|
|
||||||
|
|
||||||
const isOverflown = ({ clientHeight, scrollHeight }) => scrollHeight > clientHeight
|
const isOverflown = ({ clientHeight, scrollHeight }) => scrollHeight > clientHeight
|
||||||
|
|
||||||
const setCookie = (cname, cvalue, exdays) => {
|
|
||||||
const d = new Date();
|
|
||||||
d.setTime(d.getTime() + (exdays*24*60*60*1000));
|
|
||||||
let expires = "expires="+ d.toUTCString();
|
|
||||||
document.cookie = cname + "=" + cvalue + ";" + expires + ";SameSite=Strict;path=/auth";
|
|
||||||
}
|
|
||||||
|
|
||||||
const resizeText = ({ element, elements, minSize = 10, maxSize = 512, step = 1, unit = 'px' }) => {
|
const resizeText = ({ element, elements, minSize = 10, maxSize = 512, step = 1, unit = 'px' }) => {
|
||||||
dbp("Resize");
|
|
||||||
(elements || [element]).forEach(el => {
|
(elements || [element]).forEach(el => {
|
||||||
let i = minSize;
|
let i = minSize;
|
||||||
let overflow = false;
|
let overflow = false;
|
||||||
@ -60,19 +25,6 @@ const resizeText = ({ element, elements, minSize = 10, maxSize = 512, step = 1,
|
|||||||
});
|
});
|
||||||
}
|
}
|
||||||
|
|
||||||
const saveFile = (name, type, data) => {
|
|
||||||
if (data !== null && navigator.msSaveBlob)
|
|
||||||
return navigator.msSaveBlob(new Blob([data], { type: type }), name);
|
|
||||||
var a = $("<a style='display: none;'/>");
|
|
||||||
var url = window.URL.createObjectURL(new Blob([data], {type: type}));
|
|
||||||
a.attr("href", url);
|
|
||||||
a.attr("download", name);
|
|
||||||
$("body").append(a);
|
|
||||||
a[0].click();
|
|
||||||
window.URL.revokeObjectURL(url);
|
|
||||||
a.remove();
|
|
||||||
}
|
|
||||||
|
|
||||||
const disableNonDesktopElements = () => {
|
const disableNonDesktopElements = () => {
|
||||||
var disableElements = document.getElementsByClassName("desktopOnly");
|
var disableElements = document.getElementsByClassName("desktopOnly");
|
||||||
for(var i=0; i< disableElements.length; i++){
|
for(var i=0; i< disableElements.length; i++){
|
||||||
@ -94,140 +46,25 @@ const disableNonDesktopElements = () => {
|
|||||||
}
|
}
|
||||||
|
|
||||||
const failMsg = (msg) => {
|
const failMsg = (msg) => {
|
||||||
$("#resizer").html(msg);
|
|
||||||
$("#resizer").css("color", "#400112");
|
|
||||||
$("#resizer").css("background-color", "#79F257");
|
|
||||||
$("#resizer").animate({
|
|
||||||
color: "#79F257",
|
|
||||||
backgroundColor: "#022601"
|
|
||||||
}, 1000);
|
|
||||||
}
|
|
||||||
|
|
||||||
const validatePubKey = (key) => {
|
|
||||||
return /^(ssh-rsa AAAAB3NzaC1yc2|ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNT|ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzOD|ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1Mj|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5|ssh-dss AAAAB3NzaC1kc3)[0-9A-Za-z+\/]+[=]{0,3}( .*)?$/.test(key);
|
|
||||||
}
|
|
||||||
|
|
||||||
const sendSSH = (key, id, token) => {
|
|
||||||
var payload = {
|
|
||||||
pubkey: key,
|
|
||||||
userId: id,
|
|
||||||
authToken: token
|
|
||||||
};
|
|
||||||
$.post(USE_ORIGIN+"/auth/setKey.php", payload, (response) => {
|
|
||||||
dbp(response);
|
|
||||||
if(response.status){
|
|
||||||
Swal.fire({
|
|
||||||
...SwalConfig,
|
|
||||||
title: "Success!",
|
|
||||||
text: "Your key has been uploaded to the server."
|
|
||||||
}).then(()=>{
|
|
||||||
window.location.reload();
|
|
||||||
});
|
|
||||||
}else{
|
|
||||||
Swal.fire({
|
|
||||||
...SwalConfig,
|
|
||||||
title: "Failed!",
|
|
||||||
text: response.error
|
|
||||||
}).then(()=>{
|
|
||||||
window.location.reload();
|
|
||||||
});
|
|
||||||
}
|
|
||||||
}).fail((resp) => {
|
|
||||||
dbp("Failed");
|
|
||||||
dbd(resp);
|
|
||||||
Swal.fire({
|
|
||||||
...SwalConfig,
|
|
||||||
title: "Failed!",
|
|
||||||
text: resp.toString()
|
|
||||||
}).then(()=>{
|
|
||||||
window.location.reload();
|
|
||||||
});
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
const generateSSH = async (name, id, token) => {
|
|
||||||
dbp("Generate Key");
|
|
||||||
if (window.location.protocol === "http:") {
|
|
||||||
Swal.fire({
|
|
||||||
...SwalConfig,
|
|
||||||
title: "Error!",
|
|
||||||
text: "You must use HTTPS to generate keys."
|
|
||||||
});
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
generateKeyPair("RSASSA-PKCS1-v1_5", 4096, "WebGen " + Date())
|
|
||||||
.then((keys) => {
|
|
||||||
var KeyExport = new JSZip();
|
|
||||||
name = replaceInvalid(name);
|
|
||||||
KeyExport.file("HackersTownTTY-"+name, keys[0]);
|
|
||||||
KeyExport.file("HackersTownTTY-"+name+".pub", keys[1]);
|
|
||||||
KeyExport.generateAsync({type:"blob"})
|
|
||||||
.then((content) => {
|
|
||||||
saveFile("HackersTownTTY-"+name+".zip", "application/zip", content);
|
|
||||||
});
|
|
||||||
sendSSH(keys[1], id, token);
|
|
||||||
}).catch((err) => {
|
|
||||||
dbp(err);
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
const testSwal = () => {
|
|
||||||
Swal.fire({
|
Swal.fire({
|
||||||
...SwalConfig,
|
...SwalConfig,
|
||||||
title: "Success!",
|
title: "Error!",
|
||||||
|
text: msg,
|
||||||
});
|
});
|
||||||
}
|
}
|
||||||
|
|
||||||
const uploadSSH = (id, token) => {
|
|
||||||
//request local file
|
|
||||||
var kf = document.getElementById("keyfile");
|
|
||||||
kf.onchange = function(e) {
|
|
||||||
// File selected
|
|
||||||
var file = e.target.files[0];
|
|
||||||
if(file){
|
|
||||||
dbd(file);
|
|
||||||
var reader = new FileReader();
|
|
||||||
reader.readAsText(file, "UTF-8");
|
|
||||||
reader.onload = function (evt) {
|
|
||||||
var pubkey = evt.target.result;
|
|
||||||
pubkey = pubkey.replace(/\r\n/g, "\n");
|
|
||||||
dbp(pubkey);
|
|
||||||
pubkey = pubkey.replace(/\n/g, "");
|
|
||||||
dbp(pubkey);
|
|
||||||
if(validatePubKey(pubkey)){
|
|
||||||
sendSSH(pubkey, id, token);
|
|
||||||
}else{
|
|
||||||
failMsg("Invalid key");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
reader.onerror = function (evt) {
|
|
||||||
failMsg("Unable to load Keyfile");
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
}
|
|
||||||
kf.click();
|
|
||||||
}
|
|
||||||
|
|
||||||
const beginOauth = () => {
|
const beginOauth = () => {
|
||||||
dbp("Auth");
|
|
||||||
$.ajax({
|
$.ajax({
|
||||||
url: USE_ORIGIN+"/auth?act=id"
|
url: USE_ORIGIN+"/auth/api?act=id"
|
||||||
}).then((data) => {
|
}).then((data) => {
|
||||||
dbd(data);
|
|
||||||
if(data.id){
|
if(data.id){
|
||||||
var redirect = "https://hackers.town/oauth/authorize?"+
|
var redirect = "https://hackers.town/oauth/authorize?"+
|
||||||
"response_type=code&client_id="+data.id+"&redirect_uri="+
|
"response_type=code&client_id="+data.id+"&redirect_uri="+
|
||||||
USE_ORIGIN+"/auth&scope=read:accounts";
|
USE_ORIGIN+"/auth&scope=read:accounts";
|
||||||
dbp(redirect);
|
|
||||||
dbp(window.location.pathname);
|
|
||||||
if(window.location.pathname.includes("auth")){
|
|
||||||
setCookie("oa_retries", 0, 0.1);
|
|
||||||
}
|
|
||||||
window.location.href = redirect;
|
window.location.href = redirect;
|
||||||
}else{
|
}else{
|
||||||
// Auth Failed
|
// Auth Failed
|
||||||
failMsg("AUTH FAILED");
|
failMsg("Server ID Error");
|
||||||
}
|
}
|
||||||
});
|
});
|
||||||
}
|
}
|
||||||
@ -262,8 +99,9 @@ const displayFingerprints = () => {
|
|||||||
|
|
||||||
// On Page Load...
|
// On Page Load...
|
||||||
$(() => {
|
$(() => {
|
||||||
dbp("Begin Init Content");
|
if (localStorage.getItem("tty_token")) {
|
||||||
|
window.location.href = "/auth";
|
||||||
|
}
|
||||||
// Override domain
|
// Override domain
|
||||||
$.get("/DOMAIN_OVERRIDE", function (data) {
|
$.get("/DOMAIN_OVERRIDE", function (data) {
|
||||||
USE_ORIGIN = data.replaceAll("\n", "");
|
USE_ORIGIN = data.replaceAll("\n", "");
|
||||||
@ -272,41 +110,35 @@ $(() => {
|
|||||||
USE_ORIGIN = "https://tty.hackers.town";
|
USE_ORIGIN = "https://tty.hackers.town";
|
||||||
}).always(() => {
|
}).always(() => {
|
||||||
|
|
||||||
// Device Detection
|
// Device Detection
|
||||||
if (/(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|ipad|iris|kindle|Android|Silk|lge |maemo|midp|mmp|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows (ce|phone)|xda|xiino/i.test(navigator.userAgent) ||
|
if (/(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|ipad|iris|kindle|Android|Silk|lge |maemo|midp|mmp|netfront|opera m(ob|in)i|palm( os)?|phone|p(ixi|re)\/|plucker|pocket|psp|series(4|6)0|symbian|treo|up\.(browser|link)|vodafone|wap|windows (ce|phone)|xda|xiino/i.test(navigator.userAgent) ||
|
||||||
/1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|yas\-|your|zeto|zte\-/i.test(navigator.userAgent.substr(0, 4))) {
|
/1207|6310|6590|3gso|4thp|50[1-6]i|770s|802s|a wa|abac|ac(er|oo|s\-)|ai(ko|rn)|al(av|ca|co)|amoi|an(ex|ny|yw)|aptu|ar(ch|go)|as(te|us)|attw|au(di|\-m|r |s )|avan|be(ck|ll|nq)|bi(lb|rd)|bl(ac|az)|br(e|v)w|bumb|bw\-(n|u)|c55\/|capi|ccwa|cdm\-|cell|chtm|cldc|cmd\-|co(mp|nd)|craw|da(it|ll|ng)|dbte|dc\-s|devi|dica|dmob|do(c|p)o|ds(12|\-d)|el(49|ai)|em(l2|ul)|er(ic|k0)|esl8|ez([4-7]0|os|wa|ze)|fetc|fly(\-|_)|g1 u|g560|gene|gf\-5|g\-mo|go(\.w|od)|gr(ad|un)|haie|hcit|hd\-(m|p|t)|hei\-|hi(pt|ta)|hp( i|ip)|hs\-c|ht(c(\-| |_|a|g|p|s|t)|tp)|hu(aw|tc)|i\-(20|go|ma)|i230|iac( |\-|\/)|ibro|idea|ig01|ikom|im1k|inno|ipaq|iris|ja(t|v)a|jbro|jemu|jigs|kddi|keji|kgt( |\/)|klon|kpt |kwc\-|kyo(c|k)|le(no|xi)|lg( g|\/(k|l|u)|50|54|\-[a-w])|libw|lynx|m1\-w|m3ga|m50\/|ma(te|ui|xo)|mc(01|21|ca)|m\-cr|me(rc|ri)|mi(o8|oa|ts)|mmef|mo(01|02|bi|de|do|t(\-| |o|v)|zz)|mt(50|p1|v )|mwbp|mywa|n10[0-2]|n20[2-3]|n30(0|2)|n50(0|2|5)|n7(0(0|1)|10)|ne((c|m)\-|on|tf|wf|wg|wt)|nok(6|i)|nzph|o2im|op(ti|wv)|oran|owg1|p800|pan(a|d|t)|pdxg|pg(13|\-([1-8]|c))|phil|pire|pl(ay|uc)|pn\-2|po(ck|rt|se)|prox|psio|pt\-g|qa\-a|qc(07|12|21|32|60|\-[2-7]|i\-)|qtek|r380|r600|raks|rim9|ro(ve|zo)|s55\/|sa(ge|ma|mm|ms|ny|va)|sc(01|h\-|oo|p\-)|sdk\/|se(c(\-|0|1)|47|mc|nd|ri)|sgh\-|shar|sie(\-|m)|sk\-0|sl(45|id)|sm(al|ar|b3|it|t5)|so(ft|ny)|sp(01|h\-|v\-|v )|sy(01|mb)|t2(18|50)|t6(00|10|18)|ta(gt|lk)|tcl\-|tdg\-|tel(i|m)|tim\-|t\-mo|to(pl|sh)|ts(70|m\-|m3|m5)|tx\-9|up(\.b|g1|si)|utst|v400|v750|veri|vi(rg|te)|vk(40|5[0-3]|\-v)|vm40|voda|vulc|vx(52|53|60|61|70|80|81|83|85|98)|w3c(\-| )|webc|whit|wi(g |nc|nw)|wmlb|wonu|x700|yas\-|your|zeto|zte\-/i.test(navigator.userAgent.substr(0, 4))) {
|
||||||
isMobile = true;
|
isMobile = true;
|
||||||
}
|
|
||||||
// Adjust for Mobile
|
|
||||||
if(isMobile){
|
|
||||||
dbp("Is Mobile 👍🏻");
|
|
||||||
disableNonDesktopElements();
|
|
||||||
}
|
|
||||||
|
|
||||||
// Auto Retry
|
|
||||||
// TODO: Replace with redirect to home with logout set if error
|
|
||||||
var isRetry = false;
|
|
||||||
if(window.location.pathname.includes("auth")){
|
|
||||||
var ErrorMsg = document.getElementById("ErrorResult");
|
|
||||||
dbp(typeof ErrorMsg);
|
|
||||||
if(typeof ErrorMsg !== 'undefined' && ErrorMsg.innerText.includes("Retry")){
|
|
||||||
dbp("attempt retry");
|
|
||||||
isRetry = true;
|
|
||||||
beginOauth();
|
|
||||||
}
|
}
|
||||||
}
|
// Adjust for Mobile
|
||||||
|
if(isMobile){
|
||||||
// Console Welcome
|
disableNonDesktopElements();
|
||||||
if(!isRetry){
|
}
|
||||||
|
// Console Welcome
|
||||||
console.log("%cWelcome Hacker!", "color: #ff0000; font-size: 7em; font-style: italic; font-family: 'Times New Roman', Times, serif;");
|
console.log("%cWelcome Hacker!", "color: #ff0000; font-size: 7em; font-style: italic; font-family: 'Times New Roman', Times, serif;");
|
||||||
}
|
// Enable Extra Debug Stuff
|
||||||
|
if(DEBUG){
|
||||||
|
$('.debug').each((i,e)=>{
|
||||||
|
e.style.display = "unset";
|
||||||
|
});
|
||||||
|
}
|
||||||
|
var parameters = new URL(window.location.href).searchParams;
|
||||||
|
var message = parameters.get("msg");
|
||||||
|
var error = parameters.get("error");
|
||||||
|
if(error){
|
||||||
|
failMsg(error);
|
||||||
|
}
|
||||||
|
if(message){
|
||||||
|
Swal.fire({
|
||||||
|
...SwalConfig,
|
||||||
|
text: message
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
// Enable Extra Debug Stuff
|
})
|
||||||
if(DEBUG){
|
|
||||||
dbp("Debug Mode Enabled");
|
|
||||||
$('.debug').each((i,e)=>{
|
|
||||||
e.style.display = "unset";
|
|
||||||
});
|
|
||||||
}
|
|
||||||
})
|
|
||||||
});
|
});
|
||||||
|
|||||||
49
index.php
49
index.php
@ -2,56 +2,17 @@
|
|||||||
<!-- TODO: Add popup with error if passed to page -->
|
<!-- TODO: Add popup with error if passed to page -->
|
||||||
<?php
|
<?php
|
||||||
require_once("/var/www/usergen/secret/helpers.php");
|
require_once("/var/www/usergen/secret/helpers.php");
|
||||||
if (isset($_REQUEST["act"])){
|
|
||||||
switch($_REQUEST["act"]){
|
|
||||||
case "logout":
|
|
||||||
// Logout
|
|
||||||
clearCookies();
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
?>
|
?>
|
||||||
<HTML lang="en">
|
<HTML lang="en">
|
||||||
<Head>
|
<?php require("/var/www/usergen/elements/head.php"); ?>
|
||||||
<Title>HackersTown Server Access</Title>
|
|
||||||
<meta charset="utf-8">
|
|
||||||
<base href="/"/>
|
|
||||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
||||||
<!-- Javascript -->
|
|
||||||
<script src="https://code.jquery.com/jquery-3.6.0.min.js" integrity="sha256-/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4=" crossorigin="anonymous"></script>
|
|
||||||
<script src="https://code.jquery.com/color/jquery.color.plus-names-2.1.2.min.js"></script>
|
|
||||||
<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
|
|
||||||
<script src="https://cdn.jsdelivr.net/npm/sweetalert2@11/dist/sweetalert2.all.min.js" crossorigin="anonymous"></script>
|
|
||||||
<script src="/fittext.js"></script>
|
|
||||||
<script src="/index.js"></script>
|
|
||||||
<!-- Stylesheets -->
|
|
||||||
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">
|
|
||||||
<link href="/style.css" rel="stylesheet"/>
|
|
||||||
</Head>
|
|
||||||
<Body>
|
<Body>
|
||||||
|
<script src="/index.js"></script>
|
||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="desktopOnly col-4"></div>
|
<div class="desktopOnly col-4"></div>
|
||||||
<div id="content" class="col-4 center">
|
<div id="content" class="col-4 center">
|
||||||
<div class="row">
|
<?php require("/var/www/usergen/elements/logo.php"); ?>
|
||||||
<?php if(file_exists("/var/www/usergen/DOMAIN_OVERRIDE")){
|
<?php require("/var/www/usergen/elements/unauth.php"); ?>
|
||||||
echo "<a href=\"".str_replace("\n", "", file_get_contents("/var/www/usergen/DOMAIN_OVERRIDE"))."\">";
|
<?php require("/var/www/usergen/elements/footer.php"); ?>
|
||||||
}else{
|
|
||||||
echo "<a href=\"https://hackers.town\">";
|
|
||||||
}?>
|
|
||||||
<img src="/Assets/HTown.png" class="logo self-align-center mx-auto d-block" alt="Hacker Town logo in ASCII art. Rendered as image to force correct visualization."/>
|
|
||||||
</a>
|
|
||||||
</div>
|
|
||||||
<div id="title" class="row center">
|
|
||||||
<span id="resizer">
|
|
||||||
<TTY ACCESS>
|
|
||||||
</span>
|
|
||||||
</div>
|
|
||||||
<div class="row button">
|
|
||||||
<button id="bttn" class="keyButton" onclick="beginOauth()">Log In With HTown <!-- img src="/Assets/HTown.png" class="emoji"/ --></button>
|
|
||||||
</div>
|
|
||||||
<?php require("/var/www/usergen/footer.php"); ?>
|
|
||||||
</div>
|
</div>
|
||||||
<div class="desktopOnly col-4"></div>
|
<div class="desktopOnly col-4"></div>
|
||||||
</div>
|
</div>
|
||||||
|
|||||||
@ -19,4 +19,22 @@ function enableDebug(){
|
|||||||
ini_set('display_startup_errors', 1);
|
ini_set('display_startup_errors', 1);
|
||||||
error_reporting(E_ALL);
|
error_reporting(E_ALL);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function returnError($error){
|
||||||
|
if (gettype($error) == "object") {
|
||||||
|
$error = json_encode($error);
|
||||||
|
}
|
||||||
|
header('Content-type: application/json');
|
||||||
|
echo json_encode(array("error" => $error));
|
||||||
|
exit();
|
||||||
|
}
|
||||||
|
|
||||||
|
function returnSuccess($success, $refreshToken = ""){
|
||||||
|
header('Content-type: application/json');
|
||||||
|
echo json_encode(array(
|
||||||
|
"data" => $success,
|
||||||
|
"refreshToken" => $refreshToken
|
||||||
|
));
|
||||||
|
exit();
|
||||||
|
}
|
||||||
?>
|
?>
|
||||||
|
|||||||
@ -10,13 +10,6 @@ function verifyCredentials($Auth) {
|
|||||||
$response = curl_exec($request);
|
$response = curl_exec($request);
|
||||||
curl_close($request);
|
curl_close($request);
|
||||||
$User = json_decode($response);
|
$User = json_decode($response);
|
||||||
|
|
||||||
// if (isset($User->id)){
|
|
||||||
// // Congrats!
|
|
||||||
// $UserName = $User->display_name;
|
|
||||||
// $UserId = $User->id;
|
|
||||||
// }else{
|
|
||||||
// }
|
|
||||||
return (isset($User->error) ? $User->error : $User);
|
return (isset($User->error) ? $User->error : $User);
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -41,4 +34,9 @@ function oauthToken($AuthCode, $config){
|
|||||||
$Auth = json_decode($response);
|
$Auth = json_decode($response);
|
||||||
return (isset($Auth->error) ? $Auth->error_description : $Auth);
|
return (isset($Auth->error) ? $Auth->error_description : $Auth);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function getHello() {
|
||||||
|
$Welcomes = array("Welcome", "Dobrodošli", "Vitejte", "Welkom", "Tervetuloa", "Willkommen", "Fáilte", "Benvenuto", "Bienvenidos", "Välkommen", "ようこそ");
|
||||||
|
return $Welcomes[array_rand($Welcomes)];
|
||||||
|
}
|
||||||
?>
|
?>
|
||||||
|
|||||||
@ -38,6 +38,26 @@ function getFingerprint() {
|
|||||||
return $fingerprint;
|
return $fingerprint;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Object -> JSON -> Base84 -> Split -> Encrypt -> Combined -> re-base64 -> Sent
|
||||||
|
|
||||||
|
function encryptPayload($input){
|
||||||
|
$holdingArray = str_split(base64_encode($input), 64);
|
||||||
|
$holdingArray = array_map(function($value){
|
||||||
|
return encrypt($value);
|
||||||
|
}, $holdingArray);
|
||||||
|
$holdingArray = implode("%", $holdingArray);
|
||||||
|
return $holdingArray;
|
||||||
|
}
|
||||||
|
|
||||||
|
function decryptPayload($input){
|
||||||
|
$holdingArray = explode("%", $input);
|
||||||
|
$holdingArray = array_map(function($value){
|
||||||
|
return decrypt($value);
|
||||||
|
}, $holdingArray);
|
||||||
|
$holdingArray = implode("", $holdingArray);
|
||||||
|
return base64_decode($holdingArray);
|
||||||
|
}
|
||||||
|
|
||||||
function encrypt($input){
|
function encrypt($input){
|
||||||
// Encrypt with public key
|
// Encrypt with public key
|
||||||
ensureKey();
|
ensureKey();
|
||||||
@ -61,4 +81,56 @@ function decrypt($input){
|
|||||||
return $decrypted;
|
return $decrypted;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function buildEncToken($AuthToken, $UserID, $UserIP, $UserAgent ){
|
||||||
|
// Token Data:
|
||||||
|
// - HTown AuthToken
|
||||||
|
// - UserID
|
||||||
|
// - UserIP
|
||||||
|
// - UserAgent
|
||||||
|
// - Timestamp
|
||||||
|
$TokenData = array(
|
||||||
|
"AuthToken" => $AuthToken,
|
||||||
|
"UserID" => $UserID,
|
||||||
|
"UserIP" => $UserIP,
|
||||||
|
"UserAgent" => $UserAgent,
|
||||||
|
"Timestamp" => time() // Unix Time in Seconds
|
||||||
|
);
|
||||||
|
$TokenData = json_encode($TokenData);
|
||||||
|
$EncTokenData = encryptPayload($TokenData);
|
||||||
|
return $EncTokenData;
|
||||||
|
}
|
||||||
|
|
||||||
|
function verifyEncToken($EncTokenData){
|
||||||
|
$TokenData = decryptPayload($EncTokenData);
|
||||||
|
$TokenData = json_decode($TokenData);
|
||||||
|
if ($TokenData != null && isset($TokenData->AuthToken) && isset($TokenData->UserID) && isset($TokenData->UserIP) && isset($TokenData->UserAgent) && isset($TokenData->Timestamp)) {
|
||||||
|
// Valid Token
|
||||||
|
if (time() - $TokenData->Timestamp > 900) { // 15-minute max login session
|
||||||
|
// Token Expired
|
||||||
|
return "Login Expired";
|
||||||
|
}
|
||||||
|
if ($TokenData->UserIP != $_SERVER["REMOTE_ADDR"]) {
|
||||||
|
// IP Mismatch
|
||||||
|
return "IP Mismatch";
|
||||||
|
}
|
||||||
|
if ($TokenData->UserAgent != $_SERVER["HTTP_USER_AGENT"]) {
|
||||||
|
// User Agent Mismatch
|
||||||
|
return "UserAgent Mismatch";
|
||||||
|
}
|
||||||
|
$credentialResults = verifyCredentials($TokenData->AuthToken);
|
||||||
|
if (gettype($credentialResults) == "string") {
|
||||||
|
// Invalid AuthToken
|
||||||
|
return "Invalid Mastodon Account";
|
||||||
|
}
|
||||||
|
return array(
|
||||||
|
"AuthToken" => $TokenData->AuthToken,
|
||||||
|
"UserID" => $TokenData->UserID,
|
||||||
|
"MastodonData" => $credentialResults
|
||||||
|
);
|
||||||
|
}else{
|
||||||
|
// Invalid Token
|
||||||
|
return "Invalid Token";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
?>
|
?>
|
||||||
|
|||||||
63
send.php
63
send.php
@ -1,63 +0,0 @@
|
|||||||
<?php
|
|
||||||
|
|
||||||
// echo exec('whoami');
|
|
||||||
exit();
|
|
||||||
$z=1/0;
|
|
||||||
use Lrf141\OAuth2\Client\Provider\Mastodon;
|
|
||||||
$config = json_decode(file_get_contents("config.json", true));
|
|
||||||
|
|
||||||
session_start();
|
|
||||||
|
|
||||||
$origin = "https://tty.hackers.town";
|
|
||||||
if(file_exists("/var/www/usergen/DOMAIN_OVERRIDE")){
|
|
||||||
$origin = str_replace("\n", "", file_get_contents("/var/www/usergen/DOMAIN_OVERRIDE"));
|
|
||||||
}
|
|
||||||
|
|
||||||
$provider = new Mastodon([
|
|
||||||
'clientId' => $config.oauth.key,
|
|
||||||
'clientSecret' => $config.oauth.secret,
|
|
||||||
'redirectUri' => $origin.'/auth',
|
|
||||||
'instance' => 'https://hackers.town',
|
|
||||||
'scope' => 'read:accounts',
|
|
||||||
]);
|
|
||||||
|
|
||||||
|
|
||||||
if (!isset($_GET['code'])) {
|
|
||||||
|
|
||||||
$authUrl = $provider->getAuthorizationUrl();
|
|
||||||
|
|
||||||
$_SESSION['oauth2state'] = $provider->getState();
|
|
||||||
header('Location: '.$authUrl);
|
|
||||||
exit;
|
|
||||||
|
|
||||||
// Check given state against previously stored one to mitigate CSRF attack
|
|
||||||
} elseif (empty($_GET['state']) || ($_GET['state'] !== $_SESSION['oauth2state'])) {
|
|
||||||
|
|
||||||
unset($_SESSION['oauth2state']);
|
|
||||||
exit('Invalid state');
|
|
||||||
|
|
||||||
} else {
|
|
||||||
|
|
||||||
// Try to get an access token (using the authorization code grant)
|
|
||||||
$token = $provider->getAccessToken('authorization_code', [
|
|
||||||
'code' => $_GET['code']
|
|
||||||
]);
|
|
||||||
|
|
||||||
// Optional: Now you have a token you can look up a users profile data
|
|
||||||
try {
|
|
||||||
|
|
||||||
$user = $provider->getResourceOwner($token);
|
|
||||||
|
|
||||||
echo $user->getName();
|
|
||||||
|
|
||||||
} catch(Exception $e) {
|
|
||||||
|
|
||||||
|
|
||||||
exit('Oh dear...');
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
echo $token->getToken();
|
|
||||||
}
|
|
||||||
|
|
||||||
?>
|
|
||||||
Loading…
Reference in New Issue
Block a user