feat(preferences): Improve TOTP - add validation code in preferences before saving to ensure user add qr code in totp application

2026-09-27 16:10:35 +00:00 · 2023-01-04 17:37:46 +01:00
parent 7d72fe1281
commit 0bd530ab64
5 changed files with 91 additions and 1 deletions
@@ -53,6 +53,10 @@

 #import "UIxPreferences.h"

+#if defined(MFA_CONFIG)
+#include <liboath/oath.h>
+#endif
+
 static NSArray *reminderItems = nil;
 static NSArray *reminderValues = nil;

@@ -1586,6 +1590,69 @@ static NSArray *reminderValues = nil;
            }
        }

+
+#if defined(MFA_CONFIG)
+      // Check TOTP token
+      NSString *verificationCode;
+
+      if ([v objectForKey: @"SOGoTOTPEnabled"]
+          && 1 == [[v objectForKey: @"SOGoTOTPEnabled"] intValue]
+          && ![[user userDefaults] totpEnabled]) {
+        
+        verificationCode = [v objectForKey: @"totpVerificationCode"];
+
+        if ([verificationCode length] == 6 && [verificationCode unsignedIntValue] > 0)
+            {
+              unsigned int code;
+              const char *real_secret;
+              char *secret;
+
+              size_t secret_len;
+
+              const auto time_step = OATH_TOTP_DEFAULT_TIME_STEP_SIZE;
+              const auto digits = 6;
+
+              real_secret = [[user totpKey] UTF8String];
+
+              auto result = oath_init();
+              auto t = time(NULL);
+              auto left = time_step - (t % time_step);
+
+              char otp[digits + 1];
+
+              oath_base32_decode (real_secret,
+                                  strlen(real_secret),
+                                  &secret, &secret_len);
+
+              result = oath_totp_generate2(secret,
+                                           secret_len,
+                                           t,
+                                           time_step,
+                                           OATH_TOTP_DEFAULT_START_TIME,
+                                           digits,
+                                           0,
+                                           otp);
+
+              sscanf(otp, "%u", &code);
+
+              oath_done();
+              free(secret);
+
+              if (code != [verificationCode unsignedIntValue])
+                {
+                  results = (id <WOActionResults>) [self responseWithStatus: 485
+                         andJSONRepresentation: [NSDictionary dictionaryWithObjectsAndKeys: @"Invalid TOTP verification code", @"message", nil]];
+                  return results;
+                }
+            } else {
+              results = (id <WOActionResults>) [self responseWithStatus: 485
+                         andJSONRepresentation: [NSDictionary dictionaryWithObjectsAndKeys: @"Invalid TOTP verification code", @"message", nil]];
+              return results;
+            }
+      }
+      [v removeObjectForKey: @"totpVerificationCode"];
+#endif
+
      [[[user userDefaults] source] setValues: v];

      if ([[user userDefaults] synchronize] && [self userHasMailAccess])