fix(vulnerability): properly change the totp code after disabling it

SoObjects/SOGo/SOGoUser.h

@@ -124,7 +124,8 @@
 
 - (BOOL) isSuperUser;
 - (BOOL) canAuthenticate;
-- (NSString *) totpKey;
+- (NSString *) totpKey: (bool) isCheck;
+- (NSString *) oldtotpKey;
 
 /* resource */
 - (BOOL) isResource;

SoObjects/SOGo/SOGoUser.m

@@ -1298,7 +1298,7 @@
   return [authValue boolValue];
 }
 
-- (NSString *) totpKey
+- (NSString *) totpKey: (bool) isCheck
 {
 #if defined(MFA_CONFIG)
   NSString *key, *result;
@@ -1307,6 +1307,51 @@
 
   size_t s_len, secret_len;
 
+  //Until 5.12.4, SOGo had two problems with totp:
+  // * It was not renew after a user disable it/renable it.
+  // * The length was too small: 12 instead of the recommanded 20
+
+  if(![_defaults totpEnabled])
+  {
+    //Totp was not enabled
+    //Only renew if this is not a check (happen when the user enable it for the first time and save its preferences
+    //the saveAction will check the totp code but [_defaults totpEnabled] is still False )
+    key = [[self userSettings] userCurrentTotpKey: !isCheck];
+  }
+  else
+  {
+    //Totp currently enabled
+    key = [[self userSettings] userCurrentTotpKey: NO];
+  }
+
+  s = [key UTF8String];
+  s_len = strlen(s);
+
+  oath_init();
+  oath_base32_encode(s,s_len, &secret, &secret_len);
+  oath_done();
+
+  result = [[NSString alloc] initWithBytesNoCopy: secret
+                                          length: secret_len
+                                        encoding: NSASCIIStringEncoding
+                                    freeWhenDone: YES];
+
+  return [result autorelease];
+#else
+  return nil;
+#endif
+}
+
+- (NSString *) oldtotpKey
+{
+#if defined(MFA_CONFIG)
+  //Was used before 5.12.5, is to not make obsolete totp profile set before
+  NSString *key, *result;
+  const char *s;
+  char *secret;
+
+  size_t s_len, secret_len;
+
   key = [[[self userSettings] userPrivateSalt] substringToIndex: 12];
   s = [key UTF8String];
   s_len = strlen(s);

SoObjects/SOGo/SOGoUserSettings.h

@@ -35,6 +35,8 @@
 - (NSArray *) subscribedCalendars;
 - (NSArray *) subscribedAddressBooks;
 - (NSString *) userPrivateSalt;
+- (NSString *) userCurrentTotpKey: (bool) renew;
+- (void) setTotpKey: (NSString* ) newKey;
 - (NSString *) userPublicSalt;
 - (void)enableForceResetPassword;
 - (void)disableForceResetPassword;

SoObjects/SOGo/SOGoUserSettings.m

@@ -116,6 +116,42 @@ static Class SOGoUserProfileKlass = Nil;
   return salt;
 }
 
+- (NSString *) userCurrentTotpKey: (bool) renew
+{
+  NSMutableDictionary *values;
+  NSString *key;
+
+  key = [[self dictionaryForKey: @"General"] objectForKey: @"totpKey"];
+
+  if (!key || renew)
+    {
+      key = [[[[NSProcessInfo processInfo] globallyUniqueString] asSHA1String] substringToIndex: 20];
+      values = [self objectForKey: @"General"];
+
+      if (!values)
+        values = [NSMutableDictionary dictionary];
+
+      [values setObject: key forKey: @"totpKey"];
+      [self setObject: values forKey: @"General"];
+      [self synchronize];
+    }
+
+  return key;
+}
+
+- (void) setTotpKey: (NSString* ) newKey
+{
+  NSMutableDictionary *values;
+  values = [self objectForKey: @"General"];
+
+  if (!values)
+    values = [NSMutableDictionary dictionary];
+
+  [values setObject: newKey forKey: @"totpKey"];
+  [self setObject: values forKey: @"General"];
+  [self synchronize];
+}
+
 - (void) enableForceResetPassword
 {
   [self setObject: [NSNumber numberWithInt:1]  forKey: @"ForceResetPassword"];