fix(web): use a distinct salt for TOTP authentication

If TOTP is enabled for a user, it will be disabled until the user
configure it again, which will generate a new private salt.

SoObjects/Appointments/SOGoCalendarComponent.m

@@ -234,7 +234,7 @@
 
   tags = [NSArray arrayWithObjects: @"DTSTAMP", @"DTSTART", @"DTEND", @"DUE", @"EXDATE", @"EXRULE", @"RRULE", @"RECURRENCE-ID", nil];
   uid = [[component uid] asCryptedPassUsingScheme: @"ssha256"
-                                         withSalt: [[settings userSalt] dataUsingEncoding: NSASCIIStringEncoding]
+                                         withSalt: [[settings userPublicSalt] dataUsingEncoding: NSASCIIStringEncoding]
                                       andEncoding: encHex
                                           keyPath: nil];
 

SoObjects/SOGo/SOGoUser.m

@@ -1138,7 +1138,7 @@
 
   size_t s_len, secret_len;
 
-  key = [[[self userSettings] userSalt] substringToIndex: 12];
+  key = [[[self userSettings] userPrivateSalt] substringToIndex: 12];
   s = [key UTF8String];
   s_len = strlen(s);
 

SoObjects/SOGo/SOGoUserSettings.h

@@ -1,6 +1,6 @@
 /* SOGoUserSettings.h - this file is part of SOGo
  *
- * Copyright (C) 2009-2016 Inverse inc.
+ * Copyright (C) 2009-2021 Inverse inc.
  *
  * This file is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -33,7 +33,8 @@
 
 - (NSArray *) subscribedCalendars;
 - (NSArray *) subscribedAddressBooks;
-- (NSString *) userSalt;
+- (NSString *) userPrivateSalt;
+- (NSString *) userPublicSalt;
 
 @end
 

SoObjects/SOGo/SOGoUserSettings.m

@@ -1,6 +1,6 @@
 /* SOGoUserSettings.m - this file is part of SOGo
  *
- * Copyright (C) 2009-2016 Inverse inc.
+ * Copyright (C) 2009-2021 Inverse inc.
  *
  * This file is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -70,7 +70,7 @@ static Class SOGoUserProfileKlass = Nil;
   return [self _subscribedFoldersForModule: @"Contacts"];
 }
 
-- (NSString *) userSalt
+- (NSString *) userPublicSalt
 {
   NSMutableDictionary *values;
   NSString *salt;
@@ -93,5 +93,27 @@ static Class SOGoUserProfileKlass = Nil;
   return salt;
 }
 
+- (NSString *) userPrivateSalt
+{
+  NSMutableDictionary *values;
+  NSString *salt;
+
+  salt = [[self dictionaryForKey: @"General"] objectForKey: @"PrivateSalt"];
+
+  if (!salt)
+    {
+      salt = [[[NSProcessInfo processInfo] globallyUniqueString] asSHA1String];
+      values = [self objectForKey: @"General"];
+
+      if (!values)
+        values = [NSMutableDictionary dictionary];
+
+      [values setObject: salt  forKey: @"PrivateSalt"];
+      [self setObject:  values forKey: @"General"];
+      [self synchronize];
+    }
+
+  return salt;
+}
 
 @end