diff --git a/login.php b/login.php
index 0e88297b..4ac43edd 100644
--- a/login.php
+++ b/login.php
@@ -12,6 +12,20 @@ include("functions.php");
$ip = strip_tags(mysqli_real_escape_string($mysqli,get_ip()));
$user_agent = strip_tags(mysqli_real_escape_string($mysqli,$_SERVER['HTTP_USER_AGENT']));
+// Query Settings for "default" company (as companies are being removed shortly)
+$sql_settings = mysqli_query($mysqli,"SELECT * FROM settings WHERE company_id = 1");
+$row = mysqli_fetch_array($sql_settings);
+
+// Mail
+$config_smtp_host = $row['config_smtp_host'];
+$config_smtp_port = $row['config_smtp_port'];
+$config_smtp_encryption = $row['config_smtp_encryption'];
+$config_smtp_username = $row['config_smtp_username'];
+$config_smtp_password = $row['config_smtp_password'];
+$config_mail_from_email = $row['config_mail_from_email'];
+$config_mail_from_name = $row['config_mail_from_name'];
+
+
// HTTP-Only cookies
ini_set("session.cookie_httponly", True);
@@ -48,47 +62,64 @@ if (isset($_POST['login'])) {
// Passed login brute force check
$email = strip_tags(mysqli_real_escape_string($mysqli, $_POST['email']));
$password = $_POST['password'];
+
+ $current_code = 0; // Default value
if (isset($_POST['current_code'])) {
$current_code = strip_tags(mysqli_real_escape_string($mysqli, $_POST['current_code']));
}
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN user_settings on users.user_id = user_settings.user_id WHERE user_email = '$email' AND user_archived_at IS NULL AND user_status = 1"));
+
+ // Check password
if ($row && password_verify($password, $row['user_password'])) {
- // User variables
- $token = $row['user_token'];
+ // User password correct (partial login)
+
+ // Set temporary user variables
$user_name = strip_tags(mysqli_real_escape_string($mysqli, $row['user_name']));
$user_id = $row['user_id'];
+ $user_email = $row['user_email'];
+ $token = $row['user_token'];
- // Session info
- $_SESSION['user_id'] = $user_id;
- $_SESSION['user_name'] = $user_name;
- $_SESSION['user_role'] = $row['user_role'];
- $_SESSION['csrf_token'] = bin2hex(random_bytes(78));
+ // Checking for user 2FA
+ require_once("rfc6238.php");
+ if (empty($token) || TokenAuth6238::verify($token, $current_code)) {
- // Setup encryption session key
- if (isset($row['user_specific_encryption_ciphertext']) && $row['user_role'] > 1) {
- $user_encryption_ciphertext = $row['user_specific_encryption_ciphertext'];
- $site_encryption_master_key = decryptUserSpecificKey($user_encryption_ciphertext, $password);
- generateUserSessionKey($site_encryption_master_key);
+ // FULL LOGIN SUCCESS - 2FA not configured or was successful
- // Setup extension
- if (isset($row['user_extension_key']) && !empty($row['user_extension_key'])) {
- // Extension cookie
- // Note: Browsers don't accept cookies with SameSite None if they are not HTTPS.
- setcookie("user_extension_key", "$row[user_extension_key]", ['path' => '/', 'secure' => true, 'httponly' => true, 'samesite' => 'None']);
-
- // Set PHP session in DB so we can access the session encryption data (above)
- $user_php_session = session_id();
- mysqli_query($mysqli, "UPDATE users SET user_php_session = '$user_php_session' WHERE user_id = '$user_id'");
+ // Determine whether 2FA was used (for logs)
+ $extended_log = ''; // Default value
+ if ($current_code !== 0 ) {
+ $extended_log = 'with 2FA';
}
- }
- if (empty($token)) {
- // Full Login successful
+ // Logging successful login
+ mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = 'Success', log_description = '$user_name successfully logged in $extended_log', log_ip = '$ip', log_user_agent = '$user_agent', log_user_id = $user_id");
+ // Session info
+ $_SESSION['user_id'] = $user_id;
+ $_SESSION['user_name'] = $user_name;
+ $_SESSION['user_role'] = $row['user_role'];
+ $_SESSION['csrf_token'] = bin2hex(random_bytes(78));
$_SESSION['logged'] = TRUE;
- mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = 'Success', log_description = '$user_name successfully logged in', log_ip = '$ip', log_user_agent = '$user_agent', log_user_id = $user_id");
+
+ // Setup encryption session key
+ if (isset($row['user_specific_encryption_ciphertext']) && $row['user_role'] > 1) {
+ $user_encryption_ciphertext = $row['user_specific_encryption_ciphertext'];
+ $site_encryption_master_key = decryptUserSpecificKey($user_encryption_ciphertext, $password);
+ generateUserSessionKey($site_encryption_master_key);
+
+ // Setup extension
+ if (isset($row['user_extension_key']) && !empty($row['user_extension_key'])) {
+ // Extension cookie
+ // Note: Browsers don't accept cookies with SameSite None if they are not HTTPS.
+ setcookie("user_extension_key", "$row[user_extension_key]", ['path' => '/', 'secure' => true, 'httponly' => true, 'samesite' => 'None']);
+
+ // Set PHP session in DB so we can access the session encryption data (above)
+ $user_php_session = session_id();
+ mysqli_query($mysqli, "UPDATE users SET user_php_session = '$user_php_session' WHERE user_id = '$user_id'");
+ }
+ }
// Show start page/dashboard depending on role
if ($row['user_role'] == 2) {
@@ -97,53 +128,59 @@ if (isset($_POST['login'])) {
header("Location: dashboard_financial.php");
}
+
} else {
- // Prompt for MFA
- $token_field = "
-
-
-
-
-
-
-
";
+ // MFA is configured and needs to be confirmed, or was unsuccessful
- require_once("rfc6238.php");
+ // HTML code for the token input field
+ $token_field = "
+
+
+
+
+
+
+
+
";
- if (TokenAuth6238::verify($token, $current_code)) {
- // Full login (with MFA) successful
- $_SESSION['logged'] = TRUE;
- mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login 2FA', log_action = 'Success', log_description = '$user_name successfully logged in using 2FA', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW(), log_user_id = $user_id");
+ // Log/notify if MFA was unsuccessful
+ if ($current_code !== 0) {
- // Show start page/dashboard depending on role
- if ($row['user_role'] == 2) {
- header("Location: dashboard_technical.php");
- } else {
- header("Location: dashboard_financial.php");
- }
-
- } else {
+ // Logging
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Login', log_action = '2FA Failed', log_description = '$user_name failed 2FA', log_ip = '$ip', log_user_agent = '$user_agent', log_created_at = NOW(), log_user_id = $user_id");
+ // Email the tech to advise their credentials may be compromised
+ if (!empty($config_smtp_host)) {
+ $subject = "Important: ITFlow failed 2FA login attempt for $user_name";
+ $body = "Hi $user_name,
A recent login to ITFlow was unsuccessful due to an incorrect 2FA code. If you did not attempt this login, your credentials may be compromised.