geckon01/TwoFactorAuth
1
0
Fork 0
mirror of https://github.com/RobThree/TwoFactorAuth.git synced 2026-10-09 05:15:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

add php-cs-fixer

Browse Source
This commit is contained in:
Nicolas CARPi
2022-12-07 23:10:13 +01:00
parent a8c297c178
commit ac721e57b9
35 changed files with 215 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/TwoFactorAuth.php
+58 -58
View File
@@ -75,7 +75,7 @@ class TwoFactorAuth
$value = unpack('N', $hashpart); // Unpack binary value
$value = $value[1] & 0x7FFFFFFF; // Drop MSB, keep only 31 bits
return str_pad((string) ($value % pow(10, $this->digits)), $this->digits, '0', STR_PAD_LEFT);
return str_pad((string) ($value % 10** $this->digits), $this->digits, '0', STR_PAD_LEFT);
}
/**
@@ -100,26 +100,6 @@ class TwoFactorAuth
return $timeslice > 0;
}
/**
* Timing-attack safe comparison of 2 codes (see http://blog.ircmaxell.com/2014/11/its-all-about-time.html)
*/
private function codeEquals(string $safe, string $user): bool
{
if (function_exists('hash_equals')) {
return hash_equals($safe, $user);
}
// In general, it's not possible to prevent length leaks. So it's OK to leak the length. The important part is that
// we don't leak information about the difference of the two strings.
if (strlen($safe) === strlen($user)) {
$result = 0;
for ($i = 0; $i < strlen($safe); $i++) {
$result |= (ord($safe[$i]) ^ ord($user[$i]));
}
return $result === 0;
}
return false;
}
/**
* Get data-uri of QRCode
*/
@@ -144,7 +124,7 @@ class TwoFactorAuth
if ($timeproviders === null) {
$timeproviders = array(
new NTPTimeProvider(),
new HttpTimeProvider()
new HttpTimeProvider(),
);
}
@@ -164,16 +144,6 @@ class TwoFactorAuth
}
}
private function getTime(?int $time = null): int
{
return ($time === null) ? $this->getTimeProvider()->getTime() : $time;
}
private function getTimeSlice(?int $time = null, int $offset = 0): int
{
return (int) floor($time / $this->period) + ($offset * $this->period);
}
/**
* Builds a string to be encoded in a QR code
*/
@@ -187,32 +157,6 @@ class TwoFactorAuth
. '&digits=' . intval($this->digits);
}
private function base32Decode(string $value): string
{
if (strlen($value) == 0) {
return '';
}
if (preg_match('/[^' . preg_quote(self::$_base32dict) . ']/', $value) !== 0) {
throw new TwoFactorAuthException('Invalid base32 string');
}
$buffer = '';
foreach (str_split($value) as $char) {
if ($char !== '=') {
$buffer .= str_pad(decbin(self::$_base32lookup[$char]), 5, '0', STR_PAD_LEFT);
}
}
$length = strlen($buffer);
$blocks = trim(chunk_split(substr($buffer, 0, $length - ($length % 8)), 8, ' '));
$output = '';
foreach (explode(' ', $blocks) as $block) {
$output .= chr(bindec(str_pad($block, 8, '0', STR_PAD_RIGHT)));
}
return $output;
}
/**
* @throws TwoFactorAuthException
*/
@@ -256,4 +200,60 @@ class TwoFactorAuth
}
return $this->timeprovider;
}
/**
* Timing-attack safe comparison of 2 codes (see http://blog.ircmaxell.com/2014/11/its-all-about-time.html)
*/
private function codeEquals(string $safe, string $user): bool
{
if (function_exists('hash_equals')) {
return hash_equals($safe, $user);
}
// In general, it's not possible to prevent length leaks. So it's OK to leak the length. The important part is that
// we don't leak information about the difference of the two strings.
if (strlen($safe) === strlen($user)) {
$result = 0;
for ($i = 0; $i < strlen($safe); $i++) {
$result |= (ord($safe[$i]) ^ ord($user[$i]));
}
return $result === 0;
}
return false;
}
private function getTime(?int $time = null): int
{
return ($time === null) ? $this->getTimeProvider()->getTime() : $time;
}
private function getTimeSlice(?int $time = null, int $offset = 0): int
{
return (int) floor($time / $this->period) + ($offset * $this->period);
}
private function base32Decode(string $value): string
{
if (strlen($value) == 0) {
return '';
}
if (preg_match('/[^' . preg_quote(self::$_base32dict) . ']/', $value) !== 0) {
throw new TwoFactorAuthException('Invalid base32 string');
}
$buffer = '';
foreach (str_split($value) as $char) {
if ($char !== '=') {
$buffer .= str_pad(decbin(self::$_base32lookup[$char]), 5, '0', STR_PAD_LEFT);
}
}
$length = strlen($buffer);
$blocks = trim(chunk_split(substr($buffer, 0, $length - ($length % 8)), 8, ' '));
$output = '';
foreach (explode(' ', $blocks) as $block) {
$output .= chr(bindec(str_pad($block, 8, '0', STR_PAD_RIGHT)));
}
return $output;
}
}