WordPress.org
Get WordPress

Plugin Directory

Changeset 833004


Ignore:
Timestamp:
01/04/2014 08:30:38 PM (12 years ago)
Author:
Henrik.Schack
Message:

Man-in-the-middle attack protection added.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • google-authenticator/trunk/google-authenticator.php

    r830737 r833004  
    55Description: Two-Factor Authentication for WordPress using the Android/iPhone/Blackberry app as One Time Password generator.
    66Author: Henrik Schack
    7 Version: 0.45
     7Version: 0.46
    88Author URI: http://henrik.schack.dk/
    99Compatibility: WordPress 3.8
    … …  
    7979 * Check the verification code entered by the user.
    8080 */
    81 function verify( $secretkey, $thistry, $relaxedmode ) {
     81function verify( $secretkey, $thistry, $relaxedmode, $lasttimeslot ) {
    8282
    8383    // Did the user enter 6 digits ?
    … …  
    118118        $value = $value % 1000000;
    119119        if ( $value === $thistry ) {
    120             return true;
     120            // Check for replay (Man-in-the-middle) attack
     121            if ( $lasttimeslot >= ($tm+$i) ) {
     122                return false;
     123            }
     124            // Return timeslot in which login happened.
     125            return $tm+$i;
    121126        }   
    122127    }
    … …  
    189194            $otp = '';
    190195        }
     196        // When was the last successful login performed ?
     197        $lasttimeslot = trim( get_user_option( 'googleauthenticator_lasttimeslot', $user->ID ) );
    191198        // Valid code ?
    192         if ( $this->verify( $GA_secret, $otp, $GA_relaxedmode ) ) {
     199        if ( $timeslot=$this->verify( $GA_secret, $otp, $GA_relaxedmode, $lasttimeslot ) ) {
     200            // Store the timeslot in which login was successful.
     201            update_user_option( $user->ID, 'googleauthenticator_lasttimeslot', $timeslot, true );
    193202            return $userstate;
    194203        } else {
    … …  
    211220            }   
    212221        }
    213     }       
     222    }
    214223    // Google Authenticator isn't enabled for this account,
    215224    // just resume normal authentication.
    … …  
    330339            jQuery('#GA_QR_INFO').show('slow');
    331340        });     
    332     }); 
    333    
     341    });
     342     
    334343    jQuery('#GA_description').bind('focus blur change keyup', function() {
    335344        chl=escape("otpauth://totp/"+jQuery('#GA_description').val()+"?secret="+jQuery('#GA_secret').val());
Note: See TracChangeset for help on using the changeset viewer.