WordPress.org
Get WordPress

Plugin Directory

Changeset 837308


Ignore:
Timestamp:
01/12/2014 07:03:49 PM (12 years ago)
Author:
Henrik.Schack
Message:

0.47 More privacy, more translations

File:
1 edited

Legend:

Unmodified
Added
Removed

  • google-authenticator/trunk/google-authenticator.php

    r834053 r837308  
    55Description: Two-Factor Authentication for WordPress using the Android/iPhone/Blackberry app as One Time Password generator.
    66Author: Henrik Schack
    7 Version: 0.46
     7Version: 0.47
    88Author URI: http://henrik.schack.dk/
    99Compatibility: WordPress 3.8
    … …  
    2323    Thanks to Kimmo Suominen for fixing the iPhone description issue.
    2424    Thanks to Alex Concha for some security tips.
     25    Thanks to Sébastien Prunier for his Spanish and French translations.
    2526
    2627----------------------------------------------------------------------------
    … …  
    6566    add_filter( 'authenticate', array( $this, 'check_otp' ), 50, 3 );
    6667
    67     if ( defined( 'DOING_AJAX' ) && DOING_AJAX )
     68    if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
    6869        add_action( 'wp_ajax_GoogleAuthenticator_action', array( $this, 'ajax_callback' ) );
     70    }
    6971
    7072    add_action( 'personal_options_update', array( $this, 'personal_options_update' ) );
    … …  
    7375    add_action( 'edit_user_profile_update', array( $this, 'edit_user_profile_update' ) );
    7476
     77    add_action('admin_enqueue_scripts', array($this, 'add_qrcode_script'));
     78
    7579    load_plugin_textdomain( 'google-authenticator', false, basename( dirname( __FILE__ ) ) . '/lang' );
    7680}
     81
    7782
    7883/**
    … …  
    123128            // last successful login.
    124129            if ( $lasttimeslot >= ($tm+$i) ) {
     130                error_log("Google Authenticator plugin: Man-in-the-middle attack detected (Could also be 2 legit login attempts within the same 30 second period)");
    125131                return false;
    126132            }
    127133            // Return timeslot in which login happened.
    128134            return $tm+$i;
    129         }   
     135        }
    130136    }
    131137    return false;
    … …  
    146152}
    147153
     154/**
     155 * Add the script to generate QR codes.
     156 */
     157function add_qrcode_script() {
     158    wp_enqueue_script('jquery');
     159    wp_register_script('qrcode_script', plugins_url('jquery.qrcode.min.js', __FILE__),array("jquery"));
     160    wp_enqueue_script('qrcode_script');
     161}
    148162
    149163/**
    … …  
    292306        echo "<input name=\"GA_secret\" id=\"GA_secret\" value=\"{$GA_secret}\" readonly=\"readonly\"  type=\"text\" size=\"25\" />";
    293307        echo "<input name=\"GA_newsecret\" id=\"GA_newsecret\" value=\"".__("Create new secret",'google-authenticator')."\"   type=\"button\" class=\"button\" />";
    294         echo "<input name=\"show_qr\" id=\"show_qr\" value=\"".__("Show/Hide QR code",'google-authenticator')."\"   type=\"button\" class=\"button\" onclick=\"ShowQRCodeAfterWarning();\" />";
     308        echo "<input name=\"show_qr\" id=\"show_qr\" value=\"".__("Show/Hide QR code",'google-authenticator')."\"   type=\"button\" class=\"button\" onclick=\"ShowOrHideQRCode();\" />";
    295309        echo "</td>\n";
    296310        echo "</tr>\n";
    … …  
    299313        echo "<th></th>\n";
    300314        echo "<td><div id=\"GA_QR_INFO\" style=\"display: none\" >";
    301         echo "<img id=\"GA_QRCODE\"  src=\"\" alt=\"QR Code\"/>";
     315        echo "<div id=\"GA_QRCODE\"/></div>";
    302316
    303317        echo '<span class="description"><br/> ' . __( 'Scan this with the Google Authenticator app.', 'google-authenticator' ) . '</span>';
    … …  
    317331        echo "<input name=\"GA_password\" id=\"GA_password\" readonly=\"readonly\" value=\"".$GA_password."\" type=\"text\" size=\"25\" />";
    318332        echo "<input name=\"GA_createpassword\" id=\"GA_createpassword\" value=\"".__("Create new password",'google-authenticator')."\"   type=\"button\" class=\"button\" />";
    319         echo "<span class=\"description\" id=\"GA_passworddesc\">".__(' Password is not stored in cleartext, this is your only chance to see it.','google-authenticator')."</span>\n";
     333        echo "<span class=\"description\" id=\"GA_passworddesc\"> ".__(' Password is not stored in cleartext, this is your only chance to see it.','google-authenticator')."</span>\n";
    320334        echo "</td>\n";
    321335        echo "</tr>\n";
    322336    }
    323    
    324337
    325338    echo "</tbody></table>\n";
    … …  
    327340    echo "var GAnonce='".wp_create_nonce('GoogleAuthenticatoraction')."';\n";
    328341
    329     echo "var qrcodewarningtext = '";
    330     echo __( "WARNING:\\n\\nShowing the QR code will use the Google Chart API to do so.\\nIf you do not trust Google, please press Cancel and enter the code manually.",'google-authenticator' );
    331     echo "';\n";
    332 
    333342    echo <<<ENDOFJS
    334     var pwdata;
     343    //Create new secret and display it
    335344    jQuery('#GA_newsecret').bind('click', function() {
     345        // Remove existing QRCode
     346        jQuery('#GA_QRCODE').html("");
    336347        var data=new Object();
    337348        data['action']  = 'GoogleAuthenticator_action';
    … …  
    339350        jQuery.post(ajaxurl, data, function(response) {
    340351            jQuery('#GA_secret').val(response['new-secret']);
    341             chl=escape("otpauth://totp/"+jQuery('#GA_description').val()+"?secret="+jQuery('#GA_secret').val());
    342             qrcodeurl="https://chart.googleapis.com/chart?cht=qr&chs=300x300&chld=H|0&chl="+chl;
    343             jQuery('#GA_QRCODE').attr('src',qrcodeurl);
    344             jQuery('#GA_QR_INFO').show('slow');
     352            var qrcode="otpauth://totp/WordPress:"+escape(jQuery('#GA_description').val())+"?secret="+jQuery('#GA_secret').val()+"&issuer=WordPress";
     353            jQuery('#GA_QRCODE').qrcode(qrcode);
     354            jQuery('#GA_QR_INFO').show('slow');
    345355        });     
    346356    });
    347357
     358    // If the user starts modifying the description, hide the qrcode
    348359    jQuery('#GA_description').bind('focus blur change keyup', function() {
    349         // Only update QRCode if it's already visible
     360        // Only remove QR Code if it's visible
    350361        if (jQuery('#GA_QR_INFO').is(':visible')) {
    351             chl=escape("otpauth://totp/"+jQuery('#GA_description').val()+"?secret="+jQuery('#GA_secret').val());
    352             qrcodeurl="https://chart.googleapis.com/chart?cht=qr&chs=300x300&chld=H|0&chl="+chl;
    353             jQuery('#GA_QRCODE').attr('src',qrcodeurl);
     362            jQuery('#GA_QR_INFO').hide('slow');
     363            jQuery('#GA_QRCODE').html("");
    354364        }
    355365    });
    356366
     367    // Create new app password
    357368    jQuery('#GA_createpassword').bind('click',function() {
    358369        var data=new Object();
    … …  
    386397    }
    387398
    388     function ShowQRCodeAfterWarning() {
     399    function ShowOrHideQRCode() {
    389400        if (jQuery('#GA_QR_INFO').is(':hidden')) {
    390             if ( confirm(qrcodewarningtext) ) {
    391                 chl=escape("otpauth://totp/"+jQuery('#GA_description').val()+"?secret="+jQuery('#GA_secret').val());
    392                 qrcodeurl="https://chart.googleapis.com/chart?cht=qr&chs=300x300&chld=H|0&chl="+chl;
    393                 jQuery('#GA_QRCODE').attr('src',qrcodeurl);
    394                 jQuery('#GA_QR_INFO').show('slow');
    395             }
     401            var qrcode="otpauth://totp/WordPress:"+escape(jQuery('#GA_description').val())+"?secret="+jQuery('#GA_secret').val()+"&issuer=WordPress";
     402            jQuery('#GA_QRCODE').qrcode(qrcode);
     403            jQuery('#GA_QR_INFO').show('slow');
    396404        } else {
    397405            jQuery('#GA_QR_INFO').hide('slow');
     406            jQuery('#GA_QRCODE').html("");
    398407        }
    399408    }
    … …  
    517526    global $user_id;
    518527
    519     // Some AJAX security
     528    // Some AJAX security.
    520529    check_ajax_referer( 'GoogleAuthenticatoraction', 'nonce' );
    521530   
    522     // Create new secret, using the users password hash as input for further hashing
     531    // Create new secret.
    523532    $secret = $this->create_secret();
    524533
Note: See TracChangeset for help on using the changeset viewer.