Browse Source

api: add workaround to disable OTP

Andrew Dolgov 8 years ago
parent
commit
02cd6de128
2 changed files with 40 additions and 36 deletions
  1. 2 0
      api/index.php
  2. 38 36
      classes/auth/internal.php

+ 2 - 0
api/index.php

@@ -14,6 +14,8 @@
 	require_once "db-prefs.php";
 	require_once "functions.php";
 
+	define('AUTH_DISABLE_OTP', true);
+
 	if (defined('ENABLE_GZIP_OUTPUT') && ENABLE_GZIP_OUTPUT &&
 			function_exists("ob_gzhandler")) {
 

+ 38 - 36
classes/auth/internal.php

@@ -9,43 +9,45 @@ class Auth_Internal extends Auth_Base {
 		$otp = db_escape_string($_REQUEST["otp"]);
 
 		if (get_schema_version($this->link) > 96) {
-			$result = db_query($this->link, "SELECT otp_enabled,salt FROM ttrss_users WHERE
-				login = '$login'");
-
-			if (db_num_rows($result) > 0) {
-				require_once "lib/otphp/vendor/base32.php";
-				require_once "lib/otphp/lib/otp.php";
-				require_once "lib/otphp/lib/totp.php";
-
-				$base32 = new Base32();
-
-				$otp_enabled = sql_bool_to_bool(db_fetch_result($result, 0, "otp_enabled"));
-				$secret = $base32->encode(sha1(db_fetch_result($result, 0, "salt")));
-
-				$topt = new \OTPHP\TOTP($secret);
-				$otp_check = $topt->now();
-
-				if ($otp_enabled) {
-					if ($otp) {
-						if ($otp != $otp_check) {
-							return false;
+			if (!defined('AUTH_DISABLE_OTP') || !AUTH_DISABLE_OTP) {
+				$result = db_query($this->link, "SELECT otp_enabled,salt FROM ttrss_users WHERE
+					login = '$login'");
+
+				if (db_num_rows($result) > 0) {
+					require_once "lib/otphp/vendor/base32.php";
+					require_once "lib/otphp/lib/otp.php";
+					require_once "lib/otphp/lib/totp.php";
+
+					$base32 = new Base32();
+
+					$otp_enabled = sql_bool_to_bool(db_fetch_result($result, 0, "otp_enabled"));
+					$secret = $base32->encode(sha1(db_fetch_result($result, 0, "salt")));
+
+					$topt = new \OTPHP\TOTP($secret);
+					$otp_check = $topt->now();
+
+					if ($otp_enabled) {
+						if ($otp) {
+							if ($otp != $otp_check) {
+								return false;
+							}
+						} else {
+							?><html>
+								<head><title>Tiny Tiny RSS</title></head>
+							<body>
+							<form method="POST">
+								<input type="hidden" name="login_action" value="do_login">
+								<input type="hidden" name="login" value="<?php echo htmlspecialchars($login) ?>">
+								<input type="hidden" name="password" value="<?php echo htmlspecialchars($password) ?>">
+
+								<label><?php echo __("Please enter your one time password:") ?></label>
+								<input type="password" size="6" name="otp"/>
+								<input type="submit" value="Continue"/>
+							</form>
+							</form>
+							<?php
+							exit;
 						}
-					} else {
-						?><html>
-							<head><title>Tiny Tiny RSS</title></head>
-						<body>
-						<form method="POST">
-							<input type="hidden" name="login_action" value="do_login">
-							<input type="hidden" name="login" value="<?php echo htmlspecialchars($login) ?>">
-							<input type="hidden" name="password" value="<?php echo htmlspecialchars($password) ?>">
-
-							<label><?php echo __("Please enter your one time password:") ?></label>
-							<input type="password" size="6" name="otp"/>
-							<input type="submit" value="Continue"/>
-						</form>
-						</form>
-						<?php
-						exit;
 					}
 				}
 			}