@@ -460,7 +611,7 @@ function showSection(section) {
// On page load, check URL hash and show that section
document.addEventListener('DOMContentLoaded', function() {
const hash = window.location.hash.substring(1); // Remove #
- const validSections = ['profile', 'security', 'sessions', 'danger'];
+ const validSections = ['profile', 'security', 'twofactor', 'sessions', 'danger'];
if (hash && validSections.includes(hash)) {
showSection(hash);
@@ -477,8 +628,63 @@ function confirmDelete() {
}
}
}
+
+function showDisable2FAModal() {
+ document.getElementById('disable2FAModal').classList.remove('hidden');
+ document.getElementById('disable2FACode').focus();
+}
+
+function hideDisable2FAModal() {
+ document.getElementById('disable2FAModal').classList.add('hidden');
+ document.getElementById('disable2FAForm').reset();
+}
+
+
+
+
+
+
+
+
+
Disable Two-Factor Authentication
+
+ This will make your account less secure. Enter your 2FA code to confirm.
+
+
+
+
+
+
+
$preset) {
Configure CAPTCHA protection for authentication forms
+
+
+
diff --git a/composer.json b/composer.json
index 7c9296f..c2e3c30 100644
--- a/composer.json
+++ b/composer.json
@@ -24,7 +24,9 @@
"ext-pdo": "*",
"vlucas/phpdotenv": "^5.5",
"phpmailer/phpmailer": "^6.8",
- "guzzlehttp/guzzle": "^7.8"
+ "guzzlehttp/guzzle": "^7.8",
+ "pragmarx/google2fa": "^8.0",
+ "endroid/qr-code": "^4.8"
},
"autoload": {
"psr-4": {
diff --git a/core/Auth.php b/core/Auth.php
index 2a2d770..bb8ef20 100644
--- a/core/Auth.php
+++ b/core/Auth.php
@@ -9,7 +9,7 @@ class Auth
*/
public static function check(): bool
{
- return isset($_SESSION['user_id']);
+ return isset($_SESSION['user_id']) && !isset($_SESSION['2fa_required']);
}
/**
@@ -53,7 +53,9 @@ class Auth
'/reset-password',
'/verify-email',
'/resend-verification',
- '/install'
+ '/install',
+ '/2fa/verify',
+ '/2fa/send-email-code'
];
// Don't redirect if on a public path
@@ -64,8 +66,13 @@ class Auth
}
if (!self::check()) {
- $_SESSION['error'] = 'Please login to continue';
- header('Location: /login');
+ if (isset($_SESSION['user_id']) && self::requiresTwoFactor()) {
+ $_SESSION['error'] = 'Please complete two-factor authentication';
+ header('Location: /2fa/verify');
+ } else {
+ $_SESSION['error'] = 'Please login to continue';
+ header('Location: /login');
+ }
exit;
}
}
@@ -101,5 +108,13 @@ class Auth
{
return $_SESSION['role'] ?? null;
}
+
+ /**
+ * Check if 2FA verification is required
+ */
+ public static function requiresTwoFactor(): bool
+ {
+ return isset($_SESSION['2fa_required']) && $_SESSION['2fa_required'];
+ }
}
diff --git a/database/migrations/017_add_two_factor_authentication.sql b/database/migrations/017_add_two_factor_authentication.sql
new file mode 100644
index 0000000..fee8869
--- /dev/null
+++ b/database/migrations/017_add_two_factor_authentication.sql
@@ -0,0 +1,44 @@
+-- Add Two-Factor Authentication (2FA) support
+-- TOTP (Time-based One-Time Password) implementation
+
+-- Add 2FA fields to users table
+ALTER TABLE users
+ADD COLUMN two_factor_enabled BOOLEAN DEFAULT FALSE AFTER email_verified,
+ADD COLUMN two_factor_secret VARCHAR(32) NULL AFTER two_factor_enabled,
+ADD COLUMN two_factor_backup_codes TEXT NULL AFTER two_factor_secret,
+ADD COLUMN two_factor_setup_at TIMESTAMP NULL AFTER two_factor_backup_codes;
+
+-- Create table for 2FA verification attempts (for rate limiting and security)
+CREATE TABLE IF NOT EXISTS two_factor_verification_attempts (
+ id INT AUTO_INCREMENT PRIMARY KEY,
+ user_id INT NOT NULL,
+ ip_address VARCHAR(45) NOT NULL,
+ success BOOLEAN DEFAULT FALSE,
+ created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+ FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+ INDEX idx_user_id (user_id),
+ INDEX idx_ip_address (ip_address),
+ INDEX idx_created_at (created_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- Create table for 2FA email codes (backup method)
+CREATE TABLE IF NOT EXISTS two_factor_email_codes (
+ id INT AUTO_INCREMENT PRIMARY KEY,
+ user_id INT NOT NULL,
+ code VARCHAR(6) NOT NULL,
+ expires_at TIMESTAMP NOT NULL,
+ used BOOLEAN DEFAULT FALSE,
+ created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+ FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+ INDEX idx_user_id (user_id),
+ INDEX idx_code (code),
+ INDEX idx_expires_at (expires_at),
+ INDEX idx_used (used)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- Add 2FA policy setting
+INSERT INTO settings (setting_key, setting_value) VALUES
+('two_factor_policy', 'optional'),
+('two_factor_rate_limit_minutes', '15'),
+('two_factor_email_code_expiry_minutes', '10')
+ON DUPLICATE KEY UPDATE setting_key=setting_key;
diff --git a/routes/web.php b/routes/web.php
index 8677296..c58dfe6 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -15,6 +15,7 @@ use App\Controllers\UserController;
use App\Controllers\InstallerController;
use App\Controllers\NotificationController;
use App\Controllers\ErrorLogController;
+use App\Controllers\TwoFactorController;
$router = Application::$router;
@@ -39,6 +40,11 @@ $router->post('/forgot-password', [AuthController::class, 'forgotPassword']);
$router->get('/reset-password', [AuthController::class, 'showResetPassword']);
$router->post('/reset-password', [AuthController::class, 'resetPassword']);
+// Two-Factor Authentication routes (public during verification)
+$router->get('/2fa/verify', [TwoFactorController::class, 'showVerify']);
+$router->post('/2fa/verify', [TwoFactorController::class, 'verify']);
+$router->post('/2fa/send-email-code', [TwoFactorController::class, 'sendEmailCode']);
+
// Debug route (public - remove in production!)
$router->get('/debug/whois', [DebugController::class, 'whois']);
@@ -109,6 +115,7 @@ $router->post('/settings/update', [SettingsController::class, 'update']);
$router->post('/settings/update-app', [SettingsController::class, 'updateApp']);
$router->post('/settings/update-email', [SettingsController::class, 'updateEmail']);
$router->post('/settings/update-captcha', [SettingsController::class, 'updateCaptcha']);
+$router->post('/settings/update-two-factor', [SettingsController::class, 'updateTwoFactor']);
$router->post('/settings/test-email', [SettingsController::class, 'testEmail']);
$router->post('/settings/test-cron', [SettingsController::class, 'testCron']);
$router->post('/settings/clear-logs', [SettingsController::class, 'clearLogs']);
@@ -122,6 +129,14 @@ $router->get('/profile/resend-verification', [ProfileController::class, 'resendV
$router->post('/profile/logout-other-sessions', [ProfileController::class, 'logoutOtherSessions']);
$router->post('/profile/logout-session/{sessionId}', [ProfileController::class, 'logoutSession']);
+// Two-Factor Authentication management (protected)
+$router->get('/2fa/setup', [TwoFactorController::class, 'setup']);
+$router->post('/2fa/verify-setup', [TwoFactorController::class, 'verifySetup']);
+$router->get('/2fa/cancel-setup', [TwoFactorController::class, 'cancelSetup']);
+$router->get('/2fa/backup-codes', [TwoFactorController::class, 'backupCodes']);
+$router->post('/2fa/disable', [TwoFactorController::class, 'disable']);
+$router->post('/2fa/regenerate-backup-codes', [TwoFactorController::class, 'regenerateBackupCodes']);
+
// Notifications
$router->get('/notifications', [NotificationController::class, 'index']);
$router->get('/notifications/{id}/mark-read', [NotificationController::class, 'markAsRead']);
 ?>)
+