AdmAddAuth.prg

<?php
require_once("$admLibrary/ck_aticket.i");

  // ** DEFINE GLOBAL VALUES
    $HCUSMSFROM = "noreply@homecu.net";
    $HCUSTALETIME = 40;

$dms_ok=array( 'action'=> array("filter" => FILTER_SANITIZE_STRING), 'use_to_send'=> array("filter" => FILTER_SANITIZE_STRING), "code" => array("filter" => FILTER_SANITIZE_STRING));

HCU_ImportVars($SYSENV, "LOGOUT", $dms_ok);
extract($SYSENV["LOGOUT"]);

#
$main_url = $menu_link;
$self= "$menu_link?ft=$ft";
$content= "";
$msg= "";

if ( isset($action) ) {
  if ( $action == "send_out_of_band") {
     //adding cu_sms for sending text
     require_once(dirname(__FILE__) . '/../../shared/library/cu_sms.i');
     require_once(dirname(__FILE__) . '/../../banking/library/cu_credentials.i');
    if ( $use_to_send == "sms" ) {
      $sql = "SELECT usersms FROM cuadminusers WHERE cu = '$Cu' AND user_name = '$Cn'";

    } else if ( $use_to_send == "email" ) {
      $sql = "SELECT email FROM cuadminusers WHERE cu = '$Cu' AND user_name = '$Cn'";
    } else if ( $use_to_send == "have_code" ) {
      $action = "wait_for_code";
    } else {
      $msg .= "Invalid selection of how to send the access code.";
    }

    if ( empty( $msg ) && $action != "wait_for_code") {
      $sth = db_query($sql,$dbh);

      if ( list($sendTo) = db_fetch_array($sth,0) ) {
        db_free_result($sth);

      } else {
        $msg .= "Unable to read user record";
      }
    }

    if ( empty($msg) ) {

      // creatin, storing, and sending access code the same way
      // we do it for home banking users
      $authResp = generateAuthcode();
      if (!$authResp['authcode'] || !$authResp['authexpires']) {
        throw new Exception('Generate Access Code Failed');
      }

      if (!setAdminAuthcode($dbh, $Cu, $Cn, $authResp['authcode'])) {
        throw new Exception('Save Access Code Failed');
      }

      if (!sendAdminAuthcode($dbh, $Cu, $authResp, $sendTo, $use_to_send)) {
        throw new Exception('Send Access Code Failed');
      }

      $action = "wait_for_code";
    }
  } else if ( $action == "confirm_remote" ) {

    // check validity
    $sql = "SELECT cau.userconfirm, ca.retrylimit
            FROM cuadminusers cau
            INNER JOIN cuadmin ca ON ca.cu = cau.cu
            WHERE cau.cu = '$Cu'
              AND cau.user_name = '$Cn'";
    $sth = db_query( $sql, $dbh );

    if ( list($savedConfirm, $retryLimit) = db_fetch_array($sth,0) ) {
      db_free_result($sth);
      $confirmParts = explode( "|", $savedConfirm );

      // check the time and retry count
      $now = time();
      if ( ($now - $confirmParts[2]) > 60 * $HCUSTALETIME ) {
        $msg .= "Too much time has passed. Code expired.";
      } else if ( $_SERVER["REMOTE_ADDR"] != $confirmParts[1] ) {
        $msg .= "Access is from a different location. Please try again.";
      } else if ( $confirmParts[3] >= $retryLimit ) {
        $msg .= "Retry limit exceeded. Please start over.";

      $contents= "";
      $contents.= "<div class='row'>Retry limit exceeded. Please start over.</div>";
      $contents.= "<div class='hcu-edit-buttons k-state-default row'><a id='logoutBtn' class='k-button k-primary' href='\\\\#'>Logout</a></div>";

      printKendoWindow($menu_link, $contents);
      exit;

      } else if ( trim( $code ) != $confirmParts[0] ) {
        $msg .= "Invalid access code. Please retry.";

        // increase the retry count
        $confirmParts[3]++;
        $confirmToUpdate = implode( "|", $confirmParts );

                $sql = "UPDATE cuadminusers
                SET userconfirm = '$confirmToUpdate'
                WHERE user_name = '$Cn' AND
                  cu = '$Cu'";

            $save_rs = db_query( $sql, $dbh );

        $action = "wait_for_code";
      } else {
        // made it! save the IP and clear the code
                $sql = "UPDATE cuadminusers
                SET userconfirm = '',
                remoteip = '" . prep_save($confirmParts[1]) . "'
                WHERE user_name = '$Cn' AND
                  cu = '$Cu'";

            $save_rs = db_query( $sql, $dbh );

        // send an email to the address of record
        $sql = "SELECT cau.email, ca.orgname FROM cuadminusers cau INNER JOIN cuadmin ca ON ca.cu = cau.cu WHERE cau.cu = '$Cu' AND cau.user_name = '$Cn'";
        $sth = db_query($sql,$dbh);

        if ( list($sendTo, $orgName) = db_fetch_array($sth,0) ) {
          db_free_result($sth);

          // send the access code to the user (either email or SMS/email)
          $notify = new ErrorMail;
          $notify->mailto="$sendTo";
          $notify->mailfromname="$orgName";
          $notify->subject='Updated remote access';
          $notify->msgbody =  "The remote access for your HomeCU Admin account was changed. If you did not make this change please let your system administrator know immediately.\n";
          $notify->callingfunction = __FUNCTION__;
          $notify->file = __FILE__;
          $notify->cu = $Cu;
          $notify->SendMail();

          // now go to where they really wanted to go
          $returnAddress = urldecode($_COOKIE['Tx_aURI']);
          if ( !strlen( trim( $returnAddress ) ) ) {
            $returnAddress = "/admbin/main.prg?ft=";
          }
        }

        header("Location: " . $returnAddress);
        exit; // https://stackoverflow.com/questions/3553698/php-should-i-call-exit-after-calling-location-header
      }
    } else {
      $msg .= "Unable to read confirmation information.";
    }
  }
}

  $isAllowedRemoteAccess = false;

  if (isset($Cn) && isset($Cu)) {
    // see if user is allowed remote access
    // also get the email, sms
    $sql = "select email, userflags, usersms
            from cuadminusers
            where user_name = '$Cn'
              and cu = '$Cu' ";
    $sth = db_query($sql,$dbh);
    if ( list( $email, $userflags, $sms ) = db_fetch_array( $sth, 0 ) ) {
      $isAllowedRemoteAccess = ($userflags & GetAdminUserFlagsValue("ADM_REMOTE_ACCESS_ALLOWED")) > 0;
    }
  }


  if ( $isAllowedRemoteAccess ) {
    if (isset($action) && $action == "wait_for_code" ) {

      $contents= "";
      $contents.= "<form action='$self' method='POST' name='continue'><input type='hidden' name='action' value='confirm_remote' />";
      $contents.= "<div class='row'><label class='col-xs-5'>Enter Code:</label><div class='col-xs-7'><input type='text' name='code' class='k-input k-textbox hcu-all-100'></div></div></form>";
      $contents.= "<div class='hcu-edit-buttons k-state-default row'><a id='logoutBtn' href='\\\\#'>Logout</a>&nbsp;&nbsp;&nbsp;";
      $contents.= "<a id='submitBtn' class='k-button k-primary' href='\\\\#'><i class='fa fa-check'></i>Submit</a></div>";

    } else {
      $email = trim( $email );
      $sms = trim( $sms );

      // mask the email
      $emailParts = explode( "@", $email );

      $maskedEmail = "";
      if ( strlen( $emailParts[0] ) > 3 ) {
        $maskedEmail .= substr( $email, 0, 3 ) . str_repeat( "x", strlen( $emailParts[0] ) - 3 );
      } else {
        $maskedEmail .= $emailParts[0];
      }

      $maskedEmail .= "x";

      if ( strlen( $emailParts[1] ) > 7 ) {
        $maskedEmail .= str_repeat( "x", strlen( $emailParts[1] ) - 7 ) . substr( $email, -7 );
      } else {
        $maskedEmail .= $emailParts[1];
      }

      // mask the SMS phone number, if there is one, from the phone/email address
      $maskedSMS = "";
      if ( strlen( $sms ) > 0 ) {
        if ( strpos( $sms, "@" ) > 0 ) {
          $smsParts = explode( "@", $sms );
          $smsNumber = $smsParts[0];
        } else {
          $smsNumber = $sms;
        }
        $maskedSMS = substr( $smsNumber, 0, 4 ) . "xxxx" . substr( $smsNumber, -2 );
      }

      $thisChecked = strlen( $maskedSMS ) == 0 ? "checked" : "";

      $contents= "";
      $contents.= "<form action='$self' method='POST' name='continue'><input type='hidden' name='action' value='send_out_of_band' />";
      $contents.= "<div class='row'>You are attempting to access this system from an unknown location. <br>";
      $contents.= "In order to obtain an access code, please select how you would like the access code to be sent. <br>";
      $contents.= "The access code will expire after 15 minutes.</div>";
      $contents.= strlen($maskedSMS) > 0 ? "<div class='radio'><input type='radio' name='use_to_send' value='sms' checked />Text to $maskedSMS</div>" : "";
      $contents.= "<div class='radio'><input type='radio' name='use_to_send' value='email' $thisChecked />Email to $maskedEmail</div>";
      $contents.= "<div class='radio'><input type='radio' name='use_to_send' value='have_code' />Already have access code</div></form>";
      $contents.= "<div class='hcu-edit-buttons k-state-default row'><a id='logoutBtn' href='\\\\#'>Logout</a>&nbsp;&nbsp;&nbsp;";
      $contents.= "<a id='submitBtn' class='k-button k-primary' href='\\\\#'><i class='fa fa-check'></i>Submit</a></div>";

      ?>


    <?php
    }
  } else {

      $contents= "";
      $contents.= "You do not have permissions for remote access.";
      $contents.= "<div class='hcu-edit-buttons k-state-default row'><a id='logoutBtn' class='k-button k-primary' href='\\\\#'>Logout</a></div>";
  }

if (strlen($contents) > 0)
  printKendoWindow($menu_link, $contents, $msg);

function printKendoWindow($menu_link, $contents, $msg="") {
    $logoutForm= "<form name='logout' action='$menu_link?ft=70' method='post'>";
    echo $logoutForm;
    $fullContents= "<div id='permissionFormStatusField'></div><div class='container-fluid hcu-template'>";
    $fullContents.= strlen($msg) > 0 ? "<div class='row k-block k-error-colored hcuSpacer'>$msg</div>" : "";
    $fullContents.= $contents;
    $fullContents.= "</div>";
    ?>
    <script type="text/javascript">

      $(document).ready(function() {
        var permissionsDialog= $("<div id='permissionsDialog'></div>").appendTo("body").kendoWindow({
          visible: false,
          modal: true,
          resizable: false,
          draggable: true,
          title: "HomeCU Remote Admin Permissions",
          minWidth: 330, <?php // To show all of the title. ?>
          content: {
            template: "<?php echo $fullContents; ?>"
          }
        }).data("kendoWindow");

        permissionsDialog.open().center();

        $("#logoutBtn").click(function() {
          $("[name='logout']").submit();
        });
        $("#submitBtn").click(function() {
          $("[name='continue']").submit();
        });
      });
    </script>
<?php }