hcuProfileSecurity.prg

<?php
  /*
   * File: hcuProfileSecurity
   *
   * Purpose:  Handle the client-side updating of the user's challenge questions/answers.
   *
   */

  // ** SET SCRIPT LEVEL VARIABLES
  $serviceShowInfo = true;
  $serviceLoadMenu = true;
  $serviceShowMenu = true;

  // ** INCLUDE MAIN GLOBAL SCRIPT -- Handles security / global variable values
  require_once(dirname(__FILE__) . '/../library/hcuService.i');

  /*
   * ** CHECK USER FEATURE PERMISSIONS **
   * NOTE: DOES NOT RETURN ON FAILURE
   */
  PermCheckFeatureScreen($dbh, $HB_ENV, $MC, FEATURE_BASIC);

  // ** INSERT BUSINESS LOGIC FOR THIS FORM
  $dms_ok = array("security_curpwd"=>"string", "security_token"=>"string");

  dms_import_v2($HB_ENV, 'HCUPOST', $dms_ok);

  // ** SET VARIABLES FOR WEBSITE FLAGS

  // ** INCLUDE PRE CONTENT SCRIPT
  require_once(dirname(__FILE__) . '/../includes/hcuPreContent.i');

  /*
   * ** START CONTENT
   */
  $randomNbr = Return_Random4Challenge($HB_ENV);

  // these are used in several places so get them now
  $aryMbrChg = Get_MemberChallengeResponses($dbh, $HB_ENV, $HB_ENV['Cn']);

  // This client-side script file only handles the first step - re-authenticating

  $errorList = array();
  $act = "auth";  // default to first screen
  if ($HB_ENV['HCUPOST']['security_curpwd'] != '') {
    // ** We are validating against the current password

    $validPwd['settings_password']['current'] = $HB_ENV['HCUPOST']['security_curpwd'];
    $aryUpdate = Validate_Settings($dbh, $HB_ENV, $validPwd, $MC);

    if ($aryUpdate['status']['code'] == '000') {
      // ** Password passed authentication -- NOW
      // ** GET the current memberinfo and create the security token
      $mbrPwd = GetUserInfo($dbh, $HB_ENV, $MC, Array("user_id" => $HB_ENV['Uid'], "cu" => $HB_ENV['Cu']));

      if ($mbrPwd['status']['code'] != '000') {
        // ** An error occurred retrieving the saved password hash value
       $errorList = array( "id" => "", "message" => $mbrPwd['status']['errors'] );
      } else {
        // ** Get the database pwd hashed value
        $mbrPwdHash = $mbrPwd['data']['cuusers_passwd'];

        // sort the choices in order for consistency
        $choices = array();
        foreach ($aryMbrChg as $questId => $questResp) {
          $choices[] = $questId;
        }
        sort( $choices );
        $choiceString = implode( $choices );

        // * Create the security token - - HASHED PWD + RANDOM NBR + current challenge choices + SECRET
        // NOTE: this is checked in hcuProfile.data
        $securityToken = sha1($mbrPwdHash . $randomNbr . $choiceString . $HB_ENV['secret']);

        $retAry['data']['security_token'] = $securityToken;
        $act = "settings";

      }
    } else{
      $errorList = array( "id" => "", "message" => $MC->msg('Invalid Authentication', HCU_DISPLAY_AS_RAW) );
    }

  } else {
    // ** FAILED - send back to password confirmation screen
    $errorList = array( "id" => "", "message" => $MC->msg('Invalid Authentication', HCU_DISPLAY_AS_RAW) );
  }


  /* At this point we have one of the following actions:
   * auth (default): Show authentication screen so user can enter password
   * settings: Show settings screen so user can change security settings
   * validated: security token has been validated so process security settings update
   *
   */
  if ( $act == "auth" ) {
    // set a password cookie to help with authentication step
    // * Create random number
    // * Store in a two part value in a cookie
    // * Nbr=XX&Exp=Now()+900&Ch=Hashedvalue of {Nbr + Exp + 2FactorCookie}
    $randomNbr = rand(1000, 9999);
    $cookieName = "PWDCHG";
    $cookieExpires = time() + (60 * 15);   // * FIFTEEN MINUTE WINDOW TO POST
    $p3 = MD5($HB_ENV['secret'] . MD5(join (':', array($randomNbr, $cookieExpires))));
    $cookieValue = "p1={$randomNbr}&p2={$cookieExpires}&p3={$p3}";

    // ** COOKIE CREATED FOR RANDOM NUMBER
    HCU_setcookie_env($HB_ENV['SYSENV'], $cookieName, $cookieValue, 0);
  } else if ( $act == "settings" ) {
    // get the confidence word
    $mbrConfidence = $mbrPwd["data"]["cuusers_confidence"];

    // get current list of phone numbers
    $aryPhones = array();
    $sql = "
      SELECT phones
      FROM {$HB_ENV['Cu']}usercontact c
      LEFT JOIN {$HB_ENV['Cu']}user u
        ON u.contact = c.contact_id
      WHERE u.user_name = '{$HB_ENV['Cn']}'";
    $sqlRs = db_query($sql, $dbh);
    if ($sqlRs) {
      $aryPhones = db_fetch_assoc($sqlRs, 0);
      if ($aryPhones['phones'] === null) {
        $aryPhones = array(
          "mobile" => array()
        );
      } else {
        $aryPhones = HCU_JsonDecode($aryPhones['phones']);
      }
    }

    // gather the challenge questions and current answers
    $aryChallengeQuestions = GetChallengeQuestions("DISPLAY", $dbh, $HB_ENV, $MC);
    $aryCurrentQuestions = GetChallengeQuestions("CURRENT", $dbh, $HB_ENV, $MC, $HB_ENV['Cn']);

    /*
     * Challenge questions are stored in the database as &#HEX;
     * The way we are displaying these, we need to first get them back to their
     * original entity
     *
     */
    foreach ($aryChallengeQuestions as $chgKey => $chgValue) {
      $chgValue['display'] = html_entity_decode($chgValue['display'], ENT_QUOTES, 'UTF-8');
      $aryChallengeQuestions[$chgKey] = $chgValue;
    }
    reset($aryChallengeQuestions);
    if ( count( $aryMbrChg ) ) {
      $formPopulate = array();
      foreach ($aryMbrChg as $questId => $questResp) {
        $formPopulate[] = array( "security_qst" => $questId, "security_rsp" => $questResp );
      }
    } else {
      for ( $i = 0; $i < $HB_ENV['cu_chgqst_count']; $i++ )
        $formPopulate[] = array( "security_qst" => $aryChallengeQuestions[0]["cqid"], "security_rsp" => "" );
    }

  }

  ?>
<script type="text/javascript">
  CloseWaitWindow();
  $(document).ready(function() {
    // ON SUBMIT SHOW WAIT WINDOW
    $("#formSecurity").on("submit", function(e) {
      ShowWaitWindow();
    });

    <?php if ($act === "settings") { ?>
      // CHALLENGE QUESTIONS
      var hcuChallengeQuestions = <?php print HCU_JsonEncode($aryChallengeQuestions); ?>;
      var hcuCurrentQuestions = <?php print HCU_JsonEncode($aryCurrentQuestions); ?>;
      var hcuPhonesList = <?php print HCU_JsonEncode($aryPhones); ?>;
      var hcuPhonesData = [];

      if (hcuPhonesList.mobile) {
        for (var i = 0; i < hcuPhonesList.mobile.length; i++) {
          var phone = hcuPhonesList.mobile[i];
          var phoneParts = hcuPhonesList.mobile[i].split(/[-\s]/);
          var phone = "";

          if (phoneParts.length === 3) {
            phone += "(" + phoneParts[0].replace(/\D/g, '') + ") ";
            phone += phoneParts[1] + "-";
            phone += phoneParts[2];
          } else {
            phone += phoneParts[0] + "-";
            phone += phoneParts[1];
          }

          hcuPhonesData.push({
            id: i+1,
            value: phone,
            new: false
          });
        }
      }

      if (hcuPhonesData.length < 5) {
        hcuPhonesData.push({
          value: null,
          id: -1,
          new: false
        });
      }
    <?php } ?>

    // status will be shown in the default info location
    function ShowStatus( statusMessage ) {
      $.homecuValidator.settings.formStatusField = "formStatus";
      $.homecuValidator.settings.formInfoTitle = "";
      $.homecuValidator.displayMessage(statusMessage);
    }

    function ClearStatus( ) {
      $.homecuValidator.settings.formStatusField = "formStatus";
      $.homecuValidator.settings.formInfoTitle = "";
      $.homecuValidator.displayMessage(null);
    }

    function validateForm() {
      // validate other fields first
      var valid = $.homecuValidator.validate();

        var grid = $("#phoneGrid").data("kendoGrid");
        var data = grid.dataSource.data();
        var regex = new RegExp(/^[2-9]\d{2}-\d{3}-\d{4}$/);

        for (var i = 0; i < data.length; i++) {
          var id = data[i].id;

          if (id === -1) {
            continue;
          }

          var phone = data[i].value;
          phone = phone.replace(/[_\(\)]/g, '');
          phone = phone.replace(/\s/g, '-');
          var phoneValid = regex.test(phone);

          // if invalid, append this message onto current errors
          if (phoneValid === false) {
            valid = false;
            var message = "<?php echo $MC->msg("Phone Invalid", HCU_DISPLAY_AS_JS); ?>";
            var errors = $.homecuValidator.homecuKendoValidator.errors();
            var show = errors.concat(message);

            $.homecuValidator.displayMessage(show, $.homecuValidator.settings.statusError);
          }
        }

      return valid;
    }

    function phoneEdit(container, options) {
      var maskedTextBox = $("<input name=\"" + options.field + "\">")
        .appendTo(container)
        .kendoMaskedTextBox({
          mask: "(000) 000-0000",
          change: function() {
            var value = this.value();
            var valueStrip = value.replace(/_/g, '');
            valueStrip = valueStrip.replace(/\s/g, '-');
            valueStrip = valueStrip.replace(/[\(\)]/g, '');

            options.model.phone = valueStrip;
          }
        })
        .data("kendoMaskedTextBox");
    }

    var challengeChoices = kendo.observable({
      <?php
      if ( $act == "settings" ) {
        for ( $i = 0; $i < $HB_ENV['cu_chgqst_count']; $i++ ) {
          print "questionList{$i}: hcuChallengeQuestions,\n";
          $qstId = intval($formPopulate[$i]["security_qst"]);
          print "selectedQuestion{$i}: {$qstId},\n";
          print "response{$i}: \"{$formPopulate[$i]["security_rsp"]}\",\n";
        }
        print "confidence: \"{$mbrConfidence}\",\n";
        print "token: \"{$securityToken}\",\n";
      }
      ?>
      <?php if ($act === "settings") { ?>
          gridSource: new kendo.data.DataSource({
            data: hcuPhonesData,
            schema: {
              model: {
                id: "id",
                fields: {
                  id: { type: "number" },
                  value: { type: "string" },
                  new: { type: "boolean", default: true }
                }
              }
            },
            sort: [
              { field: "new", dir: "asc" },
              { field: "id", dir: "desc" }
            ]
          }),
          gridbind: function() {
            var grid = $("#phoneGrid").data("kendoGrid");
            var data = grid.dataSource.data();

            if (data.length >= 6) {
              $(".addRow").hide();
            } else {
              $(".addRow").show();
            }
          },
      <?php } ?>
    });

    // ** set currently selected answers if any exist
    <?php if ($act == "settings") { ?>
    if (hcuCurrentQuestions.hasOwnProperty("answers")) {
      var i = 0;
      for (key in hcuCurrentQuestions.answers) {
        challengeChoices["selectedQuestion" + i] = key;
        challengeChoices["response" + i] = hcuCurrentQuestions.answers[key];
        i++;
      }
    }
    <?php } ?>

    kendo.bind($("#profile"), challengeChoices);

    <?php if ($act === "settings") { ?>
        var grid = $("#phoneGrid").data("kendoGrid");
        $.each(grid.columns, function(idx, column) {
          if (column.field === "value")
            column.editor = phoneEdit;
        });

        $("#phoneGrid").on("click", ".removeBtn", function() {
          var row = $(this).closest("tr");
          var grid = $("#phoneGrid").data("kendoGrid");
          var data = grid.dataSource.data();

          grid.removeRow(row);
          return false;
        });

        $("#phoneGrid").on("click", ".addRow", function() {
          var row = $(this).closest("tr");
          var grid = $("#phoneGrid").data("kendoGrid");
          var data = grid.dataSource.data();

          grid.addRow();
          return false;
        });
    <?php } ?>

    $("#btnNext").click( function() {
      if ($.homecuValidator.validate()) {
        // submit form
        $("#formSecurity").submit();
      }
    });

    $("#btnUpdate").click( function() {

      if ( validateForm() ) {
        var request = {
          action: "challenge_save",
          security_token: challengeChoices.token,
          security_confidence: challengeChoices.confidence,
          security_phones: {
            mobile: hcuPhonesList.mobile,
            home: hcuPhonesList.home,
            work: hcuPhonesList.work
          }
        };

          request.security_phones.mobile = [];

          var grid = $("#phoneGrid").data("kendoGrid");
          var data = grid.dataSource.data();
          for (var i = 0; i < data.length; i++) {
            if (data[i].id === -1) {
              continue;
            }
            var value = data[i].value;
            value = value.replace(/[\)\(]/g, '');
            value = value.replace(/\s/g, '-');
            request.security_phones.mobile.push(value);
          }

        request["security_phones"] = JSON.stringify(request["security_phones"]);

        // add the rest of the info to the request
        for ( var i = 0; i < <?php echo $HB_ENV['cu_chgqst_count']; ?>; i++ ) {
          request["security_qst" + i] = eval( "challengeChoices.selectedQuestion" + i );
          request["security_rsp" + i] = eval( "challengeChoices.response" + i );
        }

        // use AJAX to update because it is difficult to use the datasource for a simple POST command
        $.ajax({
          url: "hcuProfile.data?cu=<?php echo $HB_ENV["cu"] ?>",
          type: "post",
          data: request,
          beforeSend: function( xhr ) {
            ShowWaitWindow();
          }
        }).done(function( data, textStatus, jqXHR ) {
          if ( data && data.homecuErrors ) {
            // show the error information
            $.homecuValidator.displayMessage(data.homecuErrors, $.homecuValidator.settings.statusError);
          } else {

            if ( data && data.homecuInfo && (data.homecuInfo.message.length > 0) ) {
              ShowStatus( data.homecuInfo.message );

              $("#phoneGrid").find(".k-dirty").remove();
            }

            // remove dirty flags from phone grid
            $("#phoneGrid").find(".k-dirty").remove();

            // present the device key to the apps
            if ( data.homecuData &&
                 data.homecuData.homecuKey &&
                 (data.homecuData.homecuKey.length > 0) ) {
                var appInfo = JSON.stringify( { deviceKey: data.homecuData.homecuKey } );

              <?php if ( $HB_ENV["platform"] == "ADA" ) :  ?>
                    AndroidController.notifyCommand("NEW_DEVICE_KEY", appInfo);
              <?php elseif ( $HB_ENV["platform"] == "APP" ) :  ?>
                    var postObject = {
                            body: {
                                cmd: "NEW_DEVICE_KEY",
                                params: appInfo
                            }
                        };
                    window.webkit.messageHandlers.interOp.postMessage(postObject);
              <?php endif ?>
            }
          
          <?php
            // let apps know we did an update to profile info
            if ( $HB_ENV["platform"] == "APP" || $HB_ENV["platform"] == "ADA" ) {
                $paramsForApps = array( "script" => "ProfileSecurity" );
                $paramsJSON = HCU_JsonEncode($paramsForApps);
          ?>
                var appInfo = '<?php echo $paramsJSON; ?>';

                <?php if ( $HB_ENV["platform"] == "ADA" ) :  ?>
                      AndroidController.notifyCommand("PROFILE_UPDATE", appInfo);
                <?php elseif ( $HB_ENV["platform"] == "APP" ) :  ?>
                      var postObject = {
                              body: {
                                  cmd: "PROFILE_UPDATE",
                                  params: appInfo
                              }
                          };
                      window.webkit.messageHandlers.interOp.postMessage(postObject);
                <?php endif ?>
          <?php
            }
          ?>
          }
        }).fail(function(jqXHR, textStatus, errorThrown) {
          // show the error information
          $.homecuValidator.displayMessage(textStatus, $.homecuValidator.settings.statusError);
        }).always(function(jqXHR, textStatus, errorThrown) {
          // stop the progress bar
          CloseWaitWindow();
        });
      }
    });

    // set up some validation, using the default error location
    $.homecuValidator.setup({
      formValidate: "formSecurity",
      formErrorTitle: "<?php echo $MC->msg("Error Occurred", HCU_DISPLAY_AS_JS) ?>"
    });

    homecuTooltip.bind({
        reenterTip: "<?php echo $MC->msg("Tip Re-enter Password", HCU_DISPLAY_AS_JS); ?>",
        confidenceTip: "<?php echo $MC->msg("Set Config Conf Msg", HCU_DISPLAY_AS_JS); ?>",
        phoneTip: "<?php echo $MC->msg("TXT Secure Access Codes", HCU_DISPLAY_AS_JS); ?>"
    });

  <?php
    // show any errors
    if ( isset( $_REQUEST["security_curpwd"] ) && count( $errorList ) ) {
  ?>
        var error = <?php echo HCU_JsonEncode($errorList); ?>;
        $.homecuValidator.displayMessage(error, $.homecuValidator.settings.statusError);
  <?php
    }
  ?>
});

</script>

<!-- HTML STYLING -->
<style type="text/css">
.hcuProfileSettingsDiv {
  min-width: 300px;
  max-width: 700px;
  margin-left: 0px;
  margin-top: 15px;
}

.k-block > .k-header {
  white-space: normal;
  height: 100%;
}

.hcu-info-margin, .hcu-error-margin {
  margin: 15px 0;
}

.hcu-info-padding, .hcu-error-padding {
  padding: 15px;
}

.hcu-full-width {
  width: 100%;
}

/* top-bottom margin */
.hcu-container-margin {
  margin: 15px 0;
}

.hcu-no-padding {
  padding: 0;
}

#phoneGrid .k-grid-header {
  display: none;
}

#phoneGrid .removeBtn {
  color: #A00;
}

#phoneGrid .addBtn {
  color: #507f50;
}

/**
  MAKE DROPDOWNS CONFORM TO SMALLER SIZES WITHOUT OVERFLOW
**/
.k-dropdown .k-input,.k-selectbox .k-input {
    white-space: normal;
}

</style>
<!-- HTML CONTENT -->
<div class="container-fluid hcuProfileSettingsDiv" id="profile">
  <div class="well well-sm">

    <!-- HEADER -->
    <div>
      <h3><?php echo $MC->msg('Security', HCU_DISPLAY_AS_HTML); ?></h3>
    </div>

    <!-- FORM CONTENT -->
    <form method="post" id='formSecurity' name='formSecurity'
      action="<?php echo $HB_ENV["loginpath"]."/{$HB_ENV['currentscript']}?".$HB_ENV["cuquery"] ?>">

      <?php if ($act == "settings") { ?>
      <fieldset>
        <div class="col-xs-12 col-md-6 hcu-container-margin">
          <label for="security_confidence">
            <span><?php echo $MC->msg('Set Config Conf Label', HCU_DISPLAY_AS_HTML); ?>:</span>
            <span class="fa fa-question-circle-o" id="confidenceTip"></span>
          </label>

          <input type="text" name="security_confidence"
            id="security_confidence"
            class="k-textbox hcu-full-width"
            placeholder="<?php echo $MC->msg('Set Config Conf Label', HCU_DISPLAY_AS_HTML); ?>"
            maxlength=20
            data-bind="value: confidence"
            data-required-msg="<?php echo $MC->msg('Set Config Enter Word', HCU_DISPLAY_AS_HTML); ?>"
            required >

        </div>
      </fieldset>

        <!-- if use mfa confidence word flag is set, do not show mfa questions -->
        <?php if (intval($HB_ENV['flagset3'] & $GLOBALS['CU3_MFA_AUTHCODE']) === 0) { ?>
        <fieldset>
          <?php for($i = 0; $i < $HB_ENV['cu_chgqst_count']; $i++) {?>
          <div class="col-xs-12 col-md-6 hcu-container-margin">

            <label for="challenge<?php echo $i; ?>">
              <span><?php echo $MC->msg('Set Config Question', HCU_DISPLAY_AS_HTML) . " " . ($i+1); ?>:</span>
            </label>

            <select name="challengeQuestion<?php echo $i ?>"
              id="challengeQuestion<?php echo $i ?>"
              class="unique_select hcu-full-width"
              data-role="dropdownlist"
              data-text-field="display"
              data-value-field="cqid"
              data-bind="source: questionList<?php echo $i; ?>, value: selectedQuestion<?php echo $i; ?>"
              data-homecuCustomDistinct-msg="<?php echo $MC->msg('Challenge questions once', HCU_DISPLAY_AS_HTML); ?>"
              homecu-distinct="unique_select"></select>

            <span class="k-invalid-msg" data-for="challengeQuestion<?php echo $i ?>"></span>

            <br><br>

            <input type="text" name="challenge<?php echo $i; ?>"
              id="challenge<?php echo $i; ?>"
              class="k-textbox hcu-full-width"
              placeholder="<?php echo $MC->msg('Set Config Response', HCU_DISPLAY_AS_HTML); ?>"
              data-bind="value: response<?php echo $i; ?>"
              data-required-msg="<?php echo $MC->msg('Challenge answer blank', HCU_DISPLAY_AS_HTML); ?>"
              required >
          </div>
          <?php } ?>
        </fieldset>
        <?php } ?>
        <fieldset>
          <div class="col-xs-12 col-md-6 hcu-container-margin">
            <label for="security_phone">
              <span><?php echo $MC->msg('TXT Enabled', HCU_DISPLAY_AS_HTML); ?>:</span>
           <?php if (intval($HB_ENV['flagset3'] & GetFlagsetValue('CU3_MFA_AUTHCODE'))) { ?>
              <span class="fa fa-question-circle-o" id="phoneTip"></span>
           <?php } ?>
            </label>

            <div id="phoneGrid"
              data-role="grid"
              data-row-template="gridRow"
              data-editable="{
                confirmation: false
              }"
              data-columns="[
                { width: 30 },
                { title: 'Mobile', field: 'value' }
              ]"
              data-bind="
                source: gridSource,
                events: { dataBound: gridbind }"
              ></div>
          </div>
        </fieldset>

      <?php } else { ?>

      <!-- INITIAL -->
      <fieldset>
        <div class="col-xs-12 col-md-6 hcu-container-margin">
          <label for="security_curpwd">
            <span><?php echo $MC->msg('Re-enter Password', HCU_DISPLAY_AS_HTML); ?>:</span>
            <span class="fa fa-question-circle-o" id="reenterTip"></span>
          </label>

          <i><?php echo $MC->msg("Verify Login", HCU_DISPLAY_AS_HTML); ?></i>

          <input type="password" name="security_curpwd"
            id="security_curpwd"
            class="k-textbox hcu-full-width"
            placeholder="<?php echo $MC->msg('Re-enter Password', HCU_DISPLAY_AS_HTML); ?>"
            data-required-msg="<?php echo $MC->msg('Invalid login or password', HCU_DISPLAY_AS_HTML) ?>"
            required >

        </div>
      </fieldset>
      <?php } ?>
    </form>
  </div>

  <div class="hcu-template">
    <div class="hcu-edit-buttons k-state-default">
      <?php if ($act == "settings") { ?>
      <a href="##" id="btnUpdate" class="k-button k-primary">
        <i class="fa fa-check fa-lg"></i><?php echo $MC->msg("Update", HCU_DISPLAY_AS_HTML); ?>
      </a>
      <?php } else { ?>
      <a href="##" id="btnNext" class="k-button k-primary">
        <i class="fa fa-arrow-right fa-lg"></i><?php echo $MC->msg("Next", HCU_DISPLAY_AS_HTML); ?>
      </a>
      <?php } ?>
    </div>
  </div>
</div>

<script type="text/x-kendo-template" id="gridRow">
  # if (id === -1) { #
  <tr data-uid="#: uid #" class="addRow">
    <td class="addBtn"><span class="fa fa-plus-circle"></span></td>
    <td>Add Phone</td>
  </tr>
  # } else { #
  <tr data-uid="#: uid #">
    <td class="removeBtn"><span class="fa fa-minus-circle"></span></td>
    <td>#: value #</td>
  </tr>
  # } #
</script>

<?php
  /*
   * ** END CONTENT
   */

  // ** INCLUDE POST CONTENT SCRIPT
  require_once(dirname(__FILE__) . '/../includes/hcuPostContent.i');

?>