Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP

Comparing changes

Choose two branches to see what's changed or to start a new pull request. If you need to, you can also compare across forks.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also compare across forks.
base fork: reddit/reddit
base: 4169226735
...
head fork: reddit/reddit
compare: 1db68ce6b1
Checking mergeability… Don't worry, you can still create the pull request.
  • 3 commits
  • 18 files changed
  • 0 commit comments
  • 1 contributor
Commits on Jul 23, 2012
@spladug spladug reddit_base: Add support for Secure and HTTP-Only cookies. 529df1b
@spladug spladug Add framework for RFC-6238: Time-Based One Time Password Algorithm.
This provides a system for two-factor authentication, using a compliant
OTP-generator such as Google Authenticator. The framework includes a
validator for use on API calls needing authentication as well as a UI
for provisioning/resetting your secret key. A secure cookie may be
generated to effectively turn the user's browser into a temporary
authentication factor.

This feature is currently limited to admins only until full-site SSL is
available.
8dfd73b
@spladug spladug Require two-factor authentication to enable admin mode.
This feature can be disabled with the new ini setting
`disable_admin_otp`.
1db68ce
View
1  install-reddit.sh
@@ -242,6 +242,7 @@ debug = true
disable_ads = true
disable_captcha = true
disable_ratelimit = true
+disable_require_admin_otp = true
page_cache_time = 0
View
5 r2/example.ini
@@ -66,6 +66,7 @@ CLOUDSEARCH_SUBREDDIT_DOC_API =
disable_ads = false
disable_captcha = false
disable_ratelimit = false
+disable_require_admin_otp = false
# -- important settings --
# the domain that this app serves itself up as
@@ -110,6 +111,8 @@ https_endpoint =
login_cookie = reddit_session
# name of the admin cookie
admin_cookie = reddit_admin
+# name of the otp cookie
+otp_cookie = reddit_otp
# the work factor for bcrypt, increment this every time computers double in
# speed. don't worry, changing this won't break old passwords
bcrypt_work_factor = 12
@@ -409,6 +412,8 @@ min_membership_create_community = 30
ADMIN_COOKIE_TTL = 32400
# the maximum amount of idle time for an admin cookie (seconds)
ADMIN_COOKIE_MAX_IDLE = 900
+# the maximum life of an otp cookie
+OTP_COOKIE_TTL = 604800
# min amount of karma to edit
WIKI_KARMA = 100
View
61 r2/r2/controllers/api.py
@@ -2705,11 +2705,70 @@ def POST_expando(self, link):
@validatedForm(VUser('password', default=''),
VModhash(),
+ VOneTimePassword("otp",
+ required=not g.disable_require_admin_otp),
+ remember=VBoolean("remember"),
dest=VDestination())
- def POST_adminon(self, form, jquery, dest):
+ def POST_adminon(self, form, jquery, remember, dest):
if form.has_errors('password', errors.WRONG_PASSWORD):
return
+ if form.has_errors("otp", errors.WRONG_PASSWORD,
+ errors.NO_OTP_SECRET,
+ errors.RATELIMIT):
+ return
+
+ if remember:
+ self.remember_otp(c.user)
+
self.enable_admin_mode(c.user)
form.redirect(dest)
+ @validatedForm(VUser("password", default=""),
+ VModhash())
+ def POST_generate_otp_secret(self, form, jquery):
+ if form.has_errors("password", errors.WRONG_PASSWORD):
+ return
+
+ secret = totp.generate_secret()
+ g.cache.set('otp_secret_' + c.user._id36, secret, time=300)
+ jquery("body").make_totp_qrcode(secret)
+
+ @validatedForm(VUser(),
+ VModhash(),
+ otp=nop("otp"))
+ def POST_enable_otp(self, form, jquery, otp):
+ if form.has_errors("password", errors.WRONG_PASSWORD):
+ return
+
+ secret = g.cache.get("otp_secret_" + c.user._id36)
+ if not secret:
+ c.errors.add(errors.EXPIRED, field="otp")
+ form.has_errors("otp", errors.EXPIRED)
+ return
+
+ if not VOneTimePassword.validate_otp(secret, otp):
+ c.errors.add(errors.WRONG_PASSWORD, field="otp")
+ form.has_errors("otp", errors.WRONG_PASSWORD)
+ return
+
+ c.user.otp_secret = secret
+ c.user._commit()
+
+ form.redirect("/prefs/otp")
+
+ @validatedForm(VUser("password", default=""),
+ VOneTimePassword("otp", required=True),
+ VModhash())
+ def POST_disable_otp(self, form, jquery):
+ if form.has_errors("password", errors.WRONG_PASSWORD):
+ return
+
+ if form.has_errors("otp", errors.WRONG_PASSWORD,
+ errors.NO_OTP_SECRET,
+ errors.RATELIMIT):
+ return
+
+ c.user.otp_secret = ""
+ c.user._commit()
+ form.redirect("/prefs/otp")
View
1  r2/r2/controllers/errors.py
@@ -97,6 +97,7 @@
('CONFIRM', _("please confirm the form")),
('NO_API', _('cannot perform this action via the API')),
('DOMAIN_BANNED', _('%(domain)s is not allowed on reddit: %(reason)s')),
+ ('NO_OTP_SECRET', _('you must enable two-factor authentication')),
))
errors = Storage([(e, e) for e in error_list.keys()])
View
2  r2/r2/controllers/front.py
@@ -1104,6 +1104,8 @@ def GET_prefs(self, location=''):
content = PrefFeeds()
elif location == 'delete':
content = PrefDelete()
+ elif location == 'otp':
+ content = PrefOTP()
else:
return self.abort404()
View
35 r2/r2/controllers/reddit_base.py
@@ -63,10 +63,13 @@ def add(self, name, value, *k, **kw):
self[name] = Cookie(value, *k, **kw)
class Cookie(object):
- def __init__(self, value, expires = None, domain = None, dirty = True):
+ def __init__(self, value, expires=None, domain=None,
+ dirty=True, secure=False, httponly=False):
self.value = value
self.expires = expires
self.dirty = dirty
+ self.secure = secure
+ self.httponly = httponly
if domain:
self.domain = domain
elif c.authorized_cname and not c.default_sr:
@@ -147,9 +150,10 @@ def read_user_cookie(name):
else:
return ''
-def set_user_cookie(name, val):
+def set_user_cookie(name, val, **kwargs):
uname = c.user.name if c.user_is_loggedin else ""
- c.cookies[uname + '_' + name] = Cookie(value = val)
+ c.cookies[uname + '_' + name] = Cookie(value=val,
+ **kwargs)
valid_click_cookie = fullname_regex(Link, True).match
@@ -626,7 +630,9 @@ def try_pagecache(self):
value = cookie.value,
domain = cookie.get('domain',None),
expires = cookie.get('expires',None),
- path = cookie.get('path',None))
+ path = cookie.get('path',None),
+ secure = cookie.get('secure', False),
+ httponly = cookie.get('httponly', False))
response.status_code = r.status_code
request.environ['pylons.routes_dict']['action'] = 'cached_response'
@@ -677,7 +683,9 @@ def post(self):
response.set_cookie(key = k,
value = quote(v.value),
domain = v.domain,
- expires = v.expires)
+ expires = v.expires,
+ secure = getattr(v, 'secure', False),
+ httponly = getattr(v, 'httponly', False))
end_time = datetime.now(g.tz)
@@ -776,6 +784,17 @@ def enable_admin_mode(user, first_login=None):
c.cookies[g.admin_cookie] = Cookie(value=user.make_admin_cookie(first_login=first_login))
@staticmethod
+ def remember_otp(user):
+ cookie = user.make_otp_cookie()
+ expiration = datetime.utcnow() + timedelta(seconds=g.OTP_COOKIE_TTL)
+ expiration = expiration.strftime("%a, %d %b %Y %H:%M:%S GMT")
+ set_user_cookie(g.otp_cookie,
+ cookie,
+ secure=True,
+ httponly=True,
+ expires=expiration)
+
+ @staticmethod
def disable_admin_mode(user):
c.cookies[g.admin_cookie] = Cookie(value='', expires=DELETE)
@@ -802,6 +821,7 @@ def pre(self):
# the user could have been logged in via one of the feeds
maybe_admin = False
+ is_otpcookie_valid = False
# no logins for RSS feed unless valid_feed has already been called
if not c.user:
@@ -821,6 +841,10 @@ def pre(self):
else:
self.disable_admin_mode(c.user)
+ otp_cookie = read_user_cookie(g.otp_cookie)
+ if c.user_is_loggedin and otp_cookie:
+ is_otpcookie_valid = valid_otp_cookie(otp_cookie)
+
if not c.user:
c.user = UnloggedUser(get_browser_langs())
# patch for fixing mangled language preferences
@@ -843,6 +867,7 @@ def pre(self):
c.user_is_admin = maybe_admin and c.user.name in g.admins
c.user_special_distinguish = c.user.special_distinguish()
c.user_is_sponsor = c.user_is_admin or c.user.name in g.sponsors
+ c.otp_cached = is_otpcookie_valid
if request.path != '/validuser' and not g.disallow_db_writes:
c.user.update_last_visit(c.start_time)
View
62 r2/r2/controllers/validator/validator.py
@@ -24,7 +24,7 @@
from pylons.i18n import _
from pylons.controllers.util import abort
from r2.config.extensions import api_type
-from r2.lib import utils, captcha, promote
+from r2.lib import utils, captcha, promote, totp
from r2.lib.filters import unkeep_space, websafe, _force_unicode
from r2.lib.filters import markdown_souptest
from r2.lib.db import tdb_cassandra
@@ -1767,3 +1767,63 @@ def run(self, flair_template_id):
c.site._id, flair_template_id)
except tdb_cassandra.NotFound:
return None
+
+class VOneTimePassword(Validator):
+ max_skew = 2 # check two periods to allow for some clock skew
+ ratelimit = 3 # maximum number of tries per period
+
+ def __init__(self, param, required):
+ self.required = required
+ Validator.__init__(self, param)
+
+ @classmethod
+ def validate_otp(cls, secret, password):
+ # is the password a valid format and has it been used?
+ try:
+ key = "otp-%s-%d" % (c.user._id36, int(password))
+ except (TypeError, ValueError):
+ valid_and_unused = False
+ else:
+ # leave this key around for one more time period than the maximum
+ # number of time periods we'll check for valid passwords
+ key_ttl = totp.PERIOD * (cls.max_skew + 1)
+ valid_and_unused = g.cache.add(key, True, time=key_ttl)
+
+ # check the password (allowing for some clock-skew as 2FA-users
+ # frequently travel at relativistic velocities)
+ if valid_and_unused:
+ for skew in range(cls.max_skew):
+ expected_otp = totp.make_totp(secret, skew=skew)
+ if constant_time_compare(password, expected_otp):
+ return True
+
+ return False
+
+ def run(self, password):
+ # does the user have 2FA configured?
+ secret = c.user.otp_secret
+ if not secret:
+ if self.required:
+ self.set_error(errors.NO_OTP_SECRET)
+ return
+
+ # do they have the otp cookie instead?
+ if c.otp_cached:
+ return
+
+ # make sure they're not trying this too much
+ if not g.disable_ratelimit:
+ current_password = totp.make_totp(secret)
+ key = "otp-tries-" + current_password
+ g.cache.add(key, 0)
+ recent_attempts = g.cache.incr(key)
+ if recent_attempts > self.ratelimit:
+ self.set_error(errors.RATELIMIT, dict(time="30 seconds"))
+ return
+
+ # check the password
+ if self.validate_otp(secret, password):
+ return
+
+ # if we got this far, their password was wrong, invalid or already used
+ self.set_error(errors.WRONG_PASSWORD)
View
2  r2/r2/lib/app_globals.py
@@ -63,6 +63,7 @@ class Globals(object):
'QUOTA_THRESHOLD',
'ADMIN_COOKIE_TTL',
'ADMIN_COOKIE_MAX_IDLE',
+ 'OTP_COOKIE_TTL',
'num_comments',
'max_comments',
'max_comments_gold',
@@ -113,6 +114,7 @@ class Globals(object):
's3_media_direct',
'disable_captcha',
'disable_ads',
+ 'disable_require_admin_otp',
'static_pre_gzipped',
'static_secure_pre_gzipped',
'trust_local_proxies',
View
5 r2/r2/lib/js.py
@@ -310,6 +310,11 @@ def use(self):
"traffic.js",
)
+module["qrcode"] = Module("qrcode.js",
+ "lib/jquery.qrcode.min.js",
+ "qrcode.js",
+)
+
def use(*names):
return "\n".join(module[name].use() for name in names)
View
1  r2/r2/lib/menus.py
@@ -109,6 +109,7 @@ def __getattr__(self, attr):
friends = _("friends"),
update = _("password/email"),
delete = _("delete"),
+ otp = _("two-factor authentication"),
# messages
compose = _("compose"),
View
7 r2/r2/lib/pages/pages.py
@@ -625,6 +625,10 @@ def build_toolbars(self):
buttons.extend([NamedButton('friends'),
NamedButton('update')])
+
+ if c.user_is_loggedin and c.user.name in g.admins:
+ buttons += [NamedButton('otp')]
+
#if CustomerID.get_id(user):
# buttons += [NamedButton('payment')]
buttons += [NamedButton('delete')]
@@ -639,6 +643,9 @@ def __init__(self, done = False):
class PrefFeeds(Templated):
pass
+class PrefOTP(Templated):
+ pass
+
class PrefUpdate(Templated):
"""Preference form for updating email address and passwords"""
def __init__(self, email = True, password = True, verify = False):
View
76 r2/r2/lib/totp.py
@@ -0,0 +1,76 @@
+# The contents of this file are subject to the Common Public Attribution
+# License Version 1.0. (the "License"); you may not use this file except in
+# compliance with the License. You may obtain a copy of the License at
+# http://code.reddit.com/LICENSE. The License is based on the Mozilla Public
+# License Version 1.1, but Sections 14 and 15 have been added to cover use of
+# software over a computer network and provide for limited attribution for the
+# Original Developer. In addition, Exhibit A has been modified to be consistent
+# with Exhibit B.
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for
+# the specific language governing rights and limitations under the License.
+#
+# The Original Code is reddit.
+#
+# The Original Developer is the Initial Developer. The Initial Developer of
+# the Original Code is reddit Inc.
+#
+# All portions of the code written by reddit are Copyright (c) 2006-2012 reddit
+# Inc. All Rights Reserved.
+###############################################################################
+
+"""An implementation of the RFC-6238 Time-Based One Time Password algorithm."""
+
+import time
+import hmac
+import base64
+import struct
+import hashlib
+
+
+PERIOD = 30
+
+
+def make_hotp(secret, counter):
+ """Generate an RFC-4226 HMAC-Based One Time Password."""
+ key = base64.b32decode(secret)
+
+ # compute the HMAC digest of the counter with the secret key
+ counter_encoded = struct.pack(">q", counter)
+ hmac_result = hmac.HMAC(key, counter_encoded, hashlib.sha1).digest()
+
+ # do HOTP dynamic truncation (see RFC4226 5.3)
+ offset = ord(hmac_result[-1]) & 0x0f
+ truncated_hash = hmac_result[offset:offset + 4]
+ code_bits, = struct.unpack(">L", truncated_hash)
+ htop = (code_bits & 0x7fffffff) % 1000000
+
+ # pad it out as necessary
+ return "%06d" % htop
+
+
+def make_totp(secret, skew=0, timestamp=None):
+ """Generate an RFC-6238 Time-Based One Time Password."""
+ timestamp = timestamp or time.time()
+ counter = timestamp // PERIOD
+ return make_hotp(secret, counter - skew)
+
+
+def generate_secret():
+ """Make a secret key suitable for use in TOTP."""
+ from Crypto.Random import get_random_bytes
+ bytes = get_random_bytes(20)
+ encoded = base64.b32encode(bytes)
+ return encoded
+
+
+if __name__ == "__main__":
+ # based on RFC-6238 Appendix B (trimmed to six-digit OTPs)
+ secret = base64.b32encode("12345678901234567890")
+ assert make_totp(secret, timestamp=59) == "287082"
+ assert make_totp(secret, timestamp=1111111109) == "081804"
+ assert make_totp(secret, timestamp=1111111111) == "050471"
+ assert make_totp(secret, timestamp=1234567890) == "005924"
+ assert make_totp(secret, timestamp=2000000000) == "279037"
+ assert make_totp(secret, timestamp=20000000000) == "353130"
View
36 r2/r2/models/account.py
@@ -108,6 +108,7 @@ class Account(Thing):
gold_charter = False,
gold_creddits = 0,
gold_creddit_escrow = 0,
+ otp_secret=None,
)
def has_interacted_with(self, sr):
@@ -241,6 +242,16 @@ def make_admin_cookie(self, first_login=None, last_request=None):
mac = hmac.new(g.SECRET, hashable, hashlib.sha1).hexdigest()
return ','.join((first_login, last_request, mac))
+ def make_otp_cookie(self, timestamp=None):
+ if not self._loaded:
+ self._load()
+
+ timestamp = timestamp or datetime.utcnow().strftime(COOKIE_TIMESTAMP_FORMAT)
+ secrets = [request.user_agent, self.otp_secret, self.password]
+ signature = hmac.new(g.SECRET, ','.join([timestamp] + secrets), hashlib.sha1).hexdigest()
+
+ return ",".join((timestamp, signature))
+
def needs_captcha(self):
return not g.disable_captcha and self.link_karma < 1
@@ -631,6 +642,31 @@ def valid_admin_cookie(cookie):
first_login)
+def valid_otp_cookie(cookie):
+ if g.read_only_mode:
+ return False
+
+ # parse the cookie
+ try:
+ remembered_at, signature = cookie.split(",")
+ except ValueError:
+ return False
+
+ # make sure it hasn't expired
+ try:
+ remembered_at_time = datetime.strptime(remembered_at, COOKIE_TIMESTAMP_FORMAT)
+ except ValueError:
+ return False
+
+ age = datetime.utcnow() - remembered_at_time
+ if age.total_seconds() > g.OTP_COOKIE_TTL:
+ return False
+
+ # validate
+ expected_cookie = c.user.make_otp_cookie(remembered_at)
+ return constant_time_compare(cookie, expected_cookie)
+
+
def valid_feed(name, feedhash, path):
if name and feedhash and path:
from r2.lib.template_helpers import add_sr
View
35 r2/r2/public/static/css/reddit.css
@@ -3600,7 +3600,8 @@ ul.tabmenu.formtab {
.roundfield textarea,
.roundfield input[type=text],
-.roundfield input[type=password] {
+.roundfield input[type=password],
+.roundfield input[type=number] {
font-size: 100%;
width: 492px;
padding: 3px;
@@ -5408,8 +5409,13 @@ tr.gold-accent + tr > td {
}
.adminpasswordform {
- margin-bottom: .5em;
- display: inline-block;
+ display: block;
+ margin: .5em auto 0 auto;
+}
+
+.adminpasswordform label {
+ display: block;
+ padding: .5em;
}
.content.api-help {
@@ -5622,3 +5628,26 @@ tr.gold-accent + tr > td {
.sr-description p {
margin: .75em 0;
}
+
+/** one-time password stuff **/
+#pref-otp .roundfield {
+ margin: 1em 0;
+}
+
+#pref-otp-qr {
+ display: none;
+}
+
+#otp-secret-info {
+ margin: 2em;
+ width: 512px;
+ font-size: small;
+}
+
+#otp-secret-info div {
+ margin: 1em 0;
+}
+
+#otp-secret-info .secret {
+ font-weight: bold;
+}
View
28 r2/r2/public/static/js/lib/jquery.qrcode.min.js
@@ -0,0 +1,28 @@
+(function(r){r.fn.qrcode=function(h){var s;function u(a){this.mode=s;this.data=a}function o(a,c){this.typeNumber=a;this.errorCorrectLevel=c;this.modules=null;this.moduleCount=0;this.dataCache=null;this.dataList=[]}function q(a,c){if(void 0==a.length)throw Error(a.length+"/"+c);for(var d=0;d<a.length&&0==a[d];)d++;this.num=Array(a.length-d+c);for(var b=0;b<a.length-d;b++)this.num[b]=a[b+d]}function p(a,c){this.totalCount=a;this.dataCount=c}function t(){this.buffer=[];this.length=0}u.prototype={getLength:function(){return this.data.length},
+write:function(a){for(var c=0;c<this.data.length;c++)a.put(this.data.charCodeAt(c),8)}};o.prototype={addData:function(a){this.dataList.push(new u(a));this.dataCache=null},isDark:function(a,c){if(0>a||this.moduleCount<=a||0>c||this.moduleCount<=c)throw Error(a+","+c);return this.modules[a][c]},getModuleCount:function(){return this.moduleCount},make:function(){if(1>this.typeNumber){for(var a=1,a=1;40>a;a++){for(var c=p.getRSBlocks(a,this.errorCorrectLevel),d=new t,b=0,e=0;e<c.length;e++)b+=c[e].dataCount;
+for(e=0;e<this.dataList.length;e++)c=this.dataList[e],d.put(c.mode,4),d.put(c.getLength(),j.getLengthInBits(c.mode,a)),c.write(d);if(d.getLengthInBits()<=8*b)break}this.typeNumber=a}this.makeImpl(!1,this.getBestMaskPattern())},makeImpl:function(a,c){this.moduleCount=4*this.typeNumber+17;this.modules=Array(this.moduleCount);for(var d=0;d<this.moduleCount;d++){this.modules[d]=Array(this.moduleCount);for(var b=0;b<this.moduleCount;b++)this.modules[d][b]=null}this.setupPositionProbePattern(0,0);this.setupPositionProbePattern(this.moduleCount-
+7,0);this.setupPositionProbePattern(0,this.moduleCount-7);this.setupPositionAdjustPattern();this.setupTimingPattern();this.setupTypeInfo(a,c);7<=this.typeNumber&&this.setupTypeNumber(a);null==this.dataCache&&(this.dataCache=o.createData(this.typeNumber,this.errorCorrectLevel,this.dataList));this.mapData(this.dataCache,c)},setupPositionProbePattern:function(a,c){for(var d=-1;7>=d;d++)if(!(-1>=a+d||this.moduleCount<=a+d))for(var b=-1;7>=b;b++)-1>=c+b||this.moduleCount<=c+b||(this.modules[a+d][c+b]=
+0<=d&&6>=d&&(0==b||6==b)||0<=b&&6>=b&&(0==d||6==d)||2<=d&&4>=d&&2<=b&&4>=b?!0:!1)},getBestMaskPattern:function(){for(var a=0,c=0,d=0;8>d;d++){this.makeImpl(!0,d);var b=j.getLostPoint(this);if(0==d||a>b)a=b,c=d}return c},createMovieClip:function(a,c,d){a=a.createEmptyMovieClip(c,d);this.make();for(c=0;c<this.modules.length;c++)for(var d=1*c,b=0;b<this.modules[c].length;b++){var e=1*b;this.modules[c][b]&&(a.beginFill(0,100),a.moveTo(e,d),a.lineTo(e+1,d),a.lineTo(e+1,d+1),a.lineTo(e,d+1),a.endFill())}return a},
+setupTimingPattern:function(){for(var a=8;a<this.moduleCount-8;a++)null==this.modules[a][6]&&(this.modules[a][6]=0==a%2);for(a=8;a<this.moduleCount-8;a++)null==this.modules[6][a]&&(this.modules[6][a]=0==a%2)},setupPositionAdjustPattern:function(){for(var a=j.getPatternPosition(this.typeNumber),c=0;c<a.length;c++)for(var d=0;d<a.length;d++){var b=a[c],e=a[d];if(null==this.modules[b][e])for(var f=-2;2>=f;f++)for(var i=-2;2>=i;i++)this.modules[b+f][e+i]=-2==f||2==f||-2==i||2==i||0==f&&0==i?!0:!1}},setupTypeNumber:function(a){for(var c=
+j.getBCHTypeNumber(this.typeNumber),d=0;18>d;d++){var b=!a&&1==(c>>d&1);this.modules[Math.floor(d/3)][d%3+this.moduleCount-8-3]=b}for(d=0;18>d;d++)b=!a&&1==(c>>d&1),this.modules[d%3+this.moduleCount-8-3][Math.floor(d/3)]=b},setupTypeInfo:function(a,c){for(var d=j.getBCHTypeInfo(this.errorCorrectLevel<<3|c),b=0;15>b;b++){var e=!a&&1==(d>>b&1);6>b?this.modules[b][8]=e:8>b?this.modules[b+1][8]=e:this.modules[this.moduleCount-15+b][8]=e}for(b=0;15>b;b++)e=!a&&1==(d>>b&1),8>b?this.modules[8][this.moduleCount-
+b-1]=e:9>b?this.modules[8][15-b-1+1]=e:this.modules[8][15-b-1]=e;this.modules[this.moduleCount-8][8]=!a},mapData:function(a,c){for(var d=-1,b=this.moduleCount-1,e=7,f=0,i=this.moduleCount-1;0<i;i-=2)for(6==i&&i--;;){for(var g=0;2>g;g++)if(null==this.modules[b][i-g]){var n=!1;f<a.length&&(n=1==(a[f]>>>e&1));j.getMask(c,b,i-g)&&(n=!n);this.modules[b][i-g]=n;e--; -1==e&&(f++,e=7)}b+=d;if(0>b||this.moduleCount<=b){b-=d;d=-d;break}}}};o.PAD0=236;o.PAD1=17;o.createData=function(a,c,d){for(var c=p.getRSBlocks(a,
+c),b=new t,e=0;e<d.length;e++){var f=d[e];b.put(f.mode,4);b.put(f.getLength(),j.getLengthInBits(f.mode,a));f.write(b)}for(e=a=0;e<c.length;e++)a+=c[e].dataCount;if(b.getLengthInBits()>8*a)throw Error("code length overflow. ("+b.getLengthInBits()+">"+8*a+")");for(b.getLengthInBits()+4<=8*a&&b.put(0,4);0!=b.getLengthInBits()%8;)b.putBit(!1);for(;!(b.getLengthInBits()>=8*a);){b.put(o.PAD0,8);if(b.getLengthInBits()>=8*a)break;b.put(o.PAD1,8)}return o.createBytes(b,c)};o.createBytes=function(a,c){for(var d=
+0,b=0,e=0,f=Array(c.length),i=Array(c.length),g=0;g<c.length;g++){var n=c[g].dataCount,h=c[g].totalCount-n,b=Math.max(b,n),e=Math.max(e,h);f[g]=Array(n);for(var k=0;k<f[g].length;k++)f[g][k]=255&a.buffer[k+d];d+=n;k=j.getErrorCorrectPolynomial(h);n=(new q(f[g],k.getLength()-1)).mod(k);i[g]=Array(k.getLength()-1);for(k=0;k<i[g].length;k++)h=k+n.getLength()-i[g].length,i[g][k]=0<=h?n.get(h):0}for(k=g=0;k<c.length;k++)g+=c[k].totalCount;d=Array(g);for(k=n=0;k<b;k++)for(g=0;g<c.length;g++)k<f[g].length&&
+(d[n++]=f[g][k]);for(k=0;k<e;k++)for(g=0;g<c.length;g++)k<i[g].length&&(d[n++]=i[g][k]);return d};s=4;for(var j={PATTERN_POSITION_TABLE:[[],[6,18],[6,22],[6,26],[6,30],[6,34],[6,22,38],[6,24,42],[6,26,46],[6,28,50],[6,30,54],[6,32,58],[6,34,62],[6,26,46,66],[6,26,48,70],[6,26,50,74],[6,30,54,78],[6,30,56,82],[6,30,58,86],[6,34,62,90],[6,28,50,72,94],[6,26,50,74,98],[6,30,54,78,102],[6,28,54,80,106],[6,32,58,84,110],[6,30,58,86,114],[6,34,62,90,118],[6,26,50,74,98,122],[6,30,54,78,102,126],[6,26,52,
+78,104,130],[6,30,56,82,108,134],[6,34,60,86,112,138],[6,30,58,86,114,142],[6,34,62,90,118,146],[6,30,54,78,102,126,150],[6,24,50,76,102,128,154],[6,28,54,80,106,132,158],[6,32,58,84,110,136,162],[6,26,54,82,110,138,166],[6,30,58,86,114,142,170]],G15:1335,G18:7973,G15_MASK:21522,getBCHTypeInfo:function(a){for(var c=a<<10;0<=j.getBCHDigit(c)-j.getBCHDigit(j.G15);)c^=j.G15<<j.getBCHDigit(c)-j.getBCHDigit(j.G15);return(a<<10|c)^j.G15_MASK},getBCHTypeNumber:function(a){for(var c=a<<12;0<=j.getBCHDigit(c)-
+j.getBCHDigit(j.G18);)c^=j.G18<<j.getBCHDigit(c)-j.getBCHDigit(j.G18);return a<<12|c},getBCHDigit:function(a){for(var c=0;0!=a;)c++,a>>>=1;return c},getPatternPosition:function(a){return j.PATTERN_POSITION_TABLE[a-1]},getMask:function(a,c,d){switch(a){case 0:return 0==(c+d)%2;case 1:return 0==c%2;case 2:return 0==d%3;case 3:return 0==(c+d)%3;case 4:return 0==(Math.floor(c/2)+Math.floor(d/3))%2;case 5:return 0==c*d%2+c*d%3;case 6:return 0==(c*d%2+c*d%3)%2;case 7:return 0==(c*d%3+(c+d)%2)%2;default:throw Error("bad maskPattern:"+
+a);}},getErrorCorrectPolynomial:function(a){for(var c=new q([1],0),d=0;d<a;d++)c=c.multiply(new q([1,l.gexp(d)],0));return c},getLengthInBits:function(a,c){if(1<=c&&10>c)switch(a){case 1:return 10;case 2:return 9;case s:return 8;case 8:return 8;default:throw Error("mode:"+a);}else if(27>c)switch(a){case 1:return 12;case 2:return 11;case s:return 16;case 8:return 10;default:throw Error("mode:"+a);}else if(41>c)switch(a){case 1:return 14;case 2:return 13;case s:return 16;case 8:return 12;default:throw Error("mode:"+
+a);}else throw Error("type:"+c);},getLostPoint:function(a){for(var c=a.getModuleCount(),d=0,b=0;b<c;b++)for(var e=0;e<c;e++){for(var f=0,i=a.isDark(b,e),g=-1;1>=g;g++)if(!(0>b+g||c<=b+g))for(var h=-1;1>=h;h++)0>e+h||c<=e+h||0==g&&0==h||i==a.isDark(b+g,e+h)&&f++;5<f&&(d+=3+f-5)}for(b=0;b<c-1;b++)for(e=0;e<c-1;e++)if(f=0,a.isDark(b,e)&&f++,a.isDark(b+1,e)&&f++,a.isDark(b,e+1)&&f++,a.isDark(b+1,e+1)&&f++,0==f||4==f)d+=3;for(b=0;b<c;b++)for(e=0;e<c-6;e++)a.isDark(b,e)&&!a.isDark(b,e+1)&&a.isDark(b,e+
+2)&&a.isDark(b,e+3)&&a.isDark(b,e+4)&&!a.isDark(b,e+5)&&a.isDark(b,e+6)&&(d+=40);for(e=0;e<c;e++)for(b=0;b<c-6;b++)a.isDark(b,e)&&!a.isDark(b+1,e)&&a.isDark(b+2,e)&&a.isDark(b+3,e)&&a.isDark(b+4,e)&&!a.isDark(b+5,e)&&a.isDark(b+6,e)&&(d+=40);for(e=f=0;e<c;e++)for(b=0;b<c;b++)a.isDark(b,e)&&f++;a=Math.abs(100*f/c/c-50)/5;return d+10*a}},l={glog:function(a){if(1>a)throw Error("glog("+a+")");return l.LOG_TABLE[a]},gexp:function(a){for(;0>a;)a+=255;for(;256<=a;)a-=255;return l.EXP_TABLE[a]},EXP_TABLE:Array(256),
+LOG_TABLE:Array(256)},m=0;8>m;m++)l.EXP_TABLE[m]=1<<m;for(m=8;256>m;m++)l.EXP_TABLE[m]=l.EXP_TABLE[m-4]^l.EXP_TABLE[m-5]^l.EXP_TABLE[m-6]^l.EXP_TABLE[m-8];for(m=0;255>m;m++)l.LOG_TABLE[l.EXP_TABLE[m]]=m;q.prototype={get:function(a){return this.num[a]},getLength:function(){return this.num.length},multiply:function(a){for(var c=Array(this.getLength()+a.getLength()-1),d=0;d<this.getLength();d++)for(var b=0;b<a.getLength();b++)c[d+b]^=l.gexp(l.glog(this.get(d))+l.glog(a.get(b)));return new q(c,0)},mod:function(a){if(0>
+this.getLength()-a.getLength())return this;for(var c=l.glog(this.get(0))-l.glog(a.get(0)),d=Array(this.getLength()),b=0;b<this.getLength();b++)d[b]=this.get(b);for(b=0;b<a.getLength();b++)d[b]^=l.gexp(l.glog(a.get(b))+c);return(new q(d,0)).mod(a)}};p.RS_BLOCK_TABLE=[[1,26,19],[1,26,16],[1,26,13],[1,26,9],[1,44,34],[1,44,28],[1,44,22],[1,44,16],[1,70,55],[1,70,44],[2,35,17],[2,35,13],[1,100,80],[2,50,32],[2,50,24],[4,25,9],[1,134,108],[2,67,43],[2,33,15,2,34,16],[2,33,11,2,34,12],[2,86,68],[4,43,27],
+[4,43,19],[4,43,15],[2,98,78],[4,49,31],[2,32,14,4,33,15],[4,39,13,1,40,14],[2,121,97],[2,60,38,2,61,39],[4,40,18,2,41,19],[4,40,14,2,41,15],[2,146,116],[3,58,36,2,59,37],[4,36,16,4,37,17],[4,36,12,4,37,13],[2,86,68,2,87,69],[4,69,43,1,70,44],[6,43,19,2,44,20],[6,43,15,2,44,16],[4,101,81],[1,80,50,4,81,51],[4,50,22,4,51,23],[3,36,12,8,37,13],[2,116,92,2,117,93],[6,58,36,2,59,37],[4,46,20,6,47,21],[7,42,14,4,43,15],[4,133,107],[8,59,37,1,60,38],[8,44,20,4,45,21],[12,33,11,4,34,12],[3,145,115,1,146,
+116],[4,64,40,5,65,41],[11,36,16,5,37,17],[11,36,12,5,37,13],[5,109,87,1,110,88],[5,65,41,5,66,42],[5,54,24,7,55,25],[11,36,12],[5,122,98,1,123,99],[7,73,45,3,74,46],[15,43,19,2,44,20],[3,45,15,13,46,16],[1,135,107,5,136,108],[10,74,46,1,75,47],[1,50,22,15,51,23],[2,42,14,17,43,15],[5,150,120,1,151,121],[9,69,43,4,70,44],[17,50,22,1,51,23],[2,42,14,19,43,15],[3,141,113,4,142,114],[3,70,44,11,71,45],[17,47,21,4,48,22],[9,39,13,16,40,14],[3,135,107,5,136,108],[3,67,41,13,68,42],[15,54,24,5,55,25],[15,
+43,15,10,44,16],[4,144,116,4,145,117],[17,68,42],[17,50,22,6,51,23],[19,46,16,6,47,17],[2,139,111,7,140,112],[17,74,46],[7,54,24,16,55,25],[34,37,13],[4,151,121,5,152,122],[4,75,47,14,76,48],[11,54,24,14,55,25],[16,45,15,14,46,16],[6,147,117,4,148,118],[6,73,45,14,74,46],[11,54,24,16,55,25],[30,46,16,2,47,17],[8,132,106,4,133,107],[8,75,47,13,76,48],[7,54,24,22,55,25],[22,45,15,13,46,16],[10,142,114,2,143,115],[19,74,46,4,75,47],[28,50,22,6,51,23],[33,46,16,4,47,17],[8,152,122,4,153,123],[22,73,45,
+3,74,46],[8,53,23,26,54,24],[12,45,15,28,46,16],[3,147,117,10,148,118],[3,73,45,23,74,46],[4,54,24,31,55,25],[11,45,15,31,46,16],[7,146,116,7,147,117],[21,73,45,7,74,46],[1,53,23,37,54,24],[19,45,15,26,46,16],[5,145,115,10,146,116],[19,75,47,10,76,48],[15,54,24,25,55,25],[23,45,15,25,46,16],[13,145,115,3,146,116],[2,74,46,29,75,47],[42,54,24,1,55,25],[23,45,15,28,46,16],[17,145,115],[10,74,46,23,75,47],[10,54,24,35,55,25],[19,45,15,35,46,16],[17,145,115,1,146,116],[14,74,46,21,75,47],[29,54,24,19,
+55,25],[11,45,15,46,46,16],[13,145,115,6,146,116],[14,74,46,23,75,47],[44,54,24,7,55,25],[59,46,16,1,47,17],[12,151,121,7,152,122],[12,75,47,26,76,48],[39,54,24,14,55,25],[22,45,15,41,46,16],[6,151,121,14,152,122],[6,75,47,34,76,48],[46,54,24,10,55,25],[2,45,15,64,46,16],[17,152,122,4,153,123],[29,74,46,14,75,47],[49,54,24,10,55,25],[24,45,15,46,46,16],[4,152,122,18,153,123],[13,74,46,32,75,47],[48,54,24,14,55,25],[42,45,15,32,46,16],[20,147,117,4,148,118],[40,75,47,7,76,48],[43,54,24,22,55,25],[10,
+45,15,67,46,16],[19,148,118,6,149,119],[18,75,47,31,76,48],[34,54,24,34,55,25],[20,45,15,61,46,16]];p.getRSBlocks=function(a,c){var d=p.getRsBlockTable(a,c);if(void 0==d)throw Error("bad rs block @ typeNumber:"+a+"/errorCorrectLevel:"+c);for(var b=d.length/3,e=[],f=0;f<b;f++)for(var h=d[3*f+0],g=d[3*f+1],j=d[3*f+2],l=0;l<h;l++)e.push(new p(g,j));return e};p.getRsBlockTable=function(a,c){switch(c){case 1:return p.RS_BLOCK_TABLE[4*(a-1)+0];case 0:return p.RS_BLOCK_TABLE[4*(a-1)+1];case 3:return p.RS_BLOCK_TABLE[4*
+(a-1)+2];case 2:return p.RS_BLOCK_TABLE[4*(a-1)+3]}};t.prototype={get:function(a){return 1==(this.buffer[Math.floor(a/8)]>>>7-a%8&1)},put:function(a,c){for(var d=0;d<c;d++)this.putBit(1==(a>>>c-d-1&1))},getLengthInBits:function(){return this.length},putBit:function(a){var c=Math.floor(this.length/8);this.buffer.length<=c&&this.buffer.push(0);a&&(this.buffer[c]|=128>>>this.length%8);this.length++}};"string"===typeof h&&(h={text:h});h=r.extend({},{render:"canvas",width:256,height:256,typeNumber:-1,
+correctLevel:2,background:"#ffffff",foreground:"#000000"},h);return this.each(function(){var a;if("canvas"==h.render){a=new o(h.typeNumber,h.correctLevel);a.addData(h.text);a.make();var c=document.createElement("canvas");c.width=h.width;c.height=h.height;for(var d=c.getContext("2d"),b=h.width/a.getModuleCount(),e=h.height/a.getModuleCount(),f=0;f<a.getModuleCount();f++)for(var i=0;i<a.getModuleCount();i++){d.fillStyle=a.isDark(f,i)?h.foreground:h.background;var g=Math.ceil((i+1)*b)-Math.floor(i*b),
+j=Math.ceil((f+1)*b)-Math.floor(f*b);d.fillRect(Math.round(i*b),Math.round(f*e),g,j)}}else{a=new o(h.typeNumber,h.correctLevel);a.addData(h.text);a.make();c=r("<table></table>").css("width",h.width+"px").css("height",h.height+"px").css("border","0px").css("border-collapse","collapse").css("background-color",h.background);d=h.width/a.getModuleCount();b=h.height/a.getModuleCount();for(e=0;e<a.getModuleCount();e++){f=r("<tr></tr>").css("height",b+"px").appendTo(c);for(i=0;i<a.getModuleCount();i++)r("<td></td>").css("width",
+d+"px").css("background-color",a.isDark(e,i)?h.foreground:h.background).appendTo(f)}}a=c;jQuery(a).appendTo(this)})}})(jQuery);
View
23 r2/r2/public/static/js/qrcode.js
@@ -0,0 +1,23 @@
+(function($) {
+ $.fn.make_totp_qrcode = function (secret) {
+ var form = $('#pref-otp'),
+ newform = $('#pref-otp-qr'),
+ placeholder = $('<div>'),
+ uri = ('otpauth://totp/' + r.config.logged + '@' +
+ r.config.cur_domain + '?secret=' + secret)
+
+ newform.find('#otp-secret-info').append(
+ placeholder,
+ $('<p class="secret">').text(secret)
+ )
+
+ placeholder.qrcode({
+ width: 256,
+ height: 256,
+ text: uri
+ })
+
+ newform.show()
+ form.hide()
+ }
+})(jQuery)
View
19 r2/r2/templates/passwordverificationform.html
@@ -43,6 +43,25 @@
${error_field("WRONG_PASSWORD", "password")}
</%utils:round_field>
+ <%utils:round_field title="${_('one-time password')}" description="${_('(required)')}" css_class="adminpasswordform">
+ <input type="text" name="otp" maxlength="6" tabindex="1" required pattern="[0-9]{6}" autocomplete="off"
+ % if c.otp_cached:
+ disabled
+ % endif
+ />
+ ${error_field("WRONG_PASSWORD", "otp")}
+ ${error_field("NO_OTP_SECRET", "otp")}
+ ${error_field("RATELIMIT", "otp")}
+
+ <label>
+ <input type="checkbox" name="remember" tabindex="1"
+ % if c.otp_cached:
+ disabled
+ checked
+ % endif
+ > ${_("remember this computer")}</label>
+ </%utils:round_field>
+
<p><button type="submit" class="btn" tabindex="1">${_('turn admin on')}</button></p>
<p class="status error"></p>
</div>
View
83 r2/r2/templates/prefotp.html
@@ -0,0 +1,83 @@
+## The contents of this file are subject to the Common Public Attribution
+## License Version 1.0. (the "License"); you may not use this file except in
+## compliance with the License. You may obtain a copy of the License at
+## http://code.reddit.com/LICENSE. The License is based on the Mozilla Public
+## License Version 1.1, but Sections 14 and 15 have been added to cover use of
+## software over a computer network and provide for limited attribution for the
+## Original Developer. In addition, Exhibit A has been modified to be
+## consistent with Exhibit B.
+##
+## Software distributed under the License is distributed on an "AS IS" basis,
+## WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for
+## the specific language governing rights and limitations under the License.
+##
+## The Original Code is reddit.
+##
+## The Original Developer is the Initial Developer. The Initial Developer of
+## the Original Code is reddit Inc.
+##
+## All portions of the code written by reddit are Copyright (c) 2006-2012
+## reddit Inc. All Rights Reserved.
+###############################################################################
+
+<%!
+ from r2.lib import js
+ from r2.lib.strings import strings
+%>
+
+<%namespace file="utils.html" import="error_field, _md"/>
+<%namespace name="utils" file="utils.html"/>
+
+<h1>${_("two-factor authentication")}</h1>
+
+% if c.user.otp_secret:
+<form action="/post/disable_otp" method="post" onsubmit="return post_form(this, 'disable_otp')" id="pref-otp">
+
+${_md("two-factor authentication is currently **enabled**. fill out the form below if you would like to disable it.", wrap=True)}
+
+<%utils:round_field title="${_('password')}" description="${_('(required)')}">
+ <input type="password" name="password" />
+ ${error_field("WRONG_PASSWORD", "password")}
+</%utils:round_field>
+
+<%utils:round_field title="${_('one-time password')}" description="${_('(required)')}">
+ <input type="number" name="otp" maxlength="6" />
+ ${error_field("WRONG_PASSWORD", "otp")}
+ ${error_field("NO_OTP_SECRET", "otp")}
+ ${error_field("RATELIMIT", "otp")}
+</%utils:round_field>
+
+<input type="submit" value="${_("disable")}">
+</form>
+% else:
+<form action="/post/generate_otp_secret" method="post" onsubmit="return post_form(this, 'generate_otp_secret')" id="pref-otp">
+
+${_md("enter your current password below to start the activation process for two-factor authentication.", wrap=True)}
+
+<%utils:round_field title="${_('password')}" description="${_('(required)')}">
+ <input type="password" name="password" />
+ ${error_field("WRONG_PASSWORD", "password")}
+</%utils:round_field>
+
+<input type="submit" value="${_("activate")}">
+
+</form>
+
+<form action="/post/enable_otp" method="post" onsubmit="return post_form(this, 'enable_otp')" id="pref-otp-qr">
+
+<div id="otp-secret-info">
+ ${_md("below is your two-factor authentication secret. you can scan the QR code with Google Authenticator or enter the key below manually. you WILL NOT have another chance to see this secret.")}
+</div>
+
+<%utils:round_field title="${_('one-time password')}" description="${_('(required)')}">
+ <input type="number" name="otp" maxlength="6" />
+ ${error_field("WRONG_PASSWORD", "otp")}
+ ${error_field("EXPIRED", "otp")}
+</%utils:round_field>
+
+<input type="submit" value="${_("enable")}">
+
+</form>
+% endif
+
+${unsafe(js.use("qrcode"))}

No commit comments for this range

Something went wrong with that request. Please try again.