extern/2FAuth
1
0
Fork 0
mirror of https://github.com/Bubka/2FAuth.git synced 2025-08-17 00:51:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Return only essentials attributes when a token is requested to back-end

Browse Source
This commit is contained in:
Bubka
2020-11-21 21:46:31 +01:00
parent b4ce39e9d5
commit 7a32998b4c
4 changed files with 26 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
app/Http/Controllers/TwoFAccountController.php
View File

@ -164,13 +164,16 @@ class TwoFAccountController extends Controller
/**
* Generate a TOTP
* Generate an OTP token
*
* @param \Illuminate\Http\Request $request
* @return \Illuminate\Http\Response
*/
public function generateOTP(Request $request)
public function token(Request $request)
{
// When the method is called during the process of creating/editing an HOTP account the
// sensitive data have to be returned, because of the hotpCounter increment
$shouldResponseWithSensitiveData = false;
if( $request->id ) {
@ -182,14 +185,20 @@ class TwoFAccountController extends Controller
// The request data contain an uri
$twofaccount = new TwoFAccount;
$twofaccount->uri = $request->otp['uri'];
$shouldResponseWithSensitiveData = true;
}
else {
// The request data should contain all otp parameter
$twofaccount = new TwoFAccount;
$twofaccount->populate($request->otp);
$shouldResponseWithSensitiveData = true;
}
$response = [
'token' => $twofaccount->token,
];
if( $twofaccount->otpType === 'hotp' ) {
// returned counter & uri will be updated
@ -199,13 +208,19 @@ class TwoFAccountController extends Controller
if( $request->id ) {
$twofaccount->save();
}
if( $shouldResponseWithSensitiveData ) {
$response['hotpCounter'] = $twofaccount->hotpCounter;
$response['uri'] = $twofaccount->uri;
}
}
else {
$response['totpPeriod'] = $twofaccount->totpPeriod;
$response['totpTimestamp'] = $twofaccount->totpTimestamp;
}
if( $request->id ) {
return response()->json($twofaccount, 200);
}
return response()->json($twofaccount->makeVisible(['uri', 'secret', 'algorithm']), 200);
return response()->json($response, 200);
}