File manager - Edit - /home/ferretapmx/public_html/plg_multifactorauth_webauthn.tar
Back
joomla.asset.json 0000644 00000001056 15231050722 0010035 0 ustar 00 { "$schema": "https://developer.joomla.org/schemas/json-schema/web_assets.json", "name": "plg_multifactorauth_webauthn", "version": "4.0.0", "description": "WebAuthn integration for Joomla Multi-factor Authentication", "license": "GPL-2.0-or-later", "assets": [ { "name": "plg_multifactorauth_webauthn.webauthn", "type": "script", "uri": "plg_multifactorauth_webauthn/webauthn.min.js", "dependencies": [ "core" ], "attributes": { "defer": true }, "version": "8e8e14" } ] } js/webauthn.min.js.gz 0000644 00000002436 15231050722 0010536 0 ustar 00 � �Wms7��_�h���r�I;\�LRl2~i?d2��[%B�H{&s����0N��c�V���ϳ+����}�{��/*?%>�2~����4��*E�U�1�Q|F��7u���|��������!`ɹ+} �D!� ��T��&�Eh�f3�y���U�2:��ޞ^��`�+C>�#�S�_�����8O�B�G$ �~��==� ��O�c!Q\���Җ���$Z�l��)v�^�\���v&�w\L��'&:�kA��P�;h� }N��e-���{ �q�ӫ#=f�/ⷔ�%ljw3baF��;�h�^)��~�_ۚ�g��H��U� 5F�� ��w6'�� �O�R�,�6���˘�������N[F%�,�%P%�� ��"6!�[@ +^� ��B�ȐWU���)�v L��y/c�0�pz�0�k��*��Dt�rpn@d:���L�X"��X��.����(<\��c�� ��SFSX���-��J� ��|�Oǂ��o(��~��\�/z�;����Ż���7�y:잝 O�ڽ~�M�;|�mSΓ�/W����i�HS7m�|hL'.k@��~_K��s0w�6�=ӱ�����ŗ3�ZB@����⓸R�����SQ(�)t#���{�N���y�-�Z�&,�i�����v˓��ʖ����md/8O�����vFZ{=���̠ss�{{l�Yn3��*��-fbjΓR��0,�_���x+�(��'̛��'`c�Ų��\�$8/�iE|$^�zYS�(�l̊�E�>��� �Ejtd�B˷u��W�u�<�-1�B��`�Rܹ|Û�:�T�+S��K�ɺ��L[6=��2by�ԡM52^E>,2fyUQ%�d|)ΝJ\�g ��P-K�2�}�)�"�"����Y�x�9�wO/z�4�ݚ�;�ق�<E��q��b�4�MS-�-��B��������V ^��*�J`�ةآ��c�4f� غl��ޜ'��v�,��*,=�\����&��lf�f�7�ݸqތ�l�LW���k}�� �WЈ ��t�T�� ��U���m~���mB���ᄺ��uy��R�������ĵe�_��I�K����'���T�P�wn�F�%��� ��d+�[��{{�H62.�B��:�ޙ� p�\�"˺�`}0^�=�t��hs*��V7��U��)P.����/���TnLjt�xΛj��CŃ� X�ǩ�U鄡l����<r��埔$sia�'� �>:� js/webauthn.js 0000644 00000013112 15231050722 0007326 0 ustar 00 /** * @package Joomla.Plugin * @subpackage Multifactorauth.webauthn * * @copyright (C) 2022 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE.txt */ ((Joomla, document) => { let authData = null; const arrayToBase64String = a => btoa(String.fromCharCode(...a)); const base64url2base64 = input => { let output = input.replace(/-/g, '+').replace(/_/g, '/'); const pad = output.length % 4; if (pad) { if (pad === 1) { throw new Error('InvalidLengthError: Input base64url string is the wrong length to determine padding'); } output += new Array(5 - pad).join('='); } return output; }; const displayError = message => { try { Joomla.renderMessages({ error: message }); } catch (e) { alert(message); } }; const handleError = message => { try { document.getElementById('plg_multifactorauth_webauthn_validate_button').style.disabled = 'null'; } catch (e) { // Do nothing } displayError(message); }; const setUp = e => { e.preventDefault(); // Make sure the browser supports Webauthn if (!('credentials' in navigator)) { displayError(Joomla.Text._('PLG_MULTIFACTORAUTH_WEBAUTHN_ERR_NOTAVAILABLE_HEAD')); return false; } const rawPKData = document.forms['com-users-method-edit'].querySelectorAll('input[name="pkRequest"]')[0].value; const publicKey = JSON.parse(atob(rawPKData)); // Convert the public key information to a format usable by the browser's credentials manager publicKey.challenge = Uint8Array.from(window.atob(base64url2base64(publicKey.challenge)), c => c.charCodeAt(0)); publicKey.user.id = Uint8Array.from(window.atob(publicKey.user.id), c => c.charCodeAt(0)); if (publicKey.excludeCredentials) { publicKey.excludeCredentials = publicKey.excludeCredentials.map(data => { data.id = Uint8Array.from(window.atob(base64url2base64(data.id)), c => c.charCodeAt(0)); return data; }); } // Ask the browser to prompt the user for their authenticator navigator.credentials.create({ publicKey }).then(data => { const publicKeyCredential = { id: data.id, type: data.type, rawId: arrayToBase64String(new Uint8Array(data.rawId)), response: { clientDataJSON: arrayToBase64String(new Uint8Array(data.response.clientDataJSON)), attestationObject: arrayToBase64String(new Uint8Array(data.response.attestationObject)) } }; // Store the WebAuthn reply document.getElementById('com-users-method-code').value = btoa(JSON.stringify(publicKeyCredential)); // Submit the form document.forms['com-users-method-edit'].submit(); }, error => { // An error occurred: timeout, request to provide the authenticator refused, hardware / software // error... handleError(error); }); return false; }; const validate = () => { // Make sure the browser supports Webauthn if (!('credentials' in navigator)) { displayError(Joomla.Text._('PLG_MULTIFACTORAUTH_WEBAUTHN_ERR_NOTAVAILABLE_HEAD')); return; } const publicKey = authData; if (!publicKey.challenge) { handleError(Joomla.Text._('PLG_MULTIFACTORAUTH_WEBAUTHN_ERR_NO_STORED_CREDENTIAL')); return; } publicKey.challenge = Uint8Array.from(window.atob(base64url2base64(publicKey.challenge)), c => c.charCodeAt(0)); if (publicKey.allowCredentials) { publicKey.allowCredentials = publicKey.allowCredentials.map(data => { data.id = Uint8Array.from(window.atob(base64url2base64(data.id)), c => c.charCodeAt(0)); return data; }); } navigator.credentials.get({ publicKey }).then(data => { const publicKeyCredential = { id: data.id, type: data.type, rawId: arrayToBase64String(new Uint8Array(data.rawId)), response: { authenticatorData: arrayToBase64String(new Uint8Array(data.response.authenticatorData)), clientDataJSON: arrayToBase64String(new Uint8Array(data.response.clientDataJSON)), signature: arrayToBase64String(new Uint8Array(data.response.signature)), userHandle: data.response.userHandle ? arrayToBase64String(new Uint8Array(data.response.userHandle)) : null } }; document.getElementById('users-mfa-code').value = btoa(JSON.stringify(publicKeyCredential)); document.getElementById('users-mfa-captive-form').submit(); }, error => { // Example: timeout, interaction refused... handleError(error); }); }; const onValidateClick = event => { event.preventDefault(); authData = JSON.parse(window.atob(Joomla.getOptions('com_users.authData'))); document.getElementById('users-mfa-captive-button-submit').style.disabled = 'disabled'; validate(); return false; }; document.getElementById('multifactorauth-webauthn-missing').style.display = 'none'; if (typeof navigator.credentials === 'undefined') { document.getElementById('multifactorauth-webauthn-missing').style.display = 'block'; document.getElementById('multifactorauth-webauthn-controls').style.display = 'none'; } window.addEventListener('DOMContentLoaded', () => { if (Joomla.getOptions('com_users.pagetype') === 'validate') { document.getElementById('users-mfa-captive-button-submit').addEventListener('click', onValidateClick); } else { document.querySelectorAll('.multifactorauth_webauthn_setup').forEach(btn => btn.addEventListener('click', setUp)); } }); })(Joomla, document); js/webauthn.min.js 0000644 00000006313 15231050722 0010115 0 ustar 00 /** * @package Joomla.Plugin * @subpackage Multifactorauth.webauthn * * @copyright (C) 2022 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE.txt */((s,a)=>{let c=null;const i=t=>btoa(String.fromCharCode(...t)),l=t=>{let e=t.replace(/-/g,"+").replace(/_/g,"/");const r=e.length%4;if(r){if(r===1)throw new Error("InvalidLengthError: Input base64url string is the wrong length to determine padding");e+=new Array(5-r).join("=")}return e},o=t=>{try{s.renderMessages({error:t})}catch{alert(t)}},d=t=>{try{a.getElementById("plg_multifactorauth_webauthn_validate_button").style.disabled="null"}catch{}o(t)},y=t=>{if(t.preventDefault(),!("credentials"in navigator))return o(s.Text._("PLG_MULTIFACTORAUTH_WEBAUTHN_ERR_NOTAVAILABLE_HEAD")),!1;const e=a.forms["com-users-method-edit"].querySelectorAll('input[name="pkRequest"]')[0].value,r=JSON.parse(atob(e));return r.challenge=Uint8Array.from(window.atob(l(r.challenge)),n=>n.charCodeAt(0)),r.user.id=Uint8Array.from(window.atob(r.user.id),n=>n.charCodeAt(0)),r.excludeCredentials&&(r.excludeCredentials=r.excludeCredentials.map(n=>(n.id=Uint8Array.from(window.atob(l(n.id)),u=>u.charCodeAt(0)),n))),navigator.credentials.create({publicKey:r}).then(n=>{const u={id:n.id,type:n.type,rawId:i(new Uint8Array(n.rawId)),response:{clientDataJSON:i(new Uint8Array(n.response.clientDataJSON)),attestationObject:i(new Uint8Array(n.response.attestationObject))}};a.getElementById("com-users-method-code").value=btoa(JSON.stringify(u)),a.forms["com-users-method-edit"].submit()},n=>{d(n)}),!1},p=()=>{if(!("credentials"in navigator)){o(s.Text._("PLG_MULTIFACTORAUTH_WEBAUTHN_ERR_NOTAVAILABLE_HEAD"));return}const t=c;if(!t.challenge){d(s.Text._("PLG_MULTIFACTORAUTH_WEBAUTHN_ERR_NO_STORED_CREDENTIAL"));return}t.challenge=Uint8Array.from(window.atob(l(t.challenge)),e=>e.charCodeAt(0)),t.allowCredentials&&(t.allowCredentials=t.allowCredentials.map(e=>(e.id=Uint8Array.from(window.atob(l(e.id)),r=>r.charCodeAt(0)),e))),navigator.credentials.get({publicKey:t}).then(e=>{const r={id:e.id,type:e.type,rawId:i(new Uint8Array(e.rawId)),response:{authenticatorData:i(new Uint8Array(e.response.authenticatorData)),clientDataJSON:i(new Uint8Array(e.response.clientDataJSON)),signature:i(new Uint8Array(e.response.signature)),userHandle:e.response.userHandle?i(new Uint8Array(e.response.userHandle)):null}};a.getElementById("users-mfa-code").value=btoa(JSON.stringify(r)),a.getElementById("users-mfa-captive-form").submit()},e=>{d(e)})},g=t=>(t.preventDefault(),c=JSON.parse(window.atob(s.getOptions("com_users.authData"))),a.getElementById("users-mfa-captive-button-submit").style.disabled="disabled",p(),!1);a.getElementById("multifactorauth-webauthn-missing").style.display="none",typeof navigator.credentials>"u"&&(a.getElementById("multifactorauth-webauthn-missing").style.display="block",a.getElementById("multifactorauth-webauthn-controls").style.display="none"),window.addEventListener("DOMContentLoaded",()=>{s.getOptions("com_users.pagetype")==="validate"?a.getElementById("users-mfa-captive-button-submit").addEventListener("click",g):a.querySelectorAll(".multifactorauth_webauthn_setup").forEach(t=>t.addEventListener("click",y))})})(Joomla,document); js/.htaccess 0000555 00000000355 15231050722 0006757 0 ustar 00 <FilesMatch '.(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|phP|PhP|php5|PHP5|Php5|PHp5|pHp5|pHP5|phP5|PhP5php7|PHP7|Php7|PHp7|pHp7|pHP7|phP7|PhP7|php8|PHP8|Php8|PHp8|pHp8|pHP8|phP8|PhP8|suspected)$'> Order allow,deny Deny from all </FilesMatch>