<?php
if (basename($_SERVER['SCRIPT_FILENAME']) == basename(__FILE__)){
echo "<p align=center><br><br><br><br><br><br><font size=\"6\" color=\"#FF0000\">ILLEGAL ACCESS !!";
echo "<meta http-equiv=\"refresh\" content=\"2; url=../index.php\">";
exit();} 
?>
 <!-- Content Header (Page header) -->
    <section class="content-header">
      <h1>
        Security
      </h1>
      <ol class="breadcrumb">
        <li class="breadcrumb-item"><a href="#"><i class="fa fa-dashboard"></i> Home</a></li>
        <li class="breadcrumb-item active">Security</li>
      </ol>
    </section>


    <section class="content">

  <?php
 if($googleauntentic == 1){

if(isset($_POST['submit'])) {
  
  
  $pincods = md5($_POST['pincode']);	
$sqlc = mysql_query("SELECT * FROM pincode WHERE username='$user_session'");
$numc = mysql_num_rows($sqlc);
while($rowc = mysql_fetch_array($sqlc)){
$tgl = formatgl($rowc['tgl']);
$pin = $rowc['pin'];
$sts = $rowc['status'];
$lock = $rowc['locks'];
	}
	if($usepins == 1 && !$numc) {
	header("location: index.php?go=secure&result=no_pin");
	exit;
} else {
if($usepins == 1 && !$pincods || $usepins == 1 && $pincods <> $pin) {
	header("location: index.php?go=secure&result=wrong_pin");
	exit;
} else {
if($usepins == 1 && $lock == 1) {
	header("location: index.php?go=secure&result=pin_lock");
exit;
	} else {
if($usepins == 1 && $sts == 0) {
	header("location: index.php?go=secure&result=pin_off");
	exit;
} else {	
  
  
  $user = anti_injection($_POST['user']);	
  $nama=$db->dataku("nama", $user);	
  $email=$db->dataku("email", $user);	
  $hp=$db->dataku("hp", $user);	
  
  
$ipne = $_SERVER['REMOTE_ADDR'];
$hostaddress = gethostbyaddr($ipne);
$browser = $_SERVER['HTTP_USER_AGENT'];
	$tgl = formatgl($clientdate);

  $code    = anti_injection($_POST['one_time_password']);
  $actdsb    = anti_injection($_POST['authgoogle']);
  $result  = $authenticator->verifyCode($secret,$code,$tolerance);
  if($result) {
    // Jika TRUE maka akan menampilkan pesan code valid
    // Code yang akan di eksekusi jika valid misalnya berhail login / apa gitu
	
	
	
	
	
	
	

	
	
	
	
	
	
	if($actdsb == 1){
	$db->update("member", "authgoogle='$actdsb'", "username='$user'");
	$jncvv="activated";
	$isimail2="<a href='http://".$domain."'><img src='".$logoinvoice."' style='display:inline;outline-style:none;text-decoration:none;' /></a><br><br><br>
<p>Hello ".$nama.",</p>
<p>You have enabled 2FA Google Autenticator in your acces member area.<br>
IP Address: ".$ipne."<br>
Hostnamme: ".$hostaddress."<br>
Browser : ".$browser."<br>
Date : ".$tgl."<br><br>
If you do not do this, please login, reset your Password and PIN and contact administrator to reset your 2FA Google Autenticator.
</p>
<p><br><br><br>
Regards,<br>
<b>".$bisnisname."</b><br>
".$domain."<br>".$emailadmin."<br>".$hpadmin."</p>";
	   
	    $mail2 = new PHPMailer;
		//$mail2->IsSMTP(); // telling the class to use SMTP
        $mail2->Host       = $smtphost; // SMTP server
        $mail2->SMTPAuth   = true;                  // enable SMTP authentication
        $mail2->Host       = $smtphost; // sets the SMTP server
        $mail2->Port       = $smtport;                    // set the SMTP port for the GMAIL server
        $mail2->Username   = $smtpuser; // SMTP account username
        $mail2->Password   = $smtpass;        // SMTP account password
        $mail2->setFrom($emailadmin, $nama_bisnis);
        $mail2->addAddress($email, $nama);
	    $mail2->IsHTML(true);       
        $mail2->Subject = ''.$nama.', Enabled 2FA Google Autenticator';
        $mail2->msgHTML($isimail2);
        $mail2->send();	
$isipesan = "Hello ".$nama." (".$user."), You have enabled 2FA Google Autenticator in your acces member area.";
sendwa($hp, $isipesan, $apikeywoowa);			
	
	}else{
	$db->update("member", "authgoogle='$actdsb', 2fa=''", "username='$user'");
	$jncvv="disabled";
	$isimail2="<a href='http://".$domain."'><img src='".$logoinvoice."' style='display:inline;outline-style:none;text-decoration:none;' /></a><br><br><br>
<p>Hello ".$nama.",</p>
<p>You have disable 2FA Google Autenticator in your acces member area.<br>
IP Address: ".$ipne."<br>
Hostnamme: ".$hostaddress."<br>
Browser : ".$browser."<br>
Date : ".$tgl."<br><br>
If you do not do this, please login, reset your Password and PIN and contact administrator to reset your 2FA Google Autenticator.
</p>
<p><br><br><br>
Regards,<br>
<b>".$bisnisname."</b><br>
".$domain."<br>".$emailadmin."<br>".$hpadmin."</p>";
	   
	    $mail2 = new PHPMailer;
		//$mail2->IsSMTP(); // telling the class to use SMTP
        $mail2->Host       = $smtphost; // SMTP server
        $mail2->SMTPAuth   = true;                  // enable SMTP authentication
        $mail2->Host       = $smtphost; // sets the SMTP server
        $mail2->Port       = $smtport;                    // set the SMTP port for the GMAIL server
        $mail2->Username   = $smtpuser; // SMTP account username
        $mail2->Password   = $smtpass;        // SMTP account password
        $mail2->setFrom($emailadmin, $nama_bisnis);
        $mail2->addAddress($email, $nama);
	    $mail2->IsHTML(true);       
        $mail2->Subject = ''.$nama.', Disable 2FA Google Autenticator';
        $mail2->msgHTML($isimail2);
        $mail2->send();	
$isipesan = "Hello ".$nama." (".$user."), You have disable 2FA Google Autenticator in your acces member area.";
sendwa($hp, $isipesan, $apikeywoowa);			
	
	
	}
	header("location: ?go=secure&result=success&s=$jncvv");
	exit;
	
    } else {
    // Jika FALSE maka menampilkan kode tidak valid
    // Code yang akan di eksekusi jika tidak valid, misal error / apa gitu
    header("location: ?go=secure&result=error");
	exit;
  }
}
	}
}
}
} else{
?>     
 
 <?php
 if(isset($_GET['result'])&&$_GET['result']=="success"){
echo "<div class='alert alert-success alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>Two factor authentication has been successfully ".$_GET['s'].".</div>";
}
?>

 <?php
 if(isset($_GET['result'])&&$_GET['result']=="error"){
echo "<div class='alert alert-danger alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>Incorrect 2FA Code! Please enter your google authenticator six-digit code!</div>";
}
?>

<?php
 if(isset($_GET['result'])&&$_GET['result']=="no_pin"){
echo "<div class='alert alert-danger alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>".LANG_FORGOT_NO_PIN."</div>";
}
?>  
 <?php
 if(isset($_GET['result'])&&$_GET['result']=="wrong_pin"){
echo "<div class='alert alert-danger alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>".LANG_FORGOT_WRONG_PIN."</div>";
}
?>  
 <?php
 if(isset($_GET['result'])&&$_GET['result']=="pin_lock"){
echo "<div class='alert alert-danger alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>".LANG_FORGOT_BLOCK_PIN."</div>";
}
?>  

 <?php
 if(isset($_GET['result'])&&$_GET['result']=="pin_off"){
echo "<div class='alert alert-danger alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>".LANG_FORGOT_OFF_PIN."</div>";
}
?>
          <div class="row">
                          
                          
                         
                          
                            <div class="col-md-6">
                            
                            
                               <div class="box">
            <div class="box-header with-border">
              <h3 class="box-title">Two Factor Setup</h3>
            </div>
            <div class="box-body">            
                            
                            
                            
                            
                            <?php if($db->dataku("authgoogle", $user_session) == 0){ ?>
                           
                            <p>To setup two factor authentication you first need to download Google Authenticator:</p>
                            <p><i class="fa fa-android"></i>  <a href="https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2" target="_blank">Google Authenticator for Android (Play Store)</a></p>
                            <p><i class="fa fa-apple"></i>  <a href="https://itunes.apple.com/en/app/google-authenticator/id388497605?mt=8" target="_blank">Google Authenticator for iOS (Apple App Store)</a></p>
                            <p>Then scan the below barcode or, if you are not able to scan the barcode, you can enter the "Security Key" manually.</p>
                            <h4>Security Key: <span style="font-family:Courier;color:#007DE7;letter-spacing:2px;font-size:22px;"><?php if($db->dataku("authgoogle", $user_session) == 1){ echo " xxxxxxxxxx"; }else{ echo $secret; }?></span> <small><em>(Time Based Code)</em></small></h4>

                            <br>
                            <center>
                            <?php if($db->dataku("authgoogle", $user_session) == 1){ ?>
                            <?php echo "<img src='../themes/img/hidden.png' width='200'></img>"; ?>
                            <?php } else { ?>
                            <?php echo "<img src='" . $QRCode . "'></img>"; ?>
                            <?php } ?>
                      
</center>
                            <br>

                            <p>Enter the 6 digit code generated by Google Authenticator in the 2FA Code box and switch "Enable Two-Factor" to On</p>
                            <p><span class="label label-danger">Important</span> Save this secret code for future reference</p>
                            <p><em>Note: No Google account is required to use Google Authenticator; skip any Google logins</em></p>
                            
                            
                             <?php } else { ?>
                            <div class='alert alert-success alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>Google Two factor authentication is Active</div>
                            
                             <?php } ?>
                            
                        </div>
                    </div>
                </div>
            
            <div class="col-md-6">
            
                     <div class="box">
            <div class="box-header with-border">
              <h3 class="box-title">Account Security</h3>
            </div>
            <div class="box-body">        
            
                          <form method="POST" action="" accept-charset="UTF-8" class="form-horizontal">
                   <input type="hidden" class="form-control" name="user" value="<?php echo $user_session; ?>">
                        <fieldset>
                            <p>Two Factor Authentication</p>

                            
                            
                            
                            <div class="form-group">
                                <label for="enable2fa" class="control-label col-md-3">Enable 2FA</label>
                                <div class="col-md-9">
                                     <select name="authgoogle" id="enable2fa" class="form-control" required='required'>
									<?php if($db->dataku("authgoogle", $user_session) == 1){ ?>
                                     <option value='1' selected="selected">On</option>  
									 <option value='0'>Off</option> 
									<?php } else { ?>
                                    <option value='1'>On</option>  
									 <option value='0' selected="selected">Off</option> 
                                     <?php } ?>
                                    </select>
                                    
                                </div>
                            </div>
                        </fieldset>
                        <?php if($usepins == 1){ ?>
                        <div class="form-group">
                            <label for="2fa" class="control-label col-md-3">Secure PIN</label>
                            <div class="col-md-9">
                                <div class="input-group">
                                    <span class="input-group-addon"><i class="fa fa-key"></i></span>
                                    <input class="form-control" name="pincode" type="password" required='required'>
                                </div>
                            </div>
                        </div>
                        <?php } ?>


                        <div class="form-group">
                            <label for="2fa" class="control-label col-md-3">Enter 2FA Code</label>
                            <div class="col-md-9">
                                <div class="input-group">
                                    <span class="input-group-addon"><i class="fa fa-qrcode fa-lg"></i></span>
                                    <input class="form-control" name="one_time_password" type="text">
                                </div>
                            </div>
                        </div>

                        <div class="form-group">
                            <div class="col-md-3"></div>
                            <div class="form-actions col-md-9">
                                <button type="submit" class="btn btn-<?php echo $buttone; ?>" name="submit">Submit</button>
                            </div>
                        </div>
                    </form>
                    </div>
                </div>

                                   
                             <div class="box">
            <div class="box-header with-border">
              <h3 class="box-title">Google Authenticator Guide</h3>
            </div>
            <div class="box-body">                  
                                   
                            <ol>
                                <li>Install Google Authenticator for <a href="https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2" target="_blank">Android</a> or <a href="https://itunes.apple.com/en/app/google-authenticator/id388497605?mt=8" target="_blank">Apple</a> and open Google Authenticator</li>
                                <li>Go to <code>Menu</code> -&gt; <code>Setup Account</code></li>
                                <li>Choose <code>Scan a barcode</code> option, and scan the barcode shown on this page</li>
                                <li><em><b>If you are unable to scan the barcode</b>: Choose <code>Enter provided key</code> and type in the "Security Key"</em></li>
                                <li>A six digit number will now appear in your Google Authenticator app home screen, enter this code into the 2FA form on this page</li>
                                <li>Every time you login to <?php echo $bisnisname; ?> you must enter the new 2FA code from your Google Authenticator into the 2FA box on the login form</li><li>Contact administrator if you want to reset your 2FA Google Authenticator.</li>
                            </ol>
                        </div>
                    </div>
                            </div>
        </div>

<?php } ?>
<?php } else {
	
echo "<div class='alert alert-info alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>Two factor authentication has been disable by administrator.</div>";
}
?>
 </section>         