<?php
if (basename($_SERVER['SCRIPT_FILENAME']) == basename(__FILE__)){
echo "<p align=center><br><br><br><br><br><br><font size=\"6\" color=\"#FF0000\">ILLEGAL ACCESS !!";
echo "<meta http-equiv=\"refresh\" content=\"2; url=../index.php\">";
exit();} 
?>


 <div class="row">
            <div class="col-md-12">
                <h1 class="page-header">
                    <img src="../themes/img/security.png" class="header-icon" width="30">
                    Security
                </h1>
            </div>
        </div>
        
        
  <?php
 if($googleauntentic == 1){

if(isset($_POST['submit'])) {
  
  
  $pincods = md5($_POST['pincode']);	
$sqlc = mysql_query("SELECT * FROM pincode WHERE username='$user_session'");
$numc = mysql_num_rows($sqlc);
while($rowc = mysql_fetch_array($sqlc)){
$tgl = formatgl($rowc['tgl']);
$pin = $rowc['pin'];
$sts = $rowc['status'];
$lock = $rowc['locks'];
	}
	if(!$numc) {
	header("location: index.php?go=secure&result=no_pin");
	exit;
} else {
if(!$pincods || $pincods <> $pin) {
	header("location: index.php?go=secure&result=wrong_pin");
	exit;
} else {
if($lock == 1) {
	header("location: index.php?go=secure&result=pin_lock");
exit;
	} else {
if($sts == 0) {
	header("location: index.php?go=secure&result=pin_off");
	exit;
} else {	
  
  
  $user = anti_injection($_POST['user']);	
  $nama=$db->dataku("nama", $user);	
  $email=$db->dataku("email", $user);	

  $code    = anti_injection($_POST['one_time_password']);
  $actdsb    = anti_injection($_POST['authgoogle']);
  $result  = $authenticator->verifyCode($secret,$code,$tolerance);
  if($result) {
    // Jika TRUE maka akan menampilkan pesan code valid
    // Code yang akan di eksekusi jika valid misalnya berhail login / apa gitu
	
	
	
	
	
	
	

	
	
	
	
	
	
	if($actdsb == 1){
	$db->update("member", "authgoogle='$actdsb'", "username='$user'");
	$jncvv="activated";
	$isimail2="<a href='http://".$domain."'><img src='".$logoinvoice."' style='display:inline;outline-style:none;text-decoration:none;' /></a><br><br><br>
<p>Hello ".$nama.",</p>
<p>You have enabled 2FA Google Autenticator in your acces member area.<br>
if you do not do this, please contact the administrator to reset your 2FA Google Autenticator.
</p>
<p><br><br><br>
Regards,<br>
<b>".$bisnisname."</b><br>
".$domain."<br>".$emailadmin."<br>".$hpadmin."</p>";
	   
	    $mail2 = new PHPMailer;
		//$mail2->IsSMTP(); // telling the class to use SMTP
        $mail2->Host       = $smtphost; // SMTP server
        $mail2->SMTPAuth   = true;                  // enable SMTP authentication
        $mail2->Host       = $smtphost; // sets the SMTP server
        $mail2->Port       = $smtport;                    // set the SMTP port for the GMAIL server
        $mail2->Username   = $smtpuser; // SMTP account username
        $mail2->Password   = $smtpass;        // SMTP account password
        $mail2->setFrom($emailadmin, $nama_bisnis);
        $mail2->addAddress($email, $nama);
	    $mail2->IsHTML(true);       
        $mail2->Subject = ''.$nama.', Enabled 2FA Google Autenticator';
        $mail2->msgHTML($isimail2);
        $mail2->send();			
	
	}else{
	$db->update("member", "authgoogle='$actdsb', 2fa=''", "username='$user'");
	$jncvv="disabled";
	$isimail2="<a href='http://".$domain."'><img src='".$logoinvoice."' style='display:inline;outline-style:none;text-decoration:none;' /></a><br><br><br>
<p>Hello ".$nama.",</p>
<p>You have disable 2FA Google Autenticator in your acces member area.<br>
if you do not do this, please contact the administrator to reset your 2FA Google Autenticator.
</p>
<p><br><br><br>
Regards,<br>
<b>".$bisnisname."</b><br>
".$domain."<br>".$emailadmin."<br>".$hpadmin."</p>";
	   
	    $mail2 = new PHPMailer;
		//$mail2->IsSMTP(); // telling the class to use SMTP
        $mail2->Host       = $smtphost; // SMTP server
        $mail2->SMTPAuth   = true;                  // enable SMTP authentication
        $mail2->Host       = $smtphost; // sets the SMTP server
        $mail2->Port       = $smtport;                    // set the SMTP port for the GMAIL server
        $mail2->Username   = $smtpuser; // SMTP account username
        $mail2->Password   = $smtpass;        // SMTP account password
        $mail2->setFrom($emailadmin, $nama_bisnis);
        $mail2->addAddress($email, $nama);
	    $mail2->IsHTML(true);       
        $mail2->Subject = ''.$nama.', Disable 2FA Google Autenticator';
        $mail2->msgHTML($isimail2);
        $mail2->send();			
	
	
	}
	header("location: ?go=secure&result=success&s=$jncvv");
	exit;
	
    } else {
    // Jika FALSE maka menampilkan kode tidak valid
    // Code yang akan di eksekusi jika tidak valid, misal error / apa gitu
    header("location: ?go=secure&result=error");
	exit;
  }
}
	}
}
}
} else{
?>     
 
 <?php
 if(isset($_GET['result'])&&$_GET['result']=="success"){
echo "<div class='alert alert-success alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>Two factor authentication has been successfully ".$_GET['s'].".</div>";
}
?>

 <?php
 if(isset($_GET['result'])&&$_GET['result']=="error"){
echo "<div class='alert alert-danger alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>Incorrect 2FA Code! Please enter your google authenticator six-digit code!</div>";
}
?>

<?php
 if(isset($_GET['result'])&&$_GET['result']=="no_pin"){
echo "<div class='alert alert-danger alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>".LANG_FORGOT_NO_PIN."</div>";
}
?>  
 <?php
 if(isset($_GET['result'])&&$_GET['result']=="wrong_pin"){
echo "<div class='alert alert-danger alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>".LANG_FORGOT_WRONG_PIN."</div>";
}
?>  
 <?php
 if(isset($_GET['result'])&&$_GET['result']=="pin_lock"){
echo "<div class='alert alert-danger alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>".LANG_FORGOT_BLOCK_PIN."</div>";
}
?>  

 <?php
 if(isset($_GET['result'])&&$_GET['result']=="pin_off"){
echo "<div class='alert alert-danger alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>".LANG_FORGOT_OFF_PIN."</div>";
}
?>
          <div class="row">
                            <div class="col-md-6">
                    <div class="panel panel-inverse">
                        <div class="panel-heading bg-grey">
                            <h4 class="text-white">Two Factor Setup</h4>
                        </div>
                        <div class="panel-body">
                            <p>To setup two factor authentication you first need to download Google Authenticator:</p>
                            <p><i class="fa fa-android"></i>  <a href="https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2" target="_blank">Google Authenticator for Android (Play Store)</a></p>
                            <p><i class="fa fa-apple"></i>  <a href="https://itunes.apple.com/en/app/google-authenticator/id388497605?mt=8" target="_blank">Google Authenticator for iOS (Apple App Store)</a></p>
                            <p>Then scan the below barcode or, if you are not able to scan the barcode, you can enter the "Security Key" manually.</p>
                            <h4>Security Key: <span style="font-family:Courier;color:#007DE7;letter-spacing:2px;font-size:22px;"><?php if($db->dataku("authgoogle", $user_session) == 1){ echo " xxxxxxxxxx"; }else{ echo $secret; }?></span> <small><em>(Time Based Code)</em></small></h4>

                            <br>
                            <center>
                            <?php if($db->dataku("authgoogle", $user_session) == 1){ ?>
                            <?php echo "<img src='themes/img/hidden.png' width='200'></img>"; ?>
                            <?php } else { ?>
                            <?php echo "<img src='" . $QRCode . "'></img>"; ?>
                            <?php } ?>
                      
</center>
                            <br>

                            <p>Enter the 6 digit code generated by Google Authenticator in the 2FA Code box and switch "Enable Two-Factor" to On</p>
                            <p><span class="label label-danger">Important</span> Save this secret code for future reference</p>
                            <p><em>Note: No Google account is required to use Google Authenticator; skip any Google logins</em></p>
                        </div>
                    </div>
                </div>
            
            <div class="col-md-6">
                <div class="panel panel-inverse">
                    <div class="panel-heading bg-grey">
                        <h4 class="text-white">Account Security</h4>
                    </div>

                    <div class="panel-body">
                          <form method="POST" action="" accept-charset="UTF-8" class="form-horizontal">
                   <input type="hidden" class="form-control" name="user" value="<?php echo $user_session; ?>">
                        <fieldset>
                            <p>Two Factor Authentication</p>

                            
                            
                            
                            <div class="form-group">
                                <label for="enable2fa" class="control-label col-md-3">Enable Two-Factor</label>
                                <div class="col-md-9">
                                    <?php if($db->dataku("authgoogle", $user_session) == 1){ ?>
                                    <label class="radio-inline"><input checked="checked" name="authgoogle" type="radio" value="1" id="enable2fa"> On</label>
                                    <label class="radio-inline"><input name="authgoogle" type="radio" value="0" id="enable2fa"> Off</label>
                                    <?php } else { ?>
                                    <label class="radio-inline"><input name="authgoogle" type="radio" value="1" id="enable2fa"> On</label>
                                    <label class="radio-inline"><input checked="checked" name="authgoogle" type="radio" value="0" id="enable2fa"> Off</label>
                                    <?php } ?>
                                </div>
                            </div>
                        </fieldset>
                        
                        <div class="form-group">
                            <label for="2fa" class="control-label col-md-3 text-white">Enter Your PIN</label>
                            <div class="col-md-9">
                                <div class="input-group">
                                    <span class="input-group-addon"><i class="fa fa-key"></i></span>
                                    <input class="form-control" name="pincode" type="password" required='required'>
                                </div>
                            </div>
                        </div>


                        <div class="form-group">
                            <label for="2fa" class="control-label col-md-3">Enter 2FA Code</label>
                            <div class="col-md-9">
                                <div class="input-group">
                                    <span class="input-group-addon"><i class="fa fa-qrcode fa-lg"></i></span>
                                    <input class="form-control" name="one_time_password" type="text">
                                </div>
                            </div>
                        </div>

                        <div class="form-group">
                            <div class="col-md-3"></div>
                            <div class="form-actions col-md-9">
                                <button type="submit" class="btn btn-primary" name="submit">Submit</button>
                                <button type="reset" class="btn btn-default">Cancel</button>
                            </div>
                        </div>
                    </form>
                    </div>
                </div>

                                    <div class="panel panel-inverse">
                        <div class="panel-heading bg-grey">
                            <h4 class="text-white">Google Authenticator Guide</h4>
                        </div>

                        <div class="panel-body">
                            <ol>
                                <li>Install Google Authenticator for <a href="https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2" target="_blank">Android</a> or <a href="https://itunes.apple.com/en/app/google-authenticator/id388497605?mt=8" target="_blank">Apple</a> and open Google Authenticator</li>
                                <li>Go to <code>Menu</code> -&gt; <code>Setup Account</code></li>
                                <li>Choose <code>Scan a barcode</code> option, and scan the barcode shown on this page</li>
                                <li><em><b>If you are unable to scan the barcode</b>: Choose <code>Enter provided key</code> and type in the "Security Key"</em></li>
                                <li>A six digit number will now appear in your Google Authenticator app home screen, enter this code into the 2FA form on this page</li>
                                <li>Every time you login to <?php echo $bisnisname; ?> you must enter the new 2FA code from your Google Authenticator into the 2FA box on the login form</li><li>Contact administrator if you want to reset your 2FA Google Authenticator.</li>
                            </ol>
                        </div>
                    </div>
                            </div>
        </div>

<?php } ?>
<?php } else {
	
echo "<div class='alert alert-info alert-dismissable'><button type='button' class='close' data-dismiss='alert' aria-hidden='true'></button>Two factor authentication has been disable by administrator.</div>";
}
?>