Fix 2fa

app/Http/Controllers/Auth/LoginController.php

@@ -83,6 +83,18 @@ class LoginController extends Controller
                     $userIp = config('nntmux:settings.store_user_ip') ? ($request->ip() ?? $request->getClientIp()) : '';
                     event(new UserLoggedIn($user, $userIp));
 
+                    // Check if the user has 2FA enabled
+                    if ($user->passwordSecurity && $user->passwordSecurity->google2fa_enable) {
+                        // Store intended URL for redirecting after 2FA verification
+                        $request->session()->put('url.intended', $this->redirectPath());
+                        Auth::logout();
+
+                        // Store user ID in the session for 2FA verification
+                        $request->session()->put('2fa:user:id', $user->id);
+
+                        return redirect()->route('2fa.verify');
+                    }
+
                     Auth::logoutOtherDevices($request->input('password'));
                     $this->clearLoginAttempts($request);
 

app/Http/Controllers/PasswordSecurityController.php

@@ -9,6 +9,7 @@ use Illuminate\Contracts\View\View;
 use Illuminate\Foundation\Application;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
 
 class PasswordSecurityController extends Controller
@@ -88,4 +89,95 @@ class PasswordSecurityController extends Controller
 
         return redirect()->to('2fa')->with('success', '2FA is now Disabled.');
     }
+
+    /**
+     * Verify the 2FA code provided by the user.
+     */
+    public function verify2fa(Request $request): RedirectResponse
+    {
+        $request->validate([
+            'one_time_password' => 'required|numeric',
+        ]);
+
+        // Get the user ID from session
+        if (!$request->session()->has('2fa:user:id')) {
+            return redirect()->route('login')
+                ->with('message', 'The two-factor authentication session has expired. Please login again.')
+                ->with('message_type', 'danger');
+        }
+
+        $userId = $request->session()->get('2fa:user:id');
+        $user = \App\Models\User::find($userId);
+
+        if (!$user || !$user->passwordSecurity) {
+            $request->session()->forget('2fa:user:id');
+            return redirect()->route('login')
+                ->with('message', 'User not found or 2FA not configured. Please login again.')
+                ->with('message_type', 'danger');
+        }
+
+        // Verify the OTP code
+        $valid = \Google2FA::verifyKey(
+            $user->passwordSecurity->google2fa_secret,
+            $request->input('one_time_password')
+        );
+
+        if (!$valid) {
+            return redirect()->route('2fa.verify')
+                ->with('message', 'Invalid authentication code. Please try again.')
+                ->with('message_type', 'danger');
+        }
+
+        // Log the user back in
+        Auth::login($user);
+
+        // Mark the user as having passed 2FA
+        session([config('google2fa.session_var') => true]);
+
+        // Store the timestamp for determining how long the 2FA session is valid
+        session([config('google2fa.session_var').'.auth.passed_at' => time()]);
+
+        // Clean up the temporary session variable
+        $request->session()->forget('2fa:user:id');
+
+        // Determine where to redirect after successful verification
+        $redirectUrl = $request->session()->pull('url.intended', '/');
+
+        return redirect()->to($redirectUrl)
+            ->with('message', 'Two-factor authentication verified successfully.')
+            ->with('message_type', 'success');
+    }
+
+    /**
+     * Display the 2FA verification form for a user who has already authenticated with username/password
+     * but needs to enter their 2FA code.
+     */
+    public function getVerify2fa(Request $request)
+    {
+        // Check if user ID is stored in the session
+        if (!$request->session()->has('2fa:user:id')) {
+            return redirect()->route('login')
+                ->withErrors(['msg' => 'The two-factor authentication session has expired. Please login again.']);
+        }
+
+        // Get the user ID from session
+        $userId = $request->session()->get('2fa:user:id');
+
+        // Get the user
+        $user = \App\Models\User::find($userId);
+        if (!$user) {
+            $request->session()->forget('2fa:user:id');
+            return redirect()->route('login')
+                ->withErrors(['msg' => 'User not found. Please login again.']);
+        }
+
+        $theme = 'Gentele';
+        $meta_title = 'Two Factor Authentication';
+        $meta_keywords = 'Two Factor Authentication, 2FA';
+        $meta_description = 'Two Factor Authentication Verification';
+
+        app('smarty.view')->assign(compact('meta_title', 'meta_keywords', 'meta_description', 'user'));
+
+        return app('smarty.view')->display($theme.'/2fa_verify.tpl');
+    }
 }

resources/views/themes/Gentele/2fa_verify.tpl

@@ -0,0 +1,126 @@
+<!DOCTYPE html>
+<html lang="{{App::getLocale()}}">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="csrf-token" content="{{csrf_token()}}">
+    <title>{$meta_title}{if $meta_title != "" && $site->metatitle != ""} - {/if}{$site->metatitle}</title>
+    {{Html::style("{{asset('/assets/css/all-css.css')}}")}}
+</head>
+
+<body class="login-page">
+    <div class="container">
+        <div class="row justify-content-center mt-5">
+            <div class="col-md-4 col-lg-3">
+                <div class="card shadow-sm mb-4">
+                    <div class="card-header bg-light">
+                        <h4 class="text-center mb-0">Two-Factor Authentication</h4>
+                    </div>
+
+                    <div class="card-body p-4">
+                        {if Session::has('message')}
+                            <div class="alert {if Session::has('message_type')}alert-{Session::get('message_type')}{else}alert-info{/if} alert-dismissible fade notification-fade" role="alert">
+                                <i class="fa {if Session::has('message_type') && Session::get('message_type') == 'danger'}fa-exclamation-circle{elseif Session::has('message_type') && Session::get('message_type') == 'success'}fa-check-circle{else}fa-info-circle{/if} me-2"></i>
+                                {Session::get('message')}
+                                <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
+                            </div>
+
+                            <style>
+                            .notification-fade {
+                                opacity: 0;
+                                transition: opacity 0.6s ease-in-out;
+                            }
+
+                            .notification-fade.show {
+                                opacity: 1;
+                            }
+                            </style>
+
+                            <script>
+                            document.addEventListener('DOMContentLoaded', function() {
+                                setTimeout(function() {
+                                    const alerts = document.querySelectorAll('.notification-fade');
+                                    alerts.forEach(function(alert) {
+                                        alert.classList.add('show');
+                                    });
+                                }, 100);
+                            });
+                            </script>
+                        {/if}
+
+                        <div class="text-center mb-4">
+                            <a href="{{url('/')}}">
+                                <div class="d-flex justify-content-center align-items-center mb-2">
+                                    <div class="app-logo">
+                                        <i class="fas fa-file-download" aria-hidden="true"></i>
+                                    </div>
+                                    <h3 class="mb-0 ms-2"><b>{{config('app.name')}}</b></h3>
+                                </div>
+                            </a>
+                            <p class="text-muted mt-2">Please enter your one-time verification code</p>
+                        </div>
+
+                        {{Form::open(['url' => route('2faVerify'), 'id' => '2faVerify'])}}
+                            <div class="mb-3">
+                                <div class="input-group">
+                                    <span class="input-group-text"><i class="fas fa-key"></i></span>
+                                    {{Form::text('one_time_password', null, ['placeholder' => 'Authentication Code', 'class' => 'form-control', 'required' => 'required', 'autofocus' => 'autofocus'])}}
+                                </div>
+                                <div class="form-text text-muted">
+                                    Enter the code from your authentication app
+                                </div>
+                            </div>
+
+                            <div class="d-grid gap-2">
+                                {{Form::submit('Verify', ['class' => 'btn btn-success'])}}
+                            </div>
+                        {{Form::close()}}
+                    </div>
+
+                    <div class="card-footer bg-light">
+                        <div class="text-center">
+                            <p class="text-muted small mb-0">
+                                If you're having trouble, please contact the administrator
+                            </p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    <!-- jQuery and scripts -->
+    {{Html::script("{{asset('/assets/js/all-js.js')}}")}}
+
+    <style>
+    .login-page {
+        background-color: #f8f9fa;
+        min-height: 100vh;
+        display: flex;
+        align-items: center;
+    }
+
+    .app-logo {
+        background: linear-gradient(135deg, #4e54c8, #8f94fb);
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+        width: 35px;
+        height: 35px;
+        border-radius: 8px;
+        box-shadow: 0 2px 10px rgba(0, 0, 0, 0.2);
+        transition: all 0.3s ease;
+    }
+
+    .app-logo i {
+        font-size: 18px;
+        color: white;
+    }
+
+    a:hover .app-logo {
+        transform: rotate(5deg);
+        box-shadow: 0 4px 12px rgba(0, 0, 0, 0.3);
+    }
+    </style>
+</body>
+</html>

routes/web.php

@@ -83,6 +83,9 @@ Route::get('login', [LoginController::class, 'showLoginForm'])->name('login');
 Route::post('login', [LoginController::class, 'login'])->name('login.post');
 Route::match(['GET', 'POST'], 'logout', [LoginController::class, 'logout'])->name('logout');
 
+Route::get('2fa/verify', [PasswordSecurityController::class, 'getVerify2fa'])->name('2fa.verify');
+Route::post('2faVerify', [PasswordSecurityController::class, 'verify2fa'])->name('2faVerify');
+
 Route::middleware('isVerified')->group(function () {
     Route::match(['GET', 'POST'], 'resetpassword', [ResetPasswordController::class, 'reset'])->name('resetpassword');
     Route::match(['GET', 'POST'], 'profile', [ProfileController::class, 'show'])->name('profile');
@@ -209,8 +212,4 @@ Route::middleware('role_or_permission:Admin|Moderator|edit release')->prefix('ad
     Route::match(['GET', 'POST'], 'release-edit', [AdminReleasesController::class, 'edit'])->name('admin.release-edit');
 });
 
-Route::post('2faVerify', function () {
-    return redirect()->to(URL()->previous());
-})->name('2faVerify')->middleware('2fa');
-
 Route::post('btcpay/webhook', [BtcPaymentController::class, 'btcPayCallback'])->name('btcpay.webhook');