module CookieCrypt::Controllers::Helpers

Private Instance Methods

authentication_success() click to toggle source
# File lib/cookie_crypt/controllers/helpers.rb, line 12
def authentication_success
  flash[:notice] = 'Signed in through two-factor authentication successfully.'
  warden.session(resource_name)[:need_cookie_crypt_auth] = false
  bypass_sign_in resource
  resource.update_attribute(:cookie_crypt_attempts_count, 0)
  redirect_to stored_location_for(resource_name) || :root
end
encrypted_username_and_pass() click to toggle source
# File lib/cookie_crypt/controllers/helpers.rb, line 26
def encrypted_username_and_pass
  Digest::SHA512.hexdigest("#{resource.username}_#{resource.encrypted_password}")
end
log_agent_to_resource() click to toggle source
# File lib/cookie_crypt/controllers/helpers.rb, line 65
def log_agent_to_resource
  unless using_an_agent_that_is_already_being_used?
    resource.agent_list = "#{resource.agent_list}#{'|' unless resource.agent_list.blank?}#{request.user_agent}"
    resource.save
  end
end
log_hack_attempt() click to toggle source
# File lib/cookie_crypt/controllers/helpers.rb, line 60
def log_hack_attempt
  logger = Logger.new("#{Rails.root.join('log','hack_attempts.log')}")
  logger.warn "Attempt to bypass two factor authentication and devise detected from ip #{request.remote_ip} using #{resource_name}: #{resource.inspect}!"
end
matching_answers?(hash) click to toggle source
# File lib/cookie_crypt/controllers/helpers.rb, line 72
def matching_answers? hash
  answers = []
  answers_from_form = []
  params[:security_answers].each_key do |key|
    answers_from_form << key
  end
  
  unless resource.class.cookie_crypt_auth_through == :all_questions
    if resource.class.cookie_crypt_auth_through == :one_question_cyclical || 
      resource.class.cookie_crypt_auth_through == :two_questions_cyclical

      answers << "security_answer_#{resource.security_cycle+session[:cyclemod]}"
    else #random cyclemod case
      answers << "security_answer_#{session[:cyclemod]}"
    end
  end

  if resource.class.cookie_crypt_auth_through == :two_questions_cyclical
    if session[:cyclemod]+resource.security_cycle+1 <= hash.keys.count/2
      next_question_mod = session[:cyclemod]+resource.security_cycle+1
    else
      next_question_mod = 0
    end

    answers << "security_answer_#{next_question_mod}"
  elsif resource.class.cookie_crypt_auth_through == :two_questions_random
    answers << "security_answer_#{session[:cyclemod2]}"
  elsif resource.class.cookie_crypt_auth_through == :all_questions
    hash.keys.delete_if{|x| x.include?("question")}.each do |key|
      answers << key
    end
  end

  authed = false
  a_arr = []
  answers.each do |key|
    if hash[key] == Digest::SHA512.hexdigest(sanitize(params[:security_answers][key]))
      a_arr[answers.index(key)] = true
    else
      a_arr[answers.index(key)] = false
    end
  end

  authed = true unless a_arr.include?(false)
  authed
end
set_cyclicial_cyclemod(hash) click to toggle source
# File lib/cookie_crypt/controllers/helpers.rb, line 119
def set_cyclicial_cyclemod hash
  if resource.cookie_crypt_attempts_count == 0
    session[:cyclemod] = 0
  elsif resource.cookie_crypt_attempts_count != 0 && resource.cookie_crypt_attempts_count%resource.class.cycle_question_on_fail_count == 0 
    session[:cyclemod] += 1
  else #logout then log back in at a future time?
    session[:cyclemod] = 0
  end

  session[:cyclemod] = 0 if session[:cyclemod]+resource.security_cycle > hash.keys.count/2
end
set_random_cyclemod(hash) click to toggle source
# File lib/cookie_crypt/controllers/helpers.rb, line 131
def set_random_cyclemod hash
  if resource.cookie_crypt_attempts_count == 0
    session[:cyclemod] = Random.rand(1..(hash.keys.count/2))
  elsif resource.cookie_crypt_attempts_count != 0 && resource.cookie_crypt_attempts_count%resource.class.cycle_question_on_fail_count == 0 
    r = Random.rand(1..(hash.keys.count/2))
    while session[:cyclemod] == r || resource.security_cycle == r
      r = Random.rand(1..(hash.keys.count/2))
    end
    session[:cyclemod] = r

  else #logout then log back in at a future time?
    session[:cyclemod] = 0
  end
end
unrecognized_agent?() click to toggle source
# File lib/cookie_crypt/controllers/helpers.rb, line 187
def unrecognized_agent?
  resource.agent_list.include?("#{request.user_agent}")
end
update_resource_cycle(hash) click to toggle source
# File lib/cookie_crypt/controllers/helpers.rb, line 146
def update_resource_cycle hash
  #reset or rollover the cycle number
  if resource.class.cookie_crypt_auth_through == :one_question_cyclical || 
    resource.class.cookie_crypt_auth_through == :two_questions_cyclical

    if resource.security_cycle+1 > hash.keys.count/2
      resource.security_cycle = 1
    else
      resource.security_cycle += 1
    end
  elsif resource.class.cookie_crypt_auth_through == :one_question_random || 
    resource.class.cookie_crypt_auth_through == :two_questions_random

    resource.security_cycle = session[:cyclemod]
  end
  
  resource.save
end
using_an_agent_that_is_already_being_used?() click to toggle source
# File lib/cookie_crypt/controllers/helpers.rb, line 165
def using_an_agent_that_is_already_being_used?
  unless resource.agent_list.blank?
    request_agent = UserAgent.parse("#{request.user_agent}")
    resource.agent_list.split('|').each do |agent_string|
      if agent_string.include?("#{request_agent.application}")
        agent = UserAgent.parse("#{agent_string}")
        if agent.application == request_agent.application && agent.browser == request_agent.browser
          if request_agent >= agent #version number is higher for example
            #update user agent string and return true
            resource.agent_list = resource.agent_list.gsub("#{agent.browser}/#{agent.version}","#{request_agent.browser}/#{request_agent.version}")
            resource.save
            return true
          elsif request_agent.version == agent.version
            return true
          end
        end
      end
    end
  end
  false
end