requireLogin(); $db = Database::getInstance(); $user = $auth->getCurrentUser(); $appTitle = $db->getSetting('app_title', 'UniFi Voucher System'); $error = ''; $success = ''; $backupCodes = []; // nur direkt nach Erzeugung gefüllt $hasPassword = !empty($user['password_hash']); $totpEnabled = !empty($user['totp_enabled']); $setupRequired = isset($_GET['setup_required']); // 2FA aktivieren (Code bestaetigen) if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['enable_totp'])) { if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) { $error = __('sec_token_invalid'); } else { $secret = $_SESSION['totp_setup_secret'] ?? ''; $code = trim($_POST['code'] ?? ''); if ($secret === '') { $error = __('sec_setup_expired'); } elseif (!Totp::verify($secret, $code)) { $error = __('sec_code_invalid'); } else { $backupCodes = $auth->enableTotp($user['id'], $secret); unset($_SESSION['totp_setup_secret']); $totpEnabled = true; $user = $auth->getCurrentUser(); $success = __('sec_enabled'); } } } // Überall abmelden (andere Sessions beenden) if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['logout_others'])) { if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) { $error = __('sec_token_invalid'); } else { $auth->logoutOtherSessions(); $success = __('sec_sessions_closed'); } } // Recovery-Codes neu erzeugen if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['regen_codes'])) { if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) { $error = __('sec_token_invalid'); } elseif (!empty($user['totp_enabled'])) { $backupCodes = $auth->regenerateBackupCodes($user['id']); $user = $auth->getCurrentUser(); $success = __('sec_codes_new'); } } // 2FA deaktivieren if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['disable_totp'])) { if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) { $error = __('sec_token_invalid'); } else { $auth->disableTotp($user['id']); $totpEnabled = false; $success = __('sec_disabled'); } } // Für die Setup-Ansicht ein Secret erzeugen (in Session halten bis bestätigt) $setupSecret = ''; $otpUri = ''; if (!$totpEnabled && $hasPassword) { $setupSecret = $_SESSION['totp_setup_secret'] ?? Totp::generateSecret(); $_SESSION['totp_setup_secret'] = $setupSecret; $otpUri = Totp::provisioningUri($setupSecret, $user['email'], $appTitle); } $csrf = $auth->getCsrfToken(); $dbSessions = $db->getSetting('session_driver', 'php') === 'db'; $activeSessions = $dbSessions ? $auth->activeSessionCount() : 0; ?> <?= __('sec_title') ?> – <?= htmlspecialchars($appTitle) ?>


backupCodesRemaining($user) ?>