9 lines
3.5 KiB
PHP
9 lines
3.5 KiB
PHP
<?php
|
|
include 'auth.php';
|
|
$page_title='Identity leaks - BastionGuard WebUI'; $active_page='identityleak.php';
|
|
$cfg=bg_read_json('identityleak.json',['hibp_key'=>'','leakcheck_key'=>'','monitor'=>false]); $output='';
|
|
if($_SERVER['REQUEST_METHOD']==='POST'){ csrf_validate(); $a=$_POST['action']??''; if($a==='save'){ $cfg['hibp_key']=trim($_POST['hibp_key']??''); $cfg['leakcheck_key']=trim($_POST['leakcheck_key']??''); $cfg['monitor']=!empty($_POST['monitor']); bg_write_json('identityleak.json',$cfg); bg_flash('success','API keys and monitor saved.'); bg_redirect('identityleak.php'); } elseif($a==='email'){ $email=trim($_POST['email']??''); if(!filter_var($email,FILTER_VALIDATE_EMAIL)) $output='Invalid email.'; elseif(!$cfg['hibp_key']) $output='Configure a HIBP API key to query email breaches.'; else { $res=bg_http_get('https://haveibeenpwned.com/api/v3/breachedaccount/'.rawurlencode($email).'?truncateResponse=false',['hibp-api-key: '.$cfg['hibp_key']]); $output='HIBP HTTP '.$res['code']."\n".($res['body']?:$res['error']); } } elseif($a==='password'){ $pwd=$_POST['password']??''; if($pwd==='') $output='Password is empty.'; else { $sha=strtoupper(sha1($pwd)); $prefix=substr($sha,0,5); $suffix=substr($sha,5); $res=bg_http_get('https://api.pwnedpasswords.com/range/'.$prefix); $count=0; if($res['body']) foreach(explode("\n",$res['body']) as $line){ [$s,$c]=array_pad(explode(':',trim($line),2),2,'0'); if($s===$suffix){$count=(int)$c; break;} } $output=$count>0 ? "Password found in public datasets: $count occurrences." : 'Password not found in the HIBP k-anonymity dataset.'; } }}
|
|
include 'includes/header.php'; include 'includes/sidebar.php'; ?>
|
|
<div class="page-title"><div><h1>Identity breach check</h1><p>Check email on HIBP, check passwords with k-anonymity and configure LeakCheck.</p></div></div>
|
|
<div class="row g-4"><div class="col-lg-5"><div class="card"><div class="card-body"><h5>Check breaches</h5><form method="post" class="mb-3"><?php csrf_field(); ?><input type="hidden" name="action" value="email"><label class="form-label">Email</label><div class="input-group"><input class="form-control" name="email" placeholder="nome@example.com"><button class="btn btn-primary">Check</button></div></form><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="password"><label class="form-label">Password to check</label><div class="input-group"><input class="form-control" type="password" name="password"><button class="btn btn-outline-primary">Check password</button></div><div class="form-hint">The full password is not sent to HIBP: the SHA-1 prefix is used.</div></form></div></div></div><div class="col-lg-7"><div class="card"><div class="card-body"><h5>API and monitor</h5><form method="post"><?php csrf_field(); ?><input type="hidden" name="action" value="save"><label class="form-label">HIBP API key</label><input class="form-control" name="hibp_key" value="<?= bg_e($cfg['hibp_key']) ?>"><label class="form-label mt-2">LeakCheck API key</label><input class="form-control" name="leakcheck_key" value="<?= bg_e($cfg['leakcheck_key']) ?>"><div class="form-check form-switch mt-3"><input class="form-check-input" type="checkbox" name="monitor" <?= $cfg['monitor']?'checked':'' ?>><label class="form-check-label">Automatic monitor every 24h</label></div><button class="btn btn-outline-primary mt-3">Save</button></form></div></div></div><?php if($output): ?><div class="col-12"><div class="card"><div class="card-body"><h5>Result</h5><?php bg_render_log($output); ?></div></div></div><?php endif; ?></div>
|
|
<?php include 'includes/footer.php'; ?>
|