reports/views/login.tpl.php
<?php if (!defined('IN_APP')) die() ?><!DOCTYPE html>
<html <?php if ($this->isChannel) { echo 'data-channelpage'; } ?>>
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width,initial-scale=1">
  <title><?php echo $this->mode === 'tfa' ? 'Enable Two-Factor Authentication' : 'Login' ?></title>
  <link rel="stylesheet" type="text/css" href="/css/login.css?9">
  <?php if (true): ?>
  <script type="text/javascript" src="/js/helpers.js?19"></script>
  <script type="text/javascript" src="/js/admincore.js?28"></script>
  <script type="text/javascript" src="/js/login.js?14"></script>
  <?php endif ?>
  <link rel="shortcut icon" href="/image/favicon-team.ico" type="image/x-icon">
</head>
<body data-tkn="<?php echo $this->csrf ?>">
<header>
  <h1 id="title"><?php echo $this->mode === 'tfa' ? 'Enable Two-Factor Authentication' : 'Login' ?></h1>
</header>
<div id="content">
<?php if ($this->error): ?>
  <h3 class="auth-status auth-error"><?php echo $this->error ?></h3>
<?php elseif ($this->mode === 'prompt'): ?>
<?php if ($this->isLogged): ?>
  <h3 class="auth-status auth-success"><?php echo self::S_OKAUTH ?></h3>
  <a class="button btn-login" href="https://reports.4chan.org/" target="_top">Reports Home</a>
  <br><br>
  <a class="button btn-login" href="/changepass">Change Password</a>
  <?php if (!$this->has2FA): ?><br><br>
  <a class="button btn-login" href="?action=tfa" target="_top">Enable 2FA</a><?php endif ?>
  <br><br>
  <a class="button btn-logout" id="js-logout-btn" href="?action=do_logout" target="_top">Logout</a>
<?php else: ?>
<form id="login-form" action="" method="POST" enctype="multipart/form-data">
  <input type="hidden" name="action" value="do_login">
  <input type="hidden" name="csrf" value="<?php echo $this->csrf ?>">
  <input id="js-user" placeholder="Username" type="text" name="userlogin" required>
  <input id="js-pwd" placeholder="Password" type="password" name="passlogin" required>
  <div class="label-protip">If using <a href="?action=tfa" title="Enable 2FA">two-factor authentication</a>:</div>
  <input id="js-otp" placeholder="One-time code" type="text" maxlength="6" name="otp" autocomplete="off">
  <button class="button btn-login" type="submit">Login</button>
</form>
<?php endif ?>
<?php elseif ($this->mode === 'success'): ?>
  <h3 class="auth-status auth-success"><?php echo self::S_OKAUTH ?></h3>
  <a class="button btn-login" href="/">Reports Home</a>
  <br><br>
  <a class="button btn-login" href="/changepass">Change Password</a>
  <?php if (!$this->has2FA): ?><br><br>
  <a class="button btn-login" href="?action=tfa" target="_top">Enable 2FA</a><?php endif ?>
  <br><br>
  <a class="button btn-logout" id="js-logout-btn" href="?action=do_logout">Logout</a>
<?php elseif ($this->mode === 'logout'): ?>
  <h3 class="auth-status auth-success"><?php echo self::S_OKLOGOUT ?></h3>
  <a class="button btn-login" href="/login">Login</a>
<?php elseif ($this->mode === 'tfa'): ?>
<?php if ($this->secret): ?>
<h3 class="auth-status auth-success">Two-factor authentication is now enabled.</h3>
<p>Configure Google Authenticator by scanning the QR code below:
</p>
<img id="tfa-qrcode" alt="" src="<?php echo $this->qrCode ?>">
<p>Or enter your time-based key manually: <strong id="tfa-code"><?php echo $this->secret ?></strong></p>
<p class="protip-red">DO NOT SCREENSHOT THIS PAGE OR OTHERWISE SAVE/STORE YOUR QR CODE OR KEY.</p>
<p>You won't be able to view this information again, so be sure to configure your app before leaving this page!</p>
<p><a href="/login" class="button btn-login">Done</a></p>
<?php else: ?>
<div class="tfa-protip"><p><strong>Grab your smartphone and ensure it has <a href="https://support.google.com/accounts/answer/1066447?hl=en" target="_blank">Google Authenticator</a> installed.</strong></p><p>The next page will provide you with a barcode to scan with Google Authenticator to enable two-factor authentication. The page will only be displayed <em>once</em>, so you <strong>must</strong> have the app installed before proceeding.</p><p>Note: Once two-factor authentication has been enabled, you will be required to input a one-time code generated by your smartphone every time you log in to your 4chan account.</p></div>
<form action="" method="POST" enctype="multipart/form-data">
  <input type="hidden" name="action" value="tfa">
  <input type="hidden" name="csrf" value="<?php echo $this->csrf ?>">
  <input placeholder="Username" type="text" name="userlogin" required>
  <input placeholder="Password" type="password" name="passlogin" required>
  <div id="tfa-confirm-cnt"><input type="checkbox" required="" name="appinstalled"><span class="label-protip">I have <a target="_blank" href="https://support.google.com/accounts/answer/1066447?hl=en">Google Authenticator</a><br>installed on my smartphone.</span></div>
  <button class="button btn-login" type="submit">Enable 2FA</button>
</form>
<?php endif ?>
<?php endif ?>
</div>
<?php if (!$this->isChannel): ?>
<iframe src="https://reports.4channel.org/login?action=channel_frame" height="0" width="0" id="js-channel-frame"></iframe>
<?php endif ?>
</body>
</html>
