oss/wallabag
oss/wallabag
1
0
Fork 0
mirror of https://github.com/wallabag/wallabag.git synced 2025-08-06 17:41:01 +00:00
Code Wiki Activity

Avoid non-validated OTP to be enabled

Browse source 
The OTP code must be required when enabling OTP. If the provided code is wrong, disable OTP, redirect and notice the user.
This commit is contained in:
Jeremy Benoist 2025-04-11 15:46:57 +02:00
parent 01ffc6c3d5
commit 262f674245
No known key found for this signature in database
GPG key ID: 7168D5DD29F38552
4 changed files with 13 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

18
src/Wallabag/CoreBundle/Controller/ConfigController.php
View file

@ -402,12 +402,14 @@ class ConfigController extends AbstractController
throw new BadRequestHttpException('Bad CSRF token.');
}
$user = $this->getUser();
$isValid = $googleAuthenticator->checkCode(
$this->getUser(),
$user,
$request->get('_auth_code')
);
if (true === $isValid) {
if ($isValid) {
$this->addFlash(
'notice',
'flashes.config.notice.otp_enabled'
@ -417,14 +419,14 @@ class ConfigController extends AbstractController
}
$this->addFlash(
'two_factor',
'scheb_two_factor.code_invalid'
'notice',
'flashes.config.notice.otp_code_invalid'
);
$this->addFlash(
'notice',
'scheb_two_factor.code_invalid'
);
$user->setGoogleAuthenticatorSecret(null);
$user->setBackupCodes(null);
$this->userManager->updateUser($user, true);
return $this->redirect($this->generateUrl('config') . '#set3');
}