[TikiWiki-commits] [Git][tikiwiki/tiki][30.x] [BP][FIX] 2FA login: replace plaintext password in session with one-time token

Elifeleti Mukisa Dan pushed to branch 30.x at Tiki Wiki CMS Groupware / Tiki


Commits:
2cc20872 by Elifeleti Mukisa Dan at 2026-05-22T19:08:22+00:00
[BP][FIX] 2FA login: replace plaintext password in session with one-time token
---
* [FIX] 2FA login: replace plaintext password in session with one-time token
---
* [FIX] 2FA login: replace plaintext password in session with one-time token


(cherry picked from commit 2dd82889edba45ea9d91708c4f971c313dd79e5c)

2dd82889 [FIX] 2FA login: replace plaintext password in session with one-time token

Co-authored-by: Danelif <[email protected]>

See merge request tikiwiki/tiki!10294


(cherry picked from commit 5c8daa413e019687021d6b11d0c9e99f3eea5274)

79bc2b2c [FIX] 2FA login: replace plaintext password in session with one-time token

Co-authored-by: Elifeleti Mukisa Dan <[email protected]>

See merge request tikiwiki/tiki!10315

- - - - -


1 changed file:

- tiki-login.php


Changes:

=====================================
tiki-login.php
=====================================
@@ -85,11 +85,12 @@ if ($prefs['auth_webauthn_enabled'] === 'y' && ! empty($_SESSION['webauthn_user'
     $_REQUEST['pass'] = ! empty($_REQUEST['pass']) ? trim($_REQUEST['pass']) : $userlib->genPass();
 }
 
-if ($prefs['twoFactorAuth'] === 'y' && ! empty($_SESSION['tiki_creds_username']) && ! empty($_SESSION['tiki_creds_password'])) {
-    $_REQUEST['user'] = $_SESSION['tiki_creds_username'];
-    $_REQUEST['pass'] = $_SESSION['tiki_creds_password'];
-    unset($_SESSION['tiki_creds_username']);
-    unset($_SESSION['tiki_creds_password']);
+$twoFaPrevalidated = false;
+if ($prefs['twoFactorAuth'] === 'y' && ! empty($_SESSION['tiki_2fa_token']) && ! empty($_SESSION['tiki_2fa_username'])) {
+    $_REQUEST['user'] = $_SESSION['tiki_2fa_username'];
+    $twoFaPrevalidated = true;
+    unset($_SESSION['tiki_2fa_token']);
+    unset($_SESSION['tiki_2fa_username']);
 }
 
 // Remember where user is logging in from and send them back later; using session variable for those of us who use WebISO services
@@ -294,7 +295,10 @@ if (
     }
 } else {
     // Verify user is valid
-    if ($prefs['auth_webauthn_enabled'] === 'y' && ! empty($_SESSION['webauthn_user']) && $_SESSION['webauthn_user'] === $requestedUser) {
+    if ($twoFaPrevalidated) {
+        // Password was already validated before the 2FA prompt; use a token instead of re-checking
+        $ret = [true, $requestedUser, null, null];
+    } elseif ($prefs['auth_webauthn_enabled'] === 'y' && ! empty($_SESSION['webauthn_user']) && $_SESSION['webauthn_user'] === $requestedUser) {
         $ret = [$userlib->update_lastlogin($requestedUser), $requestedUser, USER_VALID];
     } else {
         $ret = $userlib->validate_user($requestedUser, $pass);
@@ -337,8 +341,8 @@ if (
                 && $requireMfa
                 && ! empty($twoFactorSecret)
             ) {
-                $_SESSION['tiki_creds_username'] = $_REQUEST['user'];
-                $_SESSION['tiki_creds_password'] = $_REQUEST['pass'];
+                $_SESSION['tiki_2fa_token'] = bin2hex(random_bytes(32));
+                $_SESSION['tiki_2fa_username'] = $_REQUEST['user'];
                 $params = '&create2FaCodeNormalLogin&tiki_username=' . urlencode($_REQUEST['user']);
                 header('Location: ' . $base_url . 'tiki-login_scr.php?showTwoFactorForm' . $params);
                 exit;
@@ -350,8 +354,8 @@ if (
                 if (! $is2FaPass) {
                     $error = TWO_FA_INCORRECT;
                     $smarty->assign('showTwoFactorForm', 'y');
-                    $_SESSION['tiki_creds_username'] = $_REQUEST['user'];
-                    $_SESSION['tiki_creds_password'] = $_REQUEST['pass'];
+                    $_SESSION['tiki_2fa_token'] = bin2hex(random_bytes(32));
+                    $_SESSION['tiki_2fa_username'] = $_REQUEST['user'];
                     $smarty->assign('create2FaCodeNormalLogin', "y");
                     $smarty->assign('error_login', $error);
                     $smarty->assign('mid', 'tiki-login.tpl');



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/2cc20872a9622e8dc76be6864d845f9157a86bcc

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/2cc20872a9622e8dc76be6864d845f9157a86bcc
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs