[TikiWiki-commits] [Git][tikiwiki/tiki][30.x] [FIX] Email 2FA: decrypt stored token before comparing OTP

Alfred Syatsukwa pushed to branch 30.x at Tiki Wiki CMS Groupware / Tiki


Commits:
170620a7 by Alfred Syatsukwa at 2026-08-18T09:07:12+00:00
[FIX] Email 2FA: decrypt stored token before comparing OTP
---
* [FIX] Email 2FA: decrypt stored token before comparing OTP
---
* [FIX] Email 2FA: decrypt stored token before comparing OTP

(cherry picked from commit a844c36d7f6f8a82bb892517a87574651aea4d87)

See merge request tikiwiki/tiki!10933

(cherry picked from commit e0e7938eed128f2cc35d1b9374855814776a1bdf)

See merge request tikiwiki/tiki!10937

- - - - -


1 changed file:

- lib/core/TwoFactorAuth/Email2FA.php


Changes:

=====================================
lib/core/TwoFactorAuth/Email2FA.php
=====================================
@@ -112,8 +112,7 @@ class Email2FA implements TwoFactorAuthInterface
             throw new TwoFactorAuthException($errMsg);
         }
 
-        $hashedTokenFromDb = $tokenInfo['token'];
-        $hashedTokenFromClient = $this->crypt->encryptData($code);
+        $storedToken = $tokenInfo['token'];
         $attempts = $tokenInfo['attempts'];
         $created = intval($tokenInfo['created']);
         $tokenTTL = intval($prefs['twoFactorAuthEmailTokenTTL'] ?? 30) * 60;
@@ -123,7 +122,9 @@ class Email2FA implements TwoFactorAuthInterface
             throw new TwoFactorAuthException($errMsg);
         }
 
-        if ($hashedTokenFromDb !== $hashedTokenFromClient) {
+        $decryptedToken = $this->crypt->decryptData($storedToken);
+
+        if ($decryptedToken === false || ! hash_equals($decryptedToken, $code)) {
             $attempts = $tokenInfo['attempts'] + 1;
             $this->twoFATable->update(['attempts' => $attempts], ['userId' => $userInfo['userId']]);
             return false;



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/170620a78d74ff74d8a8f9f83bc06752d1ef4b9c

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/170620a78d74ff74d8a8f9f83bc06752d1ef4b9c
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs