[TikiWiki-commits] [Git][tikiwiki/tiki][27.x] [FIX] Email 2FA: decrypt stored token before comparing OTP

Alfred Syatsukwa pushed to branch 27.x at Tiki Wiki CMS Groupware / Tiki


Commits:
bcbe3dd6 by Alfred Syatsukwa at 2026-08-18T10:05:40+00:00
[FIX] Email 2FA: decrypt stored token before comparing OTP
---
* [FIX] Email 2FA: decrypt stored token before comparing OTP
---

See merge request tikiwiki/tiki!10942

(cherry picked from commit 265b4723912232a6812b12c4729fa527feb5577f)

See merge request tikiwiki/tiki!10943

- - - - -


1 changed file:

- lib/core/TwoFactorAuth/Email2FA.php


Changes:

=====================================
lib/core/TwoFactorAuth/Email2FA.php
=====================================
@@ -112,8 +112,7 @@ class Email2FA implements TwoFactorAuthInterface
             throw new TwoFactorAuthException($errMsg);
         }
 
-        $hashedTokenFromDb = $tokenInfo['token'];
-        $hashedTokenFromClient = $this->crypt->encryptData($code);
+        $storedToken = $tokenInfo['token'];
         $attempts = $tokenInfo['attempts'];
         $created = intval($tokenInfo['created']);
         $tokenTTL = intval($prefs['twoFactorAuthEmailTokenTTL'] ?? 30) * 60;
@@ -123,7 +122,9 @@ class Email2FA implements TwoFactorAuthInterface
             throw new TwoFactorAuthException($errMsg);
         }
 
-        if ($hashedTokenFromDb !== $hashedTokenFromClient) {
+        $decryptedToken = $this->crypt->decryptData($storedToken);
+
+        if ($decryptedToken === false || ! hash_equals($decryptedToken, $code)) {
             $attempts = $tokenInfo['attempts'] + 1;
             $this->twoFATable->update(['attempts' => $attempts], ['userId' => $userInfo['userId']]);
             return false;



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/bcbe3dd613272a9a696a86481daf1430a64dedda

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/bcbe3dd613272a9a696a86481daf1430a64dedda
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs