[TikiWiki-commits] [Git][tikiwiki/tiki][24.x] [FIX] Email 2FA: decrypt stored token before comparing OTP

Alfred Syatsukwa pushed to branch 24.x at Tiki Wiki CMS Groupware / Tiki


Commits:
1d4ca5ab by Alfred Syatsukwa at 2026-08-18T10:34:56+00:00
[FIX] Email 2FA: decrypt stored token before comparing OTP
---
* [FIX] Email 2FA: decrypt stored token before comparing OTP
---

See merge request tikiwiki/tiki!10943

(cherry picked from commit bcbe3dd613272a9a696a86481daf1430a64dedda)

See merge request tikiwiki/tiki!10944

- - - - -


1 changed file:

- lib/core/TwoFactorAuth/Email2FA.php


Changes:

=====================================
lib/core/TwoFactorAuth/Email2FA.php
=====================================
@@ -109,8 +109,7 @@ class Email2FA implements TwoFactorAuthInterface
             throw new TwoFactorAuthException($errMsg);
         }
 
-        $hashedTokenFromDb = $tokenInfo['token'];
-        $hashedTokenFromClient = $this->crypt->encryptData($code);
+        $storedToken = $tokenInfo['token'];
         $attempts = $tokenInfo['attempts'];
         $created = intval($tokenInfo['created']);
         $tokenTTL = intval($prefs['twoFactorAuthEmailTokenTTL'] ?? 30) * 60;
@@ -120,7 +119,9 @@ class Email2FA implements TwoFactorAuthInterface
             throw new TwoFactorAuthException($errMsg);
         }
 
-        if ($hashedTokenFromDb !== $hashedTokenFromClient) {
+        $decryptedToken = $this->crypt->decryptData($storedToken);
+
+        if ($decryptedToken === false || ! hash_equals($decryptedToken, $code)) {
             $attempts = $tokenInfo['attempts'] + 1;
             $this->twoFATable->update(['attempts' => $attempts], ['userId' => $userInfo['userId']]);
             return false;



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/1d4ca5ab35c5f95d85e80155cc9a765eb06f59a3

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/1d4ca5ab35c5f95d85e80155cc9a765eb06f59a3
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs