Expect otp_recovery to be hashed

helmo · helmo · commit d1d5bfe10d15 · 2022-03-11T22:43:33.000+01:00
diff --git a/interface/web/login/otp.php b/interface/web/login/otp.php
@@ -86,7 +86,7 @@ function finish_2fa_success($msg = '') {
 		die("Sorry, contact your administrator.");
 	}
 
-	if ($_SESSION['otp']['recovery'] == $_POST['code']) {
+	if (password_verify($_POST['code'], $user['otp_recovery'])) {
 		finish_2fa_success('via 2fa recovery code');
 	}
 	else {

Original file line number	Diff line number	Diff line change
`@@ -86,7 +86,7 @@ function finish_2fa_success($msg = '') {`
`86`	`86`	`die("Sorry, contact your administrator.");`
`87`	`87`	`}`
`88`	`88`
`89`		`- if ($_SESSION['otp']['recovery'] == $_POST['code']) {`
	`89`	`+ if (password_verify($_POST['code'], $user['otp_recovery'])) {`
`90`	`90`	`finish_2fa_success('via 2fa recovery code');`
`91`	`91`	`}`
`92`	`92`	`else {`