diff options
| author | Hui Hui <0w0@loli.pet> | 2019-05-28 01:00:32 +0800 |
|---|---|---|
| committer | zeripath <art27@cantab.net> | 2019-05-27 18:00:32 +0100 |
| commit | cf3ffebfde3eb6d76aa898a0b55249d5c3bf649e (patch) | |
| tree | 60fd7daf7147c2a749c6100c72e3fe8f00afa9b3 /routers | |
| parent | 2c412f517ae94859b1e42beb24d4bff790484f81 (diff) | |
| download | gitea-cf3ffebfde3eb6d76aa898a0b55249d5c3bf649e.tar.gz gitea-cf3ffebfde3eb6d76aa898a0b55249d5c3bf649e.zip | |
fix issuer of OTP URI should be URI-encoded. (#6634)
* fix: Issuer of OTP URI should be URI-encoded.
follow this link https://github.com/google/google-authenticator/wiki/Key-Uri-Format .
* filter unsafe character ':' in issuer
* Use Replace rather than ReplaceAll
Diffstat (limited to 'routers')
| -rw-r--r-- | routers/user/setting/security_twofa.go | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/routers/user/setting/security_twofa.go b/routers/user/setting/security_twofa.go index 3a590f0b08..fca1151a04 100644 --- a/routers/user/setting/security_twofa.go +++ b/routers/user/setting/security_twofa.go @@ -74,11 +74,13 @@ func twofaGenerateSecretAndQr(ctx *context.Context) bool { if uri != nil { otpKey, err = otp.NewKeyFromURL(uri.(string)) } + // Filter unsafe character ':' in issuer + issuer := strings.Replace(setting.AppName+" ("+setting.Domain+")", ":", "", -1) if otpKey == nil { err = nil // clear the error, in case the URL was invalid otpKey, err = totp.Generate(totp.GenerateOpts{ SecretSize: 40, - Issuer: setting.AppName + " (" + strings.TrimRight(setting.AppURL, "/") + ")", + Issuer: issuer, AccountName: ctx.User.Name, }) if err != nil { |