Fixed Two-factor authentication doesn't work for usernames with special characters

Steffen

Steffen

Well-known member
Affected version
2.0.5
If a username contains a special character like for example a question mark then XenForo generates an invalid OTP URL. You can try this for example with the username "Steffen?". When scanning the QR code, Google Authenticator for Android complains that the key wasn't recognized ("Schlüssel wurde nicht erkannt").

Notice the double question mark in the following JavaScript code generated by XenForo. The first question mark needs to be URL-encoded.
JavaScript: 
$el.qrcode({
    text: 'otpauth://totp/My%20Forum%3A%20Steffen??secret=...&issuer=My%20Forum'
});

It should look like this:
JavaScript: 
$el.qrcode({
    text: 'otpauth://totp/My%20Forum%3A%20Steffen%3F?secret=...&issuer=My%20Forum'
});


I think this is a bug in the OTP library used by XenForo: https://github.com/ChristianRiesen/otp/pull/29
 
Thanks Christian. Not only for the fix, but creating the library in the first place. It’s working really well for us.
 
Christian Riesen said:
Thanks for the bug report and pull request on the otp library.

I merged it and tagged it with a new version. If you use 2.6.0 it should be fine.
Click to expand...

Okay I am glad I saw your name here lol .... I am combing my XF installation backups trying to ensure the backup I restore does not have all the wonky stuff happening with the failed file checks that occurred overnight ... I saw your name and thought it was part of whatever happened.

Glad to know you're a real person @Christian Riesen and a good guy :P
 
Drunken said:
Okay I am glad I saw your name here lol .... I am combing my XF installation backups trying to ensure the backup I restore does not have all the wonky stuff happening with the failed file checks that occurred overnight ... I saw your name and thought it was part of whatever happened.

Glad to know you're a real person @Christian Riesen and a good guy :p
Click to expand...
Yes I happen to be a real person :) And if you run into issues with 2FA let me know, I might be able to help.
 
Christian Riesen said:
Yes I happen to be a real person :) And if you run into issues with 2FA let me know, I might be able to help.
Click to expand...

No so far that works perfectly! :-) I have some other healthcheck, wonky, messed up... something isnt right issue pop up while I was sleeping last night that I am trying to figure out. I guess I will know after my 38k files restore over my installation.

Thank you to @Jaxel for his EWR database and structure backup system.
 
Top Bottom