mirror/php-auth
1
0
Fork 0
mirror of https://github.com/delight-im/PHP-Auth.git synced 2025-08-03 22:57:27 +02:00
Code Issues Releases Wiki Activity

Extract sanitization of OTP values into separate method

Browse Source
This commit is contained in:
Marco
2024-07-04 13:35:27 +02:00
parent 2ffe09c52e
commit eba7cd2657
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/Auth.php
View File

@@ -813,9 +813,7 @@ final class Auth extends UserManager {
} }
$_SESSION[self::SESSION_FIELD_AWAITING_2FA_USER_ID] = (int) $_SESSION[self::SESSION_FIELD_AWAITING_2FA_USER_ID]; $_SESSION[self::SESSION_FIELD_AWAITING_2FA_USER_ID] = (int) $_SESSION[self::SESSION_FIELD_AWAITING_2FA_USER_ID];
$otpValue = !empty($otpValue) ? (string) $otpValue : ''; $otpValue = !empty($otpValue) ? self::sanitizeOtpValue((string) $otpValue) : '';
$otpValue = \preg_replace('/[^A-Za-z0-9]/', '', $otpValue);
$otpValue = \strtoupper($otpValue);
if (empty($otpValue)) { if (empty($otpValue)) {
throw new InvalidOneTimePasswordException(); throw new InvalidOneTimePasswordException();
@@ -2010,7 +2008,7 @@ final class Auth extends UserManager {
$this->throttle([ 'enableTwoFactor', 'mechanism', $mechanism, 'userId', $this->getUserId() ], 2, (60 * 60), 2); $this->throttle([ 'enableTwoFactor', 'mechanism', $mechanism, 'userId', $this->getUserId() ], 2, (60 * 60), 2);
$this->throttle([ 'enableTwoFactor', 'mechanism', $mechanism, $this->getIpAddress() ], 3, (60 * 60), 3); $this->throttle([ 'enableTwoFactor', 'mechanism', $mechanism, $this->getIpAddress() ], 3, (60 * 60), 3);
$otpValue = !empty($otpValue) ? \trim((string) $otpValue) : null; $otpValue = !empty($otpValue) ? self::sanitizeOtpValue((string) $otpValue) : '';
if (empty($otpValue)) { if (empty($otpValue)) {
throw new InvalidOneTimePasswordException(); throw new InvalidOneTimePasswordException();
@@ -2663,4 +2661,12 @@ final class Auth extends UserManager {
return null; return null;
} }
private static function sanitizeOtpValue($otpValue) {
$otpValue = \trim($otpValue);
$otpValue = \preg_replace('/[^A-Za-z0-9]/', '', $otpValue);
$otpValue = \strtoupper($otpValue);
return $otpValue;
}
} }