dc25c83a52
With the OTPHP upgrade from v10.x to v11.x, the behaviour of the window feature changed substantially. With version 10, the window of timestamps goes from `timestamp - window * period` to `timestamp + window * period`. For example, if the window is 5, the period 30 and the timestamp 1476822000, the OTP tested are within 1476821850 (`1476822000 - 5 * 30`) and 1476822150 (`1476822000 + 5 * 30`). In other words, this validated the 5 OTP before and after the current timestamp. With version 11, the TOTP window acts as a time drift. If the window is 15, the period 30, and the current timestamp is 147682209, the OTP tested are within 147682194 (`147682209 - 15`), 147682209 and 147682224 (`147682209 + 15`). The window shall be lower than the period. Therefore, this test includes the previous OTP but not the next one. This change required an adaption to align our implementation with OTPHP. The window of valid TOTP tokens is now much narrower. This change in functionality is a security improvement, but it also means that the time on the device generating the TOTP token must be more accurate. As OTPHP restricts the window to be strictly lower than the period, our admin setting now has a maximum allowed value of 29. To ensure we only have valid window values, we need to update the admin setting to a value lower than 30; therefore, we include an upgrade step. Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>
Moodle
Moodle is the World's Open Source Learning Platform, widely used around the world by countless universities, schools, companies, and all manner of organisations and individuals.
Moodle is designed to allow educators, administrators and learners to create personalised learning environments with a single robust, secure and integrated system.
Documentation
- Read our User documentation
- Discover our developer documentation
- Take a look at our demo site
Community
moodle.org is the central hub for the Moodle Community, with spaces for educators, administrators and developers to meet and work together.
You may also be interested in:
- attending a Moodle Moot
- our regular series of developer meetings
- the Moodle User Association
Installation and hosting
Moodle is Free, and Open Source software. You can easily download Moodle and run it on your own web server, however you may prefer to work with one of our experienced Moodle Partners.
Moodle also offers hosting through both MoodleCloud, and our partner network.
License
Moodle is provided freely as open source software, under version 3 of the GNU General Public License. For more information on our license see