Mirrors/WGDashboard
1
0
Fork 0
mirror of https://github.com/donaldzou/WGDashboard.git synced 2026-05-13 23:06:20 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #1258 from SnedS91/fix-totp-verification
Some checks failed
Docker Build and Push / docker_build (push) Has been cancelled
Details
Docker Build and Push / docker_scan (push) Has been cancelled
Details

Browse Source 
Fix TOTP verification with valid window
This commit is contained in:
Donald Zou
2026-05-10 13:13:59 +08:00
committed by GitHub
parent 9d5478e3e3 91de807557
commit 4d20d00631
1 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/dashboard.py
View File

@@ -335,7 +335,10 @@ def API_AuthenticateLogin():
totpEnabled = DashboardConfig.GetConfig("Account", "enable_totp")[1] totpEnabled = DashboardConfig.GetConfig("Account", "enable_totp")[1]
totpValid = False totpValid = False
if totpEnabled: if totpEnabled:
totpValid = pyotp.TOTP(DashboardConfig.GetConfig("Account", "totp_key")[1]).now() == data['totp'] totp_code = str(data.get("totp", "")).strip()
totpValid = pyotp.TOTP(
DashboardConfig.GetConfig("Account", "totp_key")[1]
).verify(totp_code, valid_window=1)
if (valid if (valid
and data['username'] == DashboardConfig.GetConfig("Account", "username")[1] and data['username'] == DashboardConfig.GetConfig("Account", "username")[1]
@@ -1455,11 +1458,15 @@ def API_Welcome_GetTotpLink():
@app.post(f'{APP_PREFIX}/api/Welcome_VerifyTotpLink') @app.post(f'{APP_PREFIX}/api/Welcome_VerifyTotpLink')
def API_Welcome_VerifyTotpLink(): def API_Welcome_VerifyTotpLink():
data = request.get_json() data = request.get_json()
totp = pyotp.TOTP(DashboardConfig.GetConfig("Account", "totp_key")[1]).now() totp_code = str(data.get("totp", "")).strip()
if totp == data['totp']: totpValid = pyotp.TOTP(
DashboardConfig.GetConfig("Account", "totp_key")[1]
).verify(totp_code, valid_window=1)
if totpValid:
DashboardConfig.SetConfig("Account", "totp_verified", "true") DashboardConfig.SetConfig("Account", "totp_verified", "true")
DashboardConfig.SetConfig("Account", "enable_totp", "true") DashboardConfig.SetConfig("Account", "enable_totp", "true")
return ResponseObject(totp == data['totp']) return ResponseObject(totpValid)
@app.post(f'{APP_PREFIX}/api/Welcome_Finish') @app.post(f'{APP_PREFIX}/api/Welcome_Finish')
def API_Welcome_Finish(): def API_Welcome_Finish():