superrob1500
/
mirror-WGDashboard
mirror of https://github.com/WGDashboard/WGDashboard
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1258 from SnedS91/fix-totp-verification 

Fix TOTP verification with valid window
pull/1270/merge
Donald Zou 2026-05-10 13:13:59 +08:00 committed by GitHub
parent 9d5478e3e3 91de807557
commit 4d20d00631
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/dashboard.py
View File

@ -335,7 +335,10 @@ def API_AuthenticateLogin():
totpEnabled = DashboardConfig.GetConfig("Account", "enable_totp")[1] totpEnabled = DashboardConfig.GetConfig("Account", "enable_totp")[1]
totpValid = False totpValid = False
if totpEnabled: if totpEnabled:
totpValid = pyotp.TOTP(DashboardConfig.GetConfig("Account", "totp_key")[1]).now() == data['totp'] totp_code = str(data.get("totp", "")).strip()
totpValid = pyotp.TOTP(
DashboardConfig.GetConfig("Account", "totp_key")[1]
).verify(totp_code, valid_window=1)
if (valid if (valid
and data['username'] == DashboardConfig.GetConfig("Account", "username")[1] and data['username'] == DashboardConfig.GetConfig("Account", "username")[1]
@ -1455,11 +1458,15 @@ def API_Welcome_GetTotpLink():
@app.post(f'{APP_PREFIX}/api/Welcome_VerifyTotpLink') @app.post(f'{APP_PREFIX}/api/Welcome_VerifyTotpLink')
def API_Welcome_VerifyTotpLink(): def API_Welcome_VerifyTotpLink():
data = request.get_json() data = request.get_json()
totp = pyotp.TOTP(DashboardConfig.GetConfig("Account", "totp_key")[1]).now() totp_code = str(data.get("totp", "")).strip()
if totp == data['totp']: totpValid = pyotp.TOTP(
DashboardConfig.GetConfig("Account", "totp_key")[1]
).verify(totp_code, valid_window=1)
if totpValid:
DashboardConfig.SetConfig("Account", "totp_verified", "true") DashboardConfig.SetConfig("Account", "totp_verified", "true")
DashboardConfig.SetConfig("Account", "enable_totp", "true") DashboardConfig.SetConfig("Account", "enable_totp", "true")
return ResponseObject(totp == data['totp']) return ResponseObject(totpValid)
@app.post(f'{APP_PREFIX}/api/Welcome_Finish') @app.post(f'{APP_PREFIX}/api/Welcome_Finish')
def API_Welcome_Finish(): def API_Welcome_Finish():