Add some filtering on the inputs

e107inc · Jan 19, 2021 · b0fe87f · b0fe87f
1 parent 3f05fc3
commit b0fe87f
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/login.php b/login.php
@@ -64,7 +64,8 @@
  $user_id = e107::getSession('2fa')->get('user_id');
 
  // Set $totp, entered by user
- $totp = $_POST['totp']; // TODO check input for digits only
+ $totp = intval($_POST['totp']);
+ $totp = (string) $totp;
 
  if(!$tfa_class->processLogin($user_id, $totp))
  {

diff --git a/setup.php b/setup.php
@@ -50,8 +50,10 @@
 // Setting up 2FA
 if(!$tfaActivated && isset($_POST['enter-totp-enable']))
 {
- $secret_key = $_POST['secret_key']; // TODO - add some validation?
- $totp = $_POST['totp']; // TODO - add some validation?
+ $secret_key = (string) $_POST['secret_key']; 
+
+ $totp = intval($_POST['totp']);
+ $totp = (string) $totp;
 
  if($tfa_class->processEnable(USERID, $secret_key, $totp))
  {
@@ -66,7 +68,8 @@
 
 if($tfaActivated && isset($_POST['enter-totp-disable']))
 {
- $totp = $_POST['totp']; // TODO - add some validation?
+ $totp = intval($_POST['totp']);
+ $totp = (string) $totp;
 
  if($tfa_class->processDisable(USERID, $totp))
  {