[Bug] [4.0RC1] [Addon: TOTP] Incorrect key, QR code, activates regardless of failed code
Version: Hubzilla 4.0RC1
- The key produced is incorrect. Adding it in Authy, for example, produces an error that the key is invalid.
- The QR code, though it was added successfully by a 2FA app, is not being honoured by the TOTP addon (always "fail")
- Since the code is always error "fail", the TOTP addon should not have had activated by itself. It did and locked me out of my account without any valid code.
Extra: 4. The "site name" and CSS edits are showing, and is part of the QR code.
I can't explain this further right now as I am still locked out of my account, but if I understood this correctly, the TOTP plugin is probably pulling from a variable that is being used to generate the site title in the header/nav bar … which is customisable. Hence, the HTML and CSS edits are part of the QR code.
Which could possibly be the reason also why the key and QR code are incorrect.