From 33d0dfcdbb433917a7a1bffd5d59620cceb4ea76 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Mon, 17 Jan 2022 11:06:30 +0100 Subject: [PATCH] Bug 28786: Don't rely on Auth::GoogleAuth to generate the secret --- members/two_factor_auth.pl | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl index 159e2fd992a..03393f949d1 100755 --- a/members/two_factor_auth.pl +++ b/members/two_factor_auth.pl @@ -18,6 +18,7 @@ use Modern::Perl; use CGI; +use Convert::Base32 qw( encode_base32 ); use C4::Auth qw( get_template_and_user ); use C4::Output qw( output_and_exit output_html_with_http_headers ); @@ -77,7 +78,7 @@ if ( $op eq 'enable-2FA' ) { my $auth = Koha::Auth::TwoFactorAuth->new( { patron => $logged_in_user } ); - my $secret32 = $auth->generate_secret32; + my $secret32 = encode_base32(Koha::AuthUtils::generate_salt("strong", 32)); my $qr_code_url = $auth->qr_code( $secret32, $auth->key_id, $auth->issuer, ); -- 2.25.1