Rate limit 2FA code attempts and narrow the TOTP acceptance window

2026-08-05 07:07:14 +00:00 · 2026-07-27 18:36:43 -04:00
parent 97490bef3b
commit a4fdced10f
3 changed files with 60 additions and 5 deletions
--- a/agent/user/post/profile.php
+++ b/agent/user/post/profile.php
@@ -215,7 +215,7 @@ if (isset($_POST['enable_mfa'])) {
    $token = $_SESSION['mfa_token'] ?? '';

    // Verify
-    if (TokenAuth6238::verify($token, $verify_code)) {
+    if (TokenAuth6238::verify($token, $verify_code, 1)) {

        // SUCCESS
        mysqli_query($mysqli,"UPDATE users SET user_token = '$token' WHERE user_id = $session_user_id");