Error if 2FA Key provided but not required. Close #25

mydnshost · Nov 11, 2018 · 9af5db8 · 9af5db8
1 parent ee6d2be
commit 9af5db8
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/web/1.0/index.php b/web/1.0/index.php
@@ -277,6 +277,10 @@ function getKnownDevice($user, &$context) {
 					$errorExtraData = '2FA key required.';
 					$resp->setHeader('login_error', '2fa_required');
 				}
+			} else if (empty($keys) && isset($_SERVER['HTTP_X_2FA_KEY'])) {
+				$errorExtraData = '2FA key provided but not required.';
+				$resp->setHeader('login_error', '2fa_notrequired');
+				$valid = false;
 			}
 
 			if ($valid) {