Be more tolerant of user input for auth codes by dd32 · Pull Request #518 · WordPress/two-factor

Commits on Feb 15, 2023

Add placeholder examples on authcode prompt screen.
dd32
committed
Be more tollerant of user input, allowing for authentication apps which show the authcode as '123 456'.
dd32
committed
Don't use sanitize_text_field() to 'sanitize' the authcodes provided, they should be compared as presented (within reason) not with alterations made to the value.
dd32
committed
Add the placeholder and space stripping to the TOTP setup process.
dd32
committed
In 893bd8a the Backup code class was changed from POST to REQUEST to match the others, this updates the unit test.
dd32
committed
TOTP: Add a unit test that validates invalid characters in the authcode do not pass, and that spaces/leading/trailing whitespace is acceptable.
dd32
committed
Tests: Verify that Backup codes validate_authentication fails appropriately without a code.
dd32
committed
Switch from using a placeholder with english-terms, to simply using the digits with letter spacing applied.
dd32
committed
Replace all whitespace mid-string in the authcode, and add a common function to provide the sanitization.
dd32
committed
Tests: Add a test for Two_Factor_Provider::sanitize_code_from_request() and Two_Factor_Provider::get_code().
dd32
committed
Switch from input[type=tel] to input[type=text][inputmode=numeric] for Authcode inputs, add a Javascript handler to enforce numeric-only inputs.
dd32
committed
Tests: Remove the test for Two_Factor_Provider::get_code() as it's failing.
dd32
committed
Apply the whitespace removal to the REST API TOTP setup process too.
dd32
authored
Fix typo.
dd32
authored

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Be more tolerant of user input for auth codes#518

Commits on Feb 15, 2023

Add placeholder examples on authcode prompt screen.

Be more tollerant of user input, allowing for authentication apps which show the authcode as '123 456'.

Don't use `sanitize_text_field()` to 'sanitize' the authcodes provided, they should be compared as presented (within reason) not with alterations made to the value.

Add the placeholder and space stripping to the TOTP setup process.

In `893bd8a` the Backup code class was changed from POST to REQUEST to match the others, this updates the unit test.

TOTP: Add a unit test that validates invalid characters in the authcode do not pass, and that spaces/leading/trailing whitespace is acceptable.

Tests: Verify that Backup codes validate_authentication fails appropriately without a code.

Switch from using a placeholder with english-terms, to simply using the digits with letter spacing applied.

Replace all whitespace mid-string in the authcode, and add a common function to provide the sanitization.

Tests: Add a test for Two_Factor_Provider::sanitize_code_from_request() and Two_Factor_Provider::get_code().

Switch from input[type=tel] to input[type=text][inputmode=numeric] for Authcode inputs, add a Javascript handler to enforce numeric-only inputs.

Tests: Remove the test for Two_Factor_Provider::get_code() as it's failing.

Apply the whitespace removal to the REST API TOTP setup process too.

Fix typo.

Commits on Feb 17, 2023

Merge branch 'master' into fix/user-tolerant-input

Switch to including a space in the digit placeholder, '123 456' and auto-insert a space mid-way through.

Automatically submit the 2FA form upon the correct length code being inserted.

Commits on Mar 3, 2023

Fix comment indentation.

Merge branch 'WordPress:master' into fix/user-tolerant-input