From: Tim Düsterhus <duesterhus@woltlab.com>
Date: Tue, 10 Nov 2020 14:19:39 +0000 (+0100)
Subject: Clear MFA inputs if an invalid code is entered
X-Git-Tag: 5.4.0_Alpha_1~555^2~53^2~8
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=32f9874ae713922e721e27372c6f068ba89488fd;p=GitHub%2FWoltLab%2FWCF.git

Clear MFA inputs if an invalid code is entered

It's not useful preserving an invalid code for the user.
---

diff --git a/wcfsetup/install/files/lib/system/user/multifactor/BackupMultifactorMethod.class.php b/wcfsetup/install/files/lib/system/user/multifactor/BackupMultifactorMethod.class.php
index 4a70764c8b..cdb217e85f 100644
--- a/wcfsetup/install/files/lib/system/user/multifactor/BackupMultifactorMethod.class.php
+++ b/wcfsetup/install/files/lib/system/user/multifactor/BackupMultifactorMethod.class.php
@@ -219,6 +219,7 @@ class BackupMultifactorMethod implements IMultifactorMethod {
 					FloodControl::getInstance()->registerUserContent('com.woltlab.wcf.multifactor.backup', $setupId);
 					$attempts = FloodControl::getInstance()->countUserContent('com.woltlab.wcf.multifactor.backup', $setupId, new \DateInterval('PT1H'));
 					if ($attempts['count'] > self::USER_ATTEMPTS_PER_HOUR) {
+						$field->value('');
 						$field->addValidationError(new FormFieldValidationError(
 							'flood',
 							'wcf.user.security.multifactor.backup.error.flood',
@@ -230,6 +231,7 @@ class BackupMultifactorMethod implements IMultifactorMethod {
 					$userCode = \preg_replace('/\s+/', '', $field->getValue());
 					
 					if ($this->findValidCode($userCode, $codes) === null) {
+						$field->value('');
 						$field->addValidationError(new FormFieldValidationError('invalid'));
 					}
 				})),
diff --git a/wcfsetup/install/files/lib/system/user/multifactor/TotpMultifactorMethod.class.php b/wcfsetup/install/files/lib/system/user/multifactor/TotpMultifactorMethod.class.php
index 9ab6969a34..d081f22020 100644
--- a/wcfsetup/install/files/lib/system/user/multifactor/TotpMultifactorMethod.class.php
+++ b/wcfsetup/install/files/lib/system/user/multifactor/TotpMultifactorMethod.class.php
@@ -67,6 +67,7 @@ class TotpMultifactorMethod implements IMultifactorMethod {
 						
 						$minCounter = 0;
 						if (!$totp->validateTotpCode($field->getValue(), $minCounter, new \DateTime())) {
+							$field->value('');
 							$field->addValidationError(new FormFieldValidationError('invalid'));
 						}
 						$field->minCounter($minCounter);
@@ -211,6 +212,7 @@ class TotpMultifactorMethod implements IMultifactorMethod {
 					FloodControl::getInstance()->registerUserContent('com.woltlab.wcf.multifactor.backup', $setupId);
 					$attempts = FloodControl::getInstance()->countUserContent('com.woltlab.wcf.multifactor.backup', $setupId, new \DateInterval('PT10M'));
 					if ($attempts['count'] > self::USER_ATTEMPTS_PER_TEN_MINUTES) {
+						$field->value('');
 						$field->addValidationError(new FormFieldValidationError(
 							'flood',
 							'wcf.user.security.multifactor.totp.error.flood',
@@ -235,6 +237,7 @@ class TotpMultifactorMethod implements IMultifactorMethod {
 					$totp = new Totp($selectedDevice['secret']);
 					$minCounter = $selectedDevice['minCounter'];
 					if (!$totp->validateTotpCode($field->getValue(), $minCounter, new \DateTime())) {
+						$field->value('');
 						$field->addValidationError(new FormFieldValidationError('invalid'));
 					}
 					$field->minCounter($minCounter);