Znote / ZnoteAAC

Developement repository for the Znote AAC project. A website portal to represent and manage your Open Tibia server.
MIT License
145 stars 127 forks source link

Potential 2FA issue (enable - activate on few accounts - disable = account blocked). #384

Open Znote opened 4 years ago

Znote commented 4 years ago

Because the secret column is populated, the ability to login normally may be completely blocked (in-game and through AAC), even though 2FA is disabled.

This occurs if 2FA was previously enabled, and accounts set up a 2FA key.

Because this is a column related outside of Znote AAC, I might need to figure out a smart way to clear the accounts secret key, and temporarily store it in a znote_ table during deactivation?

Or just provide a helping SQL query to sort this out and clear 2FA keys from accounts table that an OT admin can execute manually.

Something along the lines of:

-- Warning, this will destroy every registered 2FA keys on the server. 
-- People who use 2FA, will have to scan a new 2FA QR code 
-- and generate a new account on their 2FA app.
UPDATE `accounts` 
SET `secret` = NULL
WHERE `secret` IS NOT NULL;