search

twofas / 2fas-browser-extension

Source code for 2FAS Browser Extension
https://2fas.com/browser-extension
GNU General Public License v3.0
266 stars 36 forks source link

inputToken.js - fix for Fortra GoAnywhere #83

Closed RonnyAL closed 3 months ago

RonnyAL commented 4 months ago

This site uses a hidden input field for actual MFA token submission, while the visible input field presents as a password field with masked input (but isn't actually of type "password").

I made a simple fix that doesn't incorporate delays and "typing action" because I didn't want to change too many lines. Let me know if you'd like an approach that retains these techniques, and I'll submit a new request.

GrzegorzZajac000 commented 4 months ago

Thank you for your contribution. I will implement the change in the next update ;)

GrzegorzZajac000 commented 4 months ago

@RonnyAL Can you provide me any site where I can test it?

RonnyAL commented 4 months ago

@RonnyAL Can you provide me any site where I can test it?

Unfortunately, the only place I know of is my second employer's company specific page (which requires being in the company network or on VPN anyway), and even if I were to give you access, you'd have to provide a valid username and password to get the MFA prompt.

Having that said, I can happily test this for you if you give me some instructions on how to!

GrzegorzZajac000 commented 4 months ago

@RonnyAL it's kind of tricky, because you need to find the right events (keydown/keypress/keyup/change/input etc.) to which the MFA script responds correctly. Can you record some video what happen with current version of extension?

We don't want to merge code that hasn't been tested by us. In addition, we would like the behavior to be the same for all websites.

EDIT: I contacted Fortra asking for a test account ;)

GrzegorzZajac000 commented 3 months ago

v1.7.2 should fix this issue, so I'm closing PR ;)