[#12497] - 2fa handeling for mcrypt and openssl
- Fixed in Code Base
- 21 Oct 2016
- Medium
- Build: 3.6.4
- # 12497
- Diff
- rdeutz:3.6.4-2fa-fix
- Success continuous-integration/drone the build was successful Details
- Success continuous-integration/travis-ci/pr The Travis CI build passed Details
User tests: Successful: Unsuccessful:
PR for issue #12458
Executive summary
This PR checks the data and if the data is crypted with mcyrpt it converts the data to openssl (the new default, when available) and saves the new data. It also saves the configuration data un-crypted because it isn’t more secure to save them crypted.
Background information
Since we merged an update for fof to make it compatible for PHP 7.x the default aes-adapter has changed.
Backwards compatibility
It is a fix for a B/C problem
Translation impact
nothing
Testing instruction
- Create a 3.6.2 or lower site
- Add a user and add either of the 2fa
check it works
Upgrade the site to 3.6.3 and try to login with the same user
This should fail
- Create a new user and enable 2fa
- try to log in, this should work
Apply patch
Now you should be able to login with all users using 2fa.
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Labels |
Added:
?
|
||
| Category | ⇒ | Administration Components External Library Libraries |
I have tested this item
Tested with Google Authenticator.
I confirm it is now working fine with both a 362 and a 363 created user.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12497.
workz
I have tested this item
Joomla 3.6.2
Admin login - key required
com_users - key required
mod_login - key required
Upgraded to Joomla 3.6.3
Admin login - key ignored
com_users - key ignored
mod_login - key ignored
Joomla 3.6.3 + pr
Admin login - key required
com_users - key required
mod_login - key required
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12497.
Maybe good to know:
I just found that an Akeeba Backup (.jpa) from Jooma 3.6.3 when 2FA is enabled can't be restored any more: Found in errorlog: PHP Fatal error: Uncaught Error: Class 'FOFUtilsPhpfunc' not found in D:\Buro\Aaa\flexbox\libraries\fof\encrypt\aes.php
Will report this also to Akeeba Backup ofcourse
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12497.
| Status | Pending | ⇒ | Ready to Commit |
RTC as last changes only concerned typos in comments
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/12497.
| Labels |
Added:
?
|
||
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2016-10-21 15:27:06 |
| Closed_By | ⇒ | mbabker |
| Labels |
Removed:
?
|
||
Question, since I didn't clearly grab this out of the report. Will this handle users who have saved new 2FA configs on 3.6.3 which were encrypted with OpenSSL as well as deal with the mcrypt stuff?