Pull Request resolves # .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Totp::checkCode() matched the generated one-time passcode against the submitted value with a loose ==. getCode() returns a zero-padded numeric string, so PHP numeric juggling makes non-codes compare equal ("012345" == 12345, "123456" == "+123456", "123456" == " 123456"), and the comparison is not constant time. Switched to hash_equals() with a string cast. The TOTP setup handler read the code with getInt('code'), which drops leading zeros before it ever reaches the check; it now uses getCmd('code'), the same as the email MFA plugin and the captive login path, so the strict comparison keeps working for codes that start with 0. The fixed MFA plugin already uses hash_equals; this aligns the TOTP path with it.

Testing Instructions

1. Enable the TOTP multi-factor method for a user and complete the Google Authenticator setup.
2. On the captive login page, enter the current 6-digit code prefixed with a + (for example +123456).

Unit test: tests/Unit/Libraries/Cms/Encrypt/TotpTest.php.

Actual result BEFORE applying this Pull Request

+123456 (and other numeric-juggling variants of the current code) is accepted as a valid code.

Expected result AFTER applying this Pull Request

Only the exact current code is accepted; juggling variants are rejected, and codes with a leading zero still validate.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed