Changeset

3568:6b3181fe5617

mod_auth_token: Timezone fix for TOTP checking luatz.time() returns milliseconds since epoch which is in UTC time, so we don't need to convert to UTC with gmtime. By calling gmtime, TOTP validation was failing when this module wasn't running on machine set to UTC time.
author JC Brand <jc@opkode.com>
date Thu, 02 May 2019 11:07:27 +0200
parents 3567:179424d557f2
children 3569:cc4f7361dac7
files mod_auth_token/token_auth_utils.lib.lua
diffstat 1 files changed, 1 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/mod_auth_token/token_auth_utils.lib.lua	Tue Apr 30 10:45:00 2019 +0100
+++ b/mod_auth_token/token_auth_utils.lib.lua	Thu May 02 11:07:27 2019 +0200
@@ -48,7 +48,7 @@
 	local signature = base64.decode(string.match(password, " (.+)"))
 	local jid = username.."@"..realm
 
-	if totp:verify(otp, OTP_DEVIATION, luatz.gmtime(luatz.time())) then
+	if totp:verify(otp, OTP_DEVIATION, luatz.time()) then
 		log("debug", "The TOTP was verified");
 		local hmac_ctx = hmac.new(token_secret, DIGEST_TYPE)
 		if signature == hmac_ctx:final(otp..nonce..jid) then