From 5db7f75292eb7ad0a8cfd3d1afe6b29202e25c1d Mon Sep 17 00:00:00 2001
From: eddie <13182421+cpalv@users.noreply.github.com>
Date: Tue, 1 Oct 2024 02:06:38 -0500
Subject: [PATCH] hide otp

---
 src/www/system_usermanager.php | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/www/system_usermanager.php b/src/www/system_usermanager.php
index 2ebd89216c1..d976d039b61 100644
--- a/src/www/system_usermanager.php
+++ b/src/www/system_usermanager.php
@@ -434,6 +434,19 @@ function get_user_privdesc(& $user)
         $('#otp_qrcode').show();
     });
 
+    // Show OTP
+    var otp_hidden = true;
+    $('#show_otp').on("click", function () {
+        if (otp_hidden) {
+            var hidden = document.getElementById("otp_seed").value;
+            document.getElementById("otp_seed_text").textContent = hidden;
+            otp_hidden = false;
+        } else {
+            document.getElementById("otp_seed_text").textContent = '****************';
+            otp_hidden = true;
+        }
+    });
+
     // remove user
     $(".act-del-user").click(function(event){
       var userid = $(this).data('userid');
@@ -913,9 +926,13 @@ class="btn btn-default btn-xs" data-toggle="tooltip" title="<?=gettext("export c
                   <tr>
                     <td><a id="help_for_otp_seed" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?= gettext('OTP seed') ?></td>
                     <td>
-                      <input name="otp_seed" type="text" value="<?=$pconfig['otp_seed'];?>"/>
+                      <?php // on initial install, there is no OTP seed.  Check if it is set ?>
+                      <textarea id="otp_seed_text" cols="65" rows="1"><?= isset($pconfig['otp_seed']) ? gettext('****************') : "";?></textarea>
+                      <input id="otp_seed" name="otp_seed" type="hidden" value="<?=$pconfig['otp_seed'];?>"/>
                       <input type="checkbox" name="gen_otp_seed"/>
                       <small><?= gettext('Generate new secret (160 bit)') ?></small>
+                      <input id="show_otp" type="checkbox"/>
+                      <small><?= gettext('Show OTP seed') ?></small>
                       <div class="hidden" data-for="help_for_otp_seed">
                         <?=gettext("OTP (base32) seed to use when a one time password authenticator is used");?><br/>
                       </div>