Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong ID used for TOTP secret label #2277

Closed
3 of 6 tasks
UncleSamSwiss opened this issue Mar 2, 2022 · 1 comment
Closed
3 of 6 tasks

Wrong ID used for TOTP secret label #2277

UncleSamSwiss opened this issue Mar 2, 2022 · 1 comment
Assignees
Labels
bug Something is not working.

Comments

@UncleSamSwiss
Copy link

UncleSamSwiss commented Mar 2, 2022

Preflight checklist

Describe the bug

The message ID used in NewInfoSelfServiceSettingsTOTPSecretLabel() should in my opinion be InfoSelfServiceSettingsTOTPSecretLabel and not InfoSelfServiceSettingsTOTPSecret. Otherwise the same ID is used for the label as well as for the content.

See here:

ID: InfoSelfServiceSettingsTOTPSecret,

The variable is already used above:

ID: InfoSelfServiceSettingsTOTPSecret,

Reproducing the bug

I guess you could try to retrieve the TOTP settings and you would see the structure using twice the same ID. (Not tested).

Relevant log output

No response

Relevant configuration

No response

Version

0.8.2-alpha.1, but still valid on master

On which operating system are you observing this issue?

No response

In which environment are you deploying?

No response

Additional Context

No response

@UncleSamSwiss UncleSamSwiss added the bug Something is not working. label Mar 2, 2022
@UncleSamSwiss
Copy link
Author

Besides the above mentioned bug, I found the following other issues in the message ID code. If you prefer, I can open separate issues for each of them.

  • Add/remove security key use the same ID (InfoSelfServiceSettingsRegisterWebAuthn):

    func NewInfoSelfServiceRegisterWebAuthn() *Message {
    return &Message{
    ID: InfoSelfServiceSettingsRegisterWebAuthn,
    Text: "Add security key",
    Type: Info,
    }
    }

    and
    func NewInfoSelfServiceRemoveWebAuthn(name string, createdAt time.Time) *Message {
    return &Message{
    ID: InfoSelfServiceSettingsRegisterWebAuthn,
    Text: fmt.Sprintf("Remove security key \"%s\"", name),
    Type: Info,
    Context: context(map[string]interface{}{
    "display_name": name,
    "added_at": createdAt,
    }),
    }
    }

  • Two backup recovery code messages use the same ID (ErrorValidationLookupAlreadyUsed):

    func NewErrorValidationLookupAlreadyUsed() *Message {
    return &Message{
    ID: ErrorValidationLookupAlreadyUsed,
    Text: "This backup recovery code has already been used.",
    Type: Error,
    Context: context(nil),
    }
    }
    func NewErrorValidationLookupInvalid() *Message {
    return &Message{
    ID: ErrorValidationLookupAlreadyUsed,
    Text: "The backup recovery code is not valid.",
    Type: Error,
    Context: context(nil),
    }
    }

@aeneasr aeneasr self-assigned this Mar 4, 2022
aeneasr added a commit that referenced this issue Mar 4, 2022
@aeneasr aeneasr closed this as completed Mar 4, 2022
aeneasr added a commit that referenced this issue Mar 6, 2022
aeneasr added a commit that referenced this issue Mar 6, 2022
aeneasr added a commit that referenced this issue Mar 7, 2022
peturgeorgievv pushed a commit to senteca/kratos-fork that referenced this issue Jun 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something is not working.
Projects
None yet
Development

No branches or pull requests

2 participants