[SonataIntegrationBundle] Handle 2FA totp secret empty submission

mpoiriert · Nov 21, 2023 · ab57ce0 · ab57ce0
1 parent f033403
commit ab57ce0
Showing 1 changed file with 20 additions and 11 deletions.
diff --git a/packages/sonata-integration-bundle/User/Controller/TwoFactorAuthenticationController.php b/packages/sonata-integration-bundle/User/Controller/TwoFactorAuthenticationController.php
@@ -48,17 +48,19 @@ public function enable2faAction(
                 return new RedirectResponse($this->admin->generateObjectUrl('disable-2fa', $user));
             }
 
-            $user->setTotpSecret($enable2fa->totpSecret);
-            if ($totpAuthenticator->checkCode($user, $enable2fa->code)) {
-                $user->enableTwoFActorAuthenticationProvider('totp');
-                $this->admin->getModelManager()->update($user);
-
-                $this->addFlash(
-                    'sonata_flash_success',
-                    $this->trans('admin.flash.2fa_enabled', [], 'DrawUserBundle')
-                );
-
-                return $this->redirectTo($request, $user);
+            if ($enable2fa->totpSecret) {
+                $user->setTotpSecret($enable2fa->totpSecret);
+                if ($totpAuthenticator->checkCode($user, $enable2fa->code)) {
+                    $user->enableTwoFActorAuthenticationProvider('totp');
+                    $this->admin->getModelManager()->update($user);
+
+                    $this->addFlash(
+                        'sonata_flash_success',
+                        $this->trans('admin.flash.2fa_enabled', [], 'DrawUserBundle')
+                    );
+
+                    return $this->redirectTo($request, $user);
+                }
             }
 
             $this->addFlash(
@@ -74,6 +76,13 @@ public function enable2faAction(
             $totpSecret = $user->getTotpSecret();
             $enable2fa->totpSecret = $totpSecret;
             $form->setData($enable2fa);
+        } elseif (!$user->getTotpSecret()) {
+            $this->addFlash(
+                'sonata_flash_error',
+                $this->trans('admin.flash.2fa_invalid_code_refreshed', [], 'DrawUserBundle')
+            );
+
+            return new RedirectResponse($this->admin->generateObjectUrl('enable-2fa', $user));
         }
 
         $qrCode = $qrCodeGenerator->getTotpQrCode($user);