One-use emergency passwords - does not stay in memory

Permalink Browser Info Environment
This can not works like this? One-use emergency passwords always reset without reason when you log on to the page and use application generated authenticated code.
I have understood that One-use emergency passwords reset only after it has been used.

Type: Ticket
Status: Archived
67072568252
View Replies:
mnakalay replied on at Permalink Reply
mnakalay
Hello,

Thank you for bringing this to my attention.

It is almost midnight here so I will have a look in the morning and fix the issue.
mnakalay replied on at Permalink Reply 1 Attachment
mnakalay
Hi again,

I have tested the password functionality and it worked perfectly. I used the following steps:
1- I activated emergency passwords globally from the settings
2- I added two step verification to a user account
3- I activated emergency passwords for that user
4- I generated an emergency password for that user
5- I logged in as that user using application generated code (not emergency password)
6- After checking, the emergency password was still present and active as it should be.

I have the feeling you might have checked one of the other user attributes that the system uses for processing. There are3 attributes that say in big DO NOT EDIT DIRECTLY UNLESS YOU KNOW WHAT YOU ARE DOING.

One of them is labeled "Has used Emergency Password". If you have checked that attribute yourself manually then yes, your emergency password will be erased after you log in. That is why you should never touch it yourself as it says in big.

I am attaching a screenshot.

Let me know if this solved the problem.
67072568252 replied on at Permalink Reply
67072568252
I'm not edit these fields directly, or checked these fields.

Do i try removing that authentication/folder and doing the authentication again if there something old data in memory?
mnakalay replied on at Permalink Reply
mnakalay
No that's not where the calculation happens.

I checked the package on the same environment you have Concrete5 8.2.1 and PHP 7 and it works perfectly so I am not sure why it would fail for you.

I made a tiny modification just to be sure but on my side, it didn't make a difference it was already working.

I also modified the attributes to make sure they are not modified manually, even by accident.

Could you update to version 1.0.6 and try again please?

Thank you
67072568252 replied on at Permalink Reply
67072568252
Thanks.. i try that..
I do not know if there also doing with this? -
https://www.concrete5.org/community/forums/chat/help-needed/#904808...
after our web host made php7 update couple weeks ago there has been something strange..
67072568252 replied on at Permalink Reply
67072568252
I update the new version and now one use e- password works.
Awesome, thank you very much!
mnakalay replied on at Permalink Reply
mnakalay
Awesome! great to hear.

Really I don't think it had anything to do with PHP.

Since you're happy with the support :) Can I ask you to please leave a review for this plugin? Users' reviews really go a long way to help others considering the plugin and to give them an unbiased opinion.
You can do it here:https://www.concrete5.org/marketplace/addons/two-factor-login-securi...

Thank you
67072568252 replied on at Permalink Reply
67072568252
done! 😃
mnakalay replied on at Permalink Reply
mnakalay
Thank you so much, I really appreciate it.
ConcreteCMS replied on at Permalink Reply
ConcreteCMS
Attention: Since there has been no activity on this issue for two weeks, this issue has been automatically archived.

To re-open this issue, reply to this message.

concrete5 Environment Information

# concrete5 Version
Core Version - 8.2.1
Version Installed - 8.2.1

# Server Software
Apache/2

# PHP Version
7.0.23

Browser User-Agent String

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0

Hide Post Content

This will replace the post content with the message: "Content has been removed by an Administrator"

Hide Content

Request Refund

You may not request a refund that is not currently owned by you.