mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-09-19 08:37:14 +00:00
sdhfsl
f3096bb3c1
Move the +/-1 window helper to internal/util/totp so both 2FA acceptance points use it: login (CheckUser) and disable/rebind plus username/password changes (VerifyTwoFactorCode). Also shrink comments to the 2-line house rule and anchor the unit test mid-window to avoid a step-boundary flake. Addresses review on #6546 (MEDIUM + 2 LOWs).
23 lines
554 B
Go
23 lines
554 B
Go
package totp
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/xlzd/gotp"
|
|
)
|
|
|
|
// SkewWindows is how many 30s steps around now VerifyWithSkew accepts.
|
|
// Standard TOTP clock-drift tolerance, see MHSanaei/3x-ui#6535.
|
|
const SkewWindows = 1
|
|
|
|
// VerifyWithSkew accepts the code for the current step plus/minus SkewWindows.
|
|
func VerifyWithSkew(secret, code string, now time.Time) bool {
|
|
totp := gotp.NewDefaultTOTP(secret)
|
|
for i := -SkewWindows; i <= SkewWindows; i++ {
|
|
if totp.AtTime(now.Add(time.Duration(i*30)*time.Second)) == code {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|