Bilal Zahid d93f32072e fix(web): post WebAuthn TFA enrollment through the JSON API ...

The forced TFA enrollment form submitted the raw credential JSON in the
'token' field, which set_tfa()'s webauthn case never reads. It expects the
parsed \['registration'] object that only the JSON API builds, so the
form POST inserted a row with an empty keyHandle and a NULL publicKey while
still reporting success. Every WebAuthn 2FA login then failed, because
webauthn-tfa-get-args sent an empty credential id in allowCredentials.

- base.twig: POST the attestation to /api/v1/add/webauthn-tfa-registration
  like the regular WebAuthn modal does
- functions.inc.php: refuse incomplete WebAuthn registrations
- lang.en-gb.json: message for the new guard

2026-10-13 19:25:17 +05:00

..

assets

Merge pull request #6223 from mailcow/ffdhe2048

2025-02-12 10:48:22 +01:00

conf

[Rspamd] Fix CTE and boundary prefix in domain wide footer

2026-10-06 09:41:34 +02:00

Dockerfiles

[Rspamd] update to 4.2.1

2026-10-06 09:41:51 +02:00

hooks

[SOGo] Added hooks support for SOGo image (#4181)

2021-07-28 21:41:44 +02:00

web

fix(web): post WebAuthn TFA enrollment through the JSON API

2026-10-13 19:25:17 +05:00