mirror of
https://github.com/mailcow/mailcow-dockerized.git
synced 2026-11-11 02:41:33 +00:00
Bilal Zahid
d93f32072e
The forced TFA enrollment form submitted the raw credential JSON in the 'token' field, which set_tfa()'s webauthn case never reads. It expects the parsed \['registration'] object that only the JSON API builds, so the form POST inserted a row with an empty keyHandle and a NULL publicKey while still reporting success. Every WebAuthn 2FA login then failed, because webauthn-tfa-get-args sent an empty credential id in allowCredentials. - base.twig: POST the attestation to /api/v1/add/webauthn-tfa-registration like the regular WebAuthn modal does - functions.inc.php: refuse incomplete WebAuthn registrations - lang.en-gb.json: message for the new guard
