Merge pull request #4152 from ldidry/add-env-var-dev.sh

[github/wallabag/wallabag.git] / src / Wallabag / UserBundle / Entity / User.php

diff --git a/src/Wallabag/UserBundle/Entity/User.php b/src/Wallabag/UserBundle/Entity/User.php
index ab34e2bfc956d55cf1f3705ceb48cd3a535a22ef..aeab761db4df1a53e94649b0d2996bcecea98e28 100644 (file)
--- a/src/Wallabag/UserBundle/Entity/User.php
+++ b/src/Wallabag/UserBundle/Entity/User.php
@@ -188,8 +188,6 @@ class User extends BaseUser implements EmailTwoFactorInterface, GoogleTwoFactorI
     }
 
     /**
-     * @param Entry $entry
-     *
      * @return User
      */
     public function addEntry(Entry $entry)
@@ -339,7 +337,7 @@ class User extends BaseUser implements EmailTwoFactorInterface, GoogleTwoFactorI
      */
     public function isBackupCode(string $code): bool
     {
-        return \in_array($code, $this->backupCodes, true);
+        return false === $this->findBackupCode($code) ? false : true;
     }
 
     /**
@@ -347,7 +345,7 @@ class User extends BaseUser implements EmailTwoFactorInterface, GoogleTwoFactorI
      */
     public function invalidateBackupCode(string $code): void
     {
-        $key = array_search($code, $this->backupCodes, true);
+        $key = $this->findBackupCode($code);
 
         if (false !== $key) {
             unset($this->backupCodes[$key]);
@@ -355,8 +353,6 @@ class User extends BaseUser implements EmailTwoFactorInterface, GoogleTwoFactorI
     }
 
     /**
-     * @param Client $client
-     *
      * @return User
      */
     public function addClient(Client $client)
@@ -385,4 +381,24 @@ class User extends BaseUser implements EmailTwoFactorInterface, GoogleTwoFactorI
             return $this->clients->first();
         }
     }
+
+    /**
+     * Try to find a backup code from the list of backup codes of the current user.
+     *
+     * @param string $code Given code from the user
+     *
+     * @return string|false
+     */
+    private function findBackupCode(string $code)
+    {
+        foreach ($this->backupCodes as $key => $backupCode) {
+            // backup code are hashed using `password_hash`
+            // see ConfigController->otpAppAction
+            if (password_verify($code, $backupCode)) {
+                return $key;
+            }
+        }
+
+        return false;
+    }
 }