Aleksey Fedorov 7367ff75cd fix(2fa): accept display forms of the TOTP secret and never panic on a bad one (#7113) ...

gotp decodes the stored secret with strict base32 and panics when that fails,
so a 2FA secret saved through the settings API in lower case, grouped by
spaces, or not base32 at all turned every login and every attempt to turn 2FA
off into an HTTP 500. An empty secret had the opposite problem: the login
check accepted the code of an empty HMAC key, which anyone can compute.

VerifyWithSkew now normalizes the secret and verifies nothing for an empty or
non-base32 one, so secrets already stored in a display form work again.
Turning 2FA on through the settings update stores the normalized secret and
refuses one no authenticator could match.

2026-11-13 00:13:13 +01:00

..

amneziawg

fix(amneziawg): let an emptied forwardedPorts withdraw a client's forwards

2026-11-01 08:55:38 +01:00

amneziawgkern

fix(amneziawg): validate peer subnets before enabling kernel mode (#6965)

2026-11-03 15:52:26 +01:00

amneziawgnet

fix(amneziawgnet): stop tests binding fixed ports in the ephemeral range

2026-11-01 15:14:49 +01:00

config

v3.11.0

2026-10-25 20:08:14 +01:00

crypto/nodetoken

fix(nodetoken): stop refusing every node-token key file on Windows

2026-09-27 15:55:42 +02:00

database

fix(xray): adopt freedom finalRules delay and logLevel

2026-11-12 19:10:18 +01:00

eventbus

chore: refresh dependencies, fix Linux tool tasks, modernize Go idioms

2026-07-25 16:08:09 +02:00

logger

fix(logger): reuse the open log rotator when InitLogger runs again

2026-09-27 15:32:20 +02:00

mtproto

fix(mtproto): leave clients mtg cannot parse out of the generated config

2026-11-01 13:27:02 +01:00

nodee2e

fix(sync): preserve shared client lifecycle across nodes (#7038)

2026-11-02 15:27:44 +01:00

pia

chore(build): bump Go toolchain to 1.27.0

2026-08-23 21:57:03 +02:00

sub

fix(test): pin Havana repeated-midnight cases to a past transition

2026-11-06 18:53:43 +01:00

testpg

test(database): give each package its own schema when tests run on PostgreSQL (#6594)

2026-09-26 21:13:42 +02:00

tuic

fix(tuic): bound what unauthenticated connections cost

2026-10-31 15:03:21 +01:00

tunnelmonitor

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

util

fix(2fa): accept display forms of the TOTP secret and never panic on a bad one (#7113)

2026-11-13 00:13:13 +01:00

web

fix(2fa): accept display forms of the TOTP secret and never panic on a bad one (#7113)

2026-11-13 00:13:13 +01:00

xray

fix(update): keep Xray-core running until update downloads finish (#7002)

2026-11-02 15:17:01 +01:00