From 157f9ac311aec68ef1eb1558f8a17c3b5452728f Mon Sep 17 00:00:00 2001 From: Anton Afanasyeu Date: Sun, 5 Jul 2026 19:12:53 +0200 Subject: [PATCH] fix(2fa): avoid double QR mint, i18n poll status, send credentials Co-authored-by: Cursor --- public/assets/js/two_factor.js | 26 +++++++++++++++++++++----- views/two_factor_challenge.php | 4 +++- 2 files changed, 24 insertions(+), 6 deletions(-) diff --git a/public/assets/js/two_factor.js b/public/assets/js/two_factor.js index 408a26a..a61b7d0 100644 --- a/public/assets/js/two_factor.js +++ b/public/assets/js/two_factor.js @@ -72,13 +72,28 @@ var pollActive = true; var INTERVAL = 2500; // ms - function showStatus(msg) { + function showStatus(text) { if (statusEl) { statusEl.style.display = ''; - statusEl.textContent = msg; + statusEl.textContent = text; } } + function msg(key, fallback) { + var i18n = typeof window !== 'undefined' ? window.CrashI18n : null; + if (i18n && typeof i18n.t === 'function') { + var s = i18n.t(key); + if (s && s !== key) { + return s; + } + } + return fallback; + } + + function showStatusMsg(key, fallback) { + showStatus(msg(key, fallback)); + } + function stopPolling() { pollActive = false; if (pollTimer) { @@ -94,6 +109,7 @@ var url = pollUrl + '?token=' + encodeURIComponent(pollToken); var xhr = new XMLHttpRequest(); xhr.open('GET', url, true); + xhr.withCredentials = true; xhr.onload = function () { if (!pollActive) { return; @@ -106,7 +122,7 @@ } if (data.status === 'approved' && data.redirect) { stopPolling(); - showStatus('✅ Approved — signing you in…'); + showStatusMsg('twofa.approved', '✅ Approved — signing you in…'); setTimeout(function () { window.location.href = data.redirect; }, 400); @@ -114,14 +130,14 @@ } if (data.status === 'expired' || data.status === 'used' || data.status === 'not_found') { stopPolling(); - showStatus('⚠️ QR code expired. Reload to get a new one.'); + showStatusMsg('twofa.qr_expired', '⚠️ QR code expired. Reload to get a new one.'); if (qrWrap) { qrWrap.style.opacity = '0.35'; } return; } // status === 'pending' — keep polling - showStatus('⏳ Waiting for mobile approval…'); + showStatusMsg('twofa.waiting_approval', '⏳ Waiting for mobile approval…'); scheduleNext(); }; xhr.onerror = function () { diff --git a/views/two_factor_challenge.php b/views/two_factor_challenge.php index 9b10a71..c7e494d 100644 --- a/views/two_factor_challenge.php +++ b/views/two_factor_challenge.php @@ -1,7 +1,9 @@