From 681ac8a837e28a09e1c39dd94d7d122c69aeaf60 Mon Sep 17 00:00:00 2001 From: Anton Afanasyeu Date: Sat, 11 Jul 2026 14:48:27 +0200 Subject: [PATCH] fix(auth-ui): login register link, QR approve TOTP form Remove default admin hint; show Create account; approve page accepts 6-digit code without prior mobile login. Co-authored-by: Cursor --- views/login.php | 7 +++++-- views/two_factor_approve.php | 23 +++++++++++++++++++---- 2 files changed, 24 insertions(+), 6 deletions(-) diff --git a/views/login.php b/views/login.php index 532bede..6e16ae7 100644 --- a/views/login.php +++ b/views/login.php @@ -12,6 +12,7 @@ */ $bp = Auth::basePath(); $auth = Auth::authUrl(); +$loginRedirect = $loginRedirect ?? ''; ?> @@ -44,6 +45,9 @@ $auth = Auth::authUrl(); diff --git a/views/two_factor_approve.php b/views/two_factor_approve.php index e3a35c0..e0bfc22 100644 --- a/views/two_factor_approve.php +++ b/views/two_factor_approve.php @@ -3,6 +3,7 @@ $bp = Auth::basePath(); $auth = Auth::authUrl(); $user = Auth::user(); $rawToken = trim($_GET['token'] ?? $_POST['token'] ?? ''); +$needsTotp = !$user && $approvalInfo && empty($approveResult); ?> @@ -38,7 +39,7 @@ $rawToken = trim($_GET['token'] ?? $_POST['token'] ?? '');

Your other device should now be logged in automatically.

-

This approval link has expired or is invalid.

+

Invalid or expired code. Open the QR link again from your desktop, or enter the current 6-digit authenticator code.

Back to hub @@ -48,13 +49,27 @@ $rawToken = trim($_GET['token'] ?? $_POST['token'] ?? '');

Approve sign-in on another device?

- Tap Approve to log in the browser that showed you this QR code.
+ + Tap Approve to log in the browser that showed you this QR code.
+ + Enter the 6-digit code from your authenticator app to approve the other device.
+ This link expires in a few minutes.

-
+ - + + + +
+ +

+ Already signed in on this phone? + Sign in first +

+

Cancel