From 86c33124c364ba6c245fba23b35f9aa37d71ff5c Mon Sep 17 00:00:00 2001
From: Anton Afanasyeu <a.afanasieff@gmail.com>
Date: Sat, 11 Jul 2026 21:40:01 +0200
Subject: [PATCH] fix(2fa): caption link uses scan URL with src=qr query param

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 views/two_factor_challenge.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/views/two_factor_challenge.php b/views/two_factor_challenge.php
index 1e5e3b0..be0a5e7 100644
--- a/views/two_factor_challenge.php
+++ b/views/two_factor_challenge.php
@@ -48,8 +48,8 @@ if (!isset($twofaQr)) {
         <img src="<?= h((string) $twofaQr['qr_url']) ?>" width="160" height="160" alt="QR code — scan with phone camera to approve sign-in" class="twofa-qr">
         <figcaption class="muted" data-i18n="twofa.qr_caption">
           Phone camera → tap link → Approve
-          <?php if (!empty($twofaQr['short_url'])): ?>
-            · <a href="<?= h((string) $twofaQr['short_url']) ?>" rel="noopener"><?= h((string) $twofaQr['short_url']) ?></a>
+          <?php if (!empty($twofaQr['scan_url']) || !empty($twofaQr['short_url'])): ?>
+            · <a href="<?= h((string) ($twofaQr['scan_url'] ?? $twofaQr['short_url'])) ?>" rel="noopener"><?= h((string) ($twofaQr['short_url'] ?? '')) ?></a>
           <?php endif; ?>
         </figcaption>
       </figure>