token can be used several times

[individual-it]

1. login using a token
2. remember the token
3. logout
4. login again using the same token

From RFC6238 :

   Note that a prover may send the same OTP inside a given time-step
   window multiple times to a verifier.  The verifier MUST NOT accept
   the second attempt of the OTP after the successful validation has
   been issued for the first OTP, which ensures one-time only use of an
   OTP.

[PVince81]

likely not a regression as this part of the code wasn't touched

[karakayasemi]

If someone listens to the user-server conversation and learns the secret, he/she still should be unable to log on. I am planning to add a column to app table for the last secret and prevent this situation.

[davitol]

Retested following these stpes:

    login using a token
    remember the token
    logout
    login again using the same token

It keeps failing. I'm still able to log in with the same token. (tested with oC 10.0.9 and TOTP release-0.5.0)

[PVince81]

@karakayasemi ^

[PVince81]

• revert on release branch: Release 0.5.0 reverts #64
• revert on master ?

[karakayasemi]

Somehow mapper update is not working in this line: https://github.com/owncloud/twofactor_totp/blob/master/lib/Service/Totp.php#L123. lastValidatedKey column always null. I will debug it.

[karakayasemi]

I found my mistake. To prevent method does not exist warnings in createMock function, I implemented set function for last_validated_key column in here: https://github.com/owncloud/twofactor_totp/blob/master/lib/Db/TotpSecret.php#L65. Obviously, entity setters are doing more than just assignment. They are also updating UpdatedFields of the entity. I will create a fix for my mistake.
Should I open PR for master or which way I should follow?

[PVince81]

please open a PR for master

in the future please also manually test to make sure everything works

[karakayasemi]

Okay, I will be more careful. Sorry for the mess.