nextcloud / nextcloud/twofactor_gateway

Hiding the one-time pass code using style approach in Signal

Open
#598 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
122
Forks
63
Avg merge
3d 17h
Merged PRs (30d)
23

Description

Hi! With the recent update in the bbernhard's Signal CLI REST API, dev branch it is possible to use styles:

**bold**
*italic*
`monospaced`
~stricken-through~ 
||this is a spoiler||

My suggestion is to hide the one-time passcode from unintended eyes by hiding it under the cut, so it will look like this:

image

A user will click on blurred rectangle and see it.

For that I've made a small workaround to the code:
lib/Provider/AProvider.php:

108 + $secret = '||'.$secret.'||'

and

lib/Service/Gateway/Signal/Gateway.php:

80                     $response = $client->post(
81                             $this->config->getUrl() . '/v2/send',
82                             [
83                                     'json' => [
84 +                                           'text_mode' => 'styled',
85                                             'message' => $message,
86                                             'number' => $registered_acct,
87                                             'recipients' => $recipient_acct
88                                              ],
89
90                             ]
91                     );

I understand that this is a workaround, and there should be a nicer solution, eg

  1. to detach $secret from the whole var $message
  2. to rewrite the Signal provider Gateway.php: apply styling to $secret and concatenate with the rest in $message.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in lib/Provider/AProvider.php where the one-time secret is added to the message, then inspect lib/Service/Gateway/Signal/Gateway.php and its /v2/send request. Confirm how styled Signal messages are enabled and determine how to hide only the passcode while preserving the rest of the message; done means the passcode is revealed only after clicking the hidden area.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.