use separate database column for OTP secrets (migrate previous format if needed)

1 files changed, 5 insertions, 0 deletions

diff --git a/classes/pref/users.php b/classes/pref/users.php
index cac0dca7c..068166863 100644
--- a/classes/pref/users.php
+++ b/classes/pref/users.php
@@ -119,6 +119,11 @@ class Pref_Users extends Handler_Administrative {
 				$user->email = clean($_REQUEST["email"]);
 				$user->otp_enabled = checkbox_to_sql_bool($_REQUEST["otp_enabled"]);
 
+				// force new OTP secret when next enabled
+				if (Config::get_schema_version() >= 143 && !$user->otp_enabled) {
+					$user->otp_secret = null;
+				}
+
 				$user->save();
 			}