146
edits
Module Two-Factor Authentication (2FA): Difference between revisions
Module Two-Factor Authentication (2FA) (view source)
Revision as of 22:09, 14 October 2026
, 14 days agoVersion 6.0.4: Google Authenticator fix, verified on Dolibarr 16 to 24
Theopequiii (talk | contribs) (Link to the full presentation and support of the module (purchase on the DoliStore)) |
Theopequiii (talk | contribs) (Version 6.0.4: Google Authenticator fix, verified on Dolibarr 16 to 24) |
||
| Line 18: | Line 18: | ||
|- | |- | ||
! Version | ! Version | ||
| 6.0. | | 6.0.4 | ||
|- | |- | ||
! Dolibarr | ! Dolibarr | ||
| Line 69: | Line 69: | ||
== Compatibility == | == Compatibility == | ||
* Dolibarr 16 to 24 (verified on 16, 18, 20, 22, 23 and 24). | * Dolibarr 16 to 24 (verified on 16, 17, 18, 19, 20, 21, 22, 23 and 24). | ||
* PHP 7.4 to 8.4, MySQL / MariaDB, OpenSSL extension. | * PHP 7.4 to 8.4, MySQL / MariaDB, OpenSSL extension. | ||
* HTTPS required for WebAuthn / FIDO2 (a browser requirement). | * HTTPS required for WebAuthn / FIDO2 (a browser requirement). | ||
| Line 83: | Line 83: | ||
== Versions == | == Versions == | ||
* '''6.0.4''' (14 October 2026): '''Google Authenticator rejected the QR code''' while other apps accepted it. The TOTP key is now 32 characters long (160 bits) instead of 20, a length Google Authenticator refused. Devices already registered keep working. When a code is right but the phone or server clock is off, the page now shows the drift instead of a plain "invalid code". Bigger QR code and clearer scan instructions. | |||
* '''6.0.3''' (3 October 2026): '''security fix, update recommended on Dolibarr 16 to 18'''. On these versions the second factor was not asked: the check relied on a Dolibarr hook that only exists from version 19. It now goes through a hook present in every version and called on every request. On every version, document downloads and exports also require the verification. | * '''6.0.3''' (3 October 2026): '''security fix, update recommended on Dolibarr 16 to 18'''. On these versions the second factor was not asked: the check relied on a Dolibarr hook that only exists from version 19. It now goes through a hook present in every version and called on every request. On every version, document downloads and exports also require the verification. | ||
* '''6.0.2''' (2 October 2026): administration page fixed, interface translated into French and English. | * '''6.0.2''' (2 October 2026): administration page fixed, interface translated into French and English. | ||