2-Factor Authentication (2FA - Done)

[Trioxin]

/api/?action=verify2FA&twoCode=blabla

[Jamie]

It says it's been validated, also states it within dev tools http://prntscr.com/hd2odk

[Trioxin]

you sent it blabla or the code from your phone?

[Trioxin]

you got it working?

[Trioxin]

Code updated again. I added an if statement to the API: https://hastebin.com/oxohagajel.xml

[Jamie]

There's an extra

}

on line 31 in /api/index.php

[Trioxin]

Updated to fix that: https://hastebin.com/afejuquqoc.xml

[Jamie]

The changes you made to /api/ fixed the issue (I checked on database to see that 2-factor auth is enabled for the user), but attempt to sign in without an auth code and it allows the user with just their user and pass.

Any idea why?

[Jamie]

Also

PHP Fatal error: Cannot use isset() on the result of an expression (you can use "null !== expression" instead)

To fix it I did

$currentUser = $user->data();
if(isset($currentUser)) {

[Trioxin]

You can rework how you want the API to detect logged in users however you want. I just changed mine a bit after you said that.