prepare("SELECT * FROM sessions WHERE userId = :uid AND valid AND created+157700000 > UNIX_TIMESTAMP() AND lastonline+432000 > UNIX_TIMESTAMP() ORDER BY created DESC");
$sessions->bindParam(":uid", $userinfo->id, PDO::PARAM_INT);
$sessions->execute();
$twofa = SESSION["2fa"];
$twofaSecret = $userinfo->twofaSecret;
//2fa stuff is not done dynamically cause 1. its less hassle and 2. because the 2fa panel is the default panel shown in the security area its basically seamless anyway so ehh
if(isset($_POST["2fa"]))
{
$csrf = $_POST['polygon_csrf'] ?? false;
$code = $_POST['code'] ?? false;
$password = $_POST['password'] ?? false;
if($csrf != SESSION["csrfToken"])
{
pageBuilder::showStaticNotification("error", "Invalid CSRF token"); goto pb;
}
if(!$gauth->checkCode($twofaSecret, $code, 1))
{
pageBuilder::showStaticNotification("error", "Incorrect code"); goto pb;
}
if(!password_verify($password, $userinfo->password))
{
pageBuilder::showStaticNotification("error", "Incorrect password"); goto pb;
}
twofa::toggle();
$twofa = !SESSION["2fa"];
if($twofa)
{
$recoveryCodes = twofa::generateRecoveryCodes();
ob_start();
?>
Congratulations! Your account is now more secure. But, before you go there's one last thing which is really important.
If all else fails, if you just cannot regain access to your 2FA app codes, you can use a 2FA recovery code.
=$code?>
1000 characters max, Markdown is supported
[ this replaces words with baba booey ]
[ this plays a sliding transition on page loading ]
Two-Factor Authentication is currently active. If you wish to disable it, just fill in the fields below.
If you disable 2FA your old recovery codes will be invalidated, so just be mindful of that.
It is highly recommended to use a two-factor authentication app that supports backups so that in the event that you lose access to the app or something, you can still get your codes back. Authy is an excellent one.
Scan the QR code with your authenticator app of choice.
This changes with every page refresh, so be careful.
There's also a manual key here if you prefer that: =$twofaSecret?>