fix: 2fa qr code - handle special chars in site title

requarks · Sep 10, 2020 · 9009816 · 9009816
1 parent aa96e97
commit 9009816
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/server/models/users.js b/server/models/users.js
@@ -128,7 +128,8 @@ module.exports = class User extends Model {
       tfaIsActive: false,
       tfaSecret: tfaInfo.secret
     })
-    return qr.imageSync(`otpauth://totp/${WIKI.config.title}:${this.email}?secret=${tfaInfo.secret}`, { type: 'svg' })
+    const safeTitle = WIKI.config.title.replace(/[\s-.,=!@#$%?&*()+[\]{}/\\;<>]/g, '')
+    return qr.imageSync(`otpauth://totp/${safeTitle}:${this.email}?secret=${tfaInfo.secret}`, { type: 'svg' })
   }
 
   async enableTFA() {