Add encrypted TOTP secret field to accounts#135
Open
RPGMais wants to merge 1 commit intoInfotelGLPI:masterfrom
Open
Add encrypted TOTP secret field to accounts#135RPGMais wants to merge 1 commit intoInfotelGLPI:masterfrom
RPGMais wants to merge 1 commit intoInfotelGLPI:masterfrom
Conversation
This was referenced Mar 24, 2026
Open
Open
Add support for storing TOTP (Time-based One-Time Password) secrets alongside account credentials. The TOTP secret is encrypted server-side using the same fingerprint as the password, providing secure storage for 2FA seeds used by authenticators like Google Authenticator, Authy, and Bitwarden. Changes: - New `encrypted_totp_secret` column (TEXT) in accounts table - Server-side encryption via AccountCrypto (same AES-256-CTR as passwords) - Show/hide toggle in the UI (same UX pattern as the password field) - "Clear" checkbox to remove stored TOTP secret - Re-encryption support when changing the fingerprint key (Hash::updateHash) - Migration file for existing installations (update-3.3.0.sql) The TOTP secret is encrypted server-side (unlike the password which is encrypted client-side in JS). This is intentional as TOTP seeds are short strings submitted via standard form POST and don't benefit from the client-side encryption overhead. Fixes InfotelGLPI#127 Closes InfotelGLPI#96 Closes InfotelGLPI#102
RPGMais
force-pushed
the
feature/totp-secret-field
branch
from
3f9dca0 to
3ca19e0
Compare
tsmr
reviewed
Apr 10, 2026
| ]; | ||
|
|
||
| $tab[] = [ | ||
| 'id' => '30', |
Contributor
There was a problem hiding this comment.
id 30 already used (please change to 31)
tsmr
reviewed
Apr 10, 2026
| $aeskey = new AesKey(); | ||
| if ($hash_id | ||
| && $aeskey->getFromDBByCrit(['plugin_accounts_hashes_id' => $hash_id]) | ||
| && !empty($aeskey->fields['name'])) { |
Contributor
There was a problem hiding this comment.
And if i haven't stored aeskey into database, i cannot encrypt it ?
tsmr
reviewed
Apr 10, 2026
| class="form-control" | ||
| autocomplete="off" | ||
| placeholder="{{ item.isNewItem() ? '' : __('Leave blank to keep current', 'accounts') }}" | ||
| value=""> |
Contributor
There was a problem hiding this comment.
How can i see the uncrypted value of TOTP secret ?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
encrypted_totp_secretcolumn to store TOTP (Time-based One-Time Password) seeds alongside account credentialsThis is a highly requested feature (3 separate issues) that allows users to securely store 2FA seeds used by authenticators like Google Authenticator, Authy, and Bitwarden, instead of storing them as plaintext in the "Others" or "Comments" fields.
Changes
install/sql/update-3.3.0.sqlencrypted_totp_secretcolumninstall/sql/empty-3.2.1.sqlhook.php$DB->fieldExists()guardsrc/Account.phpencryptTotpSecret()helper,rawSearchOptions,prepareInputForAdd/Update,showFormsrc/Hash.phpupdateHash()now re-encrypts TOTP secret alongside passwordtemplates/account.html.twigDesign Decisions
nosearch+nodisplayon the search option: encrypted content should never appear in search results or list views.Test Plan
encrypted_totp_secretcolumn exists inglpi_plugin_accounts_accountsFixes #127, closes #96, closes #102