CVE-2026-44460

@@ -1,5 +1,32 @@
 # Changelog
 
+## Changes 04/29/2026 (v3.12.0)
+
+`release(v3.12.0): TOTP setup flow hardening`
+
+**Commit message**  
+
+```text
+release(v3.12.0): TOTP setup flow hardening
+
+- auth(totp): tighten setup QR access to fully authenticated profile sessions
+- auth(totp): avoid reusing existing TOTP enrollment data during setup
+```
+
+**Fixed**  
+
+- **TOTP setup flow hardening**
+  - Tightened TOTP setup so enrollment QR generation is only available from a fully authenticated profile session.
+  - Accounts that already have TOTP configured are no longer offered a setup QR for the existing enrollment.
+  - Existing TOTP sign-in, recovery-code, disable, and first-time setup flows remain supported.
+
+**Changed**  
+
+- **Authenticator re-enrollment behavior**
+  - Users who need to enroll a replacement authenticator should disable TOTP and enable it again to generate a fresh enrollment.
+
+---
+
 ## Changes 04/16/2026 (v3.11.2)
 
 `release(v3.11.2): phpseclib security dependency update`

@@ -5,7 +5,7 @@
      * @OA\Get(
      *     path="/api/profile/totp_setup.php",
      *     summary="Set up TOTP and generate a QR code",
-     *     description="Generates (or retrieves) the TOTP secret for the user and builds a QR code image for scanning.",
+     *     description="Generates a new TOTP secret for an authenticated user and builds a QR code image for scanning.",
      *     operationId="setupTOTP",
      *     tags={"TOTP"},
      *     security={{"cookieAuth": {}}},
@@ -26,6 +26,10 @@
      *         description="Not authorized or invalid CSRF token"
      *     ),
      *     @OA\Response(
+     *         response=409,
+     *         description="TOTP is already configured"
+     *     ),
+     *     @OA\Response(
      *         response=500,
      *         description="Server error"
      *     )

@@ -809,20 +809,30 @@ public static function setupTOTP($username)
         global $encryptionKey;
         $usersFile = USERS_DIR . USERS_FILE;
 
+        if (!preg_match(REGEX_USER, $username)) {
+            return ['error' => 'Invalid username', 'statusCode' => 400];
+        }
+
         if (!file_exists($usersFile)) {
             return ['error' => 'Users file not found'];
         }
 
         $lines = file($usersFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [];
-        $totpSecret = null;
+        $userExists = false;
 
         foreach ($lines as $line) {
             $parts = explode(':', trim($line));
-            if (count($parts) >= 4 && strcasecmp($parts[0], $username) === 0 && !empty($parts[3])) {
-                $totpSecret = decryptData($parts[3], $encryptionKey);
+            if (count($parts) >= 3 && strcasecmp($parts[0], $username) === 0) {
+                $userExists = true;
+                if (count($parts) >= 4 && !empty($parts[3])) {
+                    return ['error' => 'TOTP is already configured for this account', 'statusCode' => 409];
+                }
                 break;
             }
         }
+        if (!$userExists) {
+            return ['error' => 'User not found', 'statusCode' => 404];
+        }
 
         $tfa = new \RobThree\Auth\TwoFactorAuth(
             new \RobThree\Auth\Providers\Qr\GoogleChartsQrCodeProvider(),
@@ -832,25 +842,25 @@ public static function setupTOTP($username)
             \RobThree\Auth\Algorithm::Sha1
         );
 
-        if (!$totpSecret) {
-            $totpSecret = $tfa->createSecret();
-            $encryptedSecret = encryptData($totpSecret, $encryptionKey);
+        $totpSecret = $tfa->createSecret();
+        $encryptedSecret = encryptData($totpSecret, $encryptionKey);
 
-            $newLines = [];
-            foreach ($lines as $line) {
-                $parts = explode(':', trim($line));
-                if (count($parts) >= 3 && strcasecmp($parts[0], $username) === 0) {
-                    if (count($parts) >= 4) {
-                        $parts[3] = $encryptedSecret;
-                    } else {
-                        $parts[] = $encryptedSecret;
-                    }
-                    $newLines[] = implode(':', $parts);
+        $newLines = [];
+        foreach ($lines as $line) {
+            $parts = explode(':', trim($line));
+            if (count($parts) >= 3 && strcasecmp($parts[0], $username) === 0) {
+                if (count($parts) >= 4) {
+                    $parts[3] = $encryptedSecret;
                 } else {
-                    $newLines[] = $line;
+                    $parts[] = $encryptedSecret;
                 }
+                $newLines[] = implode(':', $parts);
+            } else {
+                $newLines[] = $line;
             }
-            file_put_contents($usersFile, implode(PHP_EOL, $newLines) . PHP_EOL, LOCK_EX);
+        }
+        if (file_put_contents($usersFile, implode(PHP_EOL, $newLines) . PHP_EOL, LOCK_EX) === false) {
+            return ['error' => 'Failed to save TOTP secret'];
         }
 
         // Prefer admin-configured otpauth template if present

@@ -16,7 +16,7 @@
  * - Hardened CSRF/auth checks (works even when getallheaders() is unavailable)
  * - Consistent method checks without breaking existing clients (accepts POST as fallback for some endpoints)
  * - Stricter validation & safer defaults
- * - Fixed TOTP setup bug for pending-login users
+ * - TOTP setup is restricted to fully authenticated profile sessions
  * - Standardized calls to UserModel (proper case)
  */
 class UserController
@@ -528,40 +528,36 @@ public function saveTOTPRecoveryCode()
 
     public function setupTOTP()
     {
-        // Allow access if authenticated OR pending TOTP
-        if (!( (isset($_SESSION['authenticated']) && $_SESSION['authenticated'] === true) || isset($_SESSION['pending_login_user']) )) {
-            http_response_code(403);
-            header('Content-Type: application/json');
-            echo json_encode(["error" => "Not authorized to access TOTP setup"]);
-            exit;
-        }
+        self::requireAuth();
+        self::requireCsrf();
 
-        $username = $_SESSION['username'] ?? ($_SESSION['pending_login_user'] ?? '');
+        $username = $_SESSION['username'] ?? '';
         if (defined('FR_DEMO_MODE') && FR_DEMO_MODE && $username === 'demo') {
             http_response_code(403);
             header('Content-Type: application/json');
             echo json_encode(['error' => 'TOTP setup is disabled for the demo account.']);
             exit;
         }
 
-
-        self::requireCsrf();
-
-        // Fix: if username not present (pending flow), fall back to pending_login_user
-        $username = $_SESSION['username'] ?? ($_SESSION['pending_login_user'] ?? '');
         if ($username === '') {
             http_response_code(400);
             header('Content-Type: application/json');
             echo json_encode(['error' => 'Username not available for TOTP setup']);
             exit;
         }
+        if (!preg_match(REGEX_USER, $username)) {
+            http_response_code(400);
+            header('Content-Type: application/json');
+            echo json_encode(['error' => 'Invalid user identifier']);
+            exit;
+        }
 
         header("Content-Type: image/png");
         header('X-Content-Type-Options: nosniff');
 
         $result = UserModel::setupTOTP($username);
         if (isset($result['error'])) {
-            http_response_code(500);
+            http_response_code((int)($result['statusCode'] ?? 500));
             header('Content-Type: application/json');
             echo json_encode(["error" => $result['error']]);
             exit;

@@ -112,6 +112,7 @@ function rrmdir(string $dir): void
 
 $_COOKIE['remember_me_token'] = $token;
 require_once $baseDir . '/config/config.php';
+require_once $baseDir . '/src/FileRise/Domain/UserModel.php';
 
 $errors = [];
 
@@ -183,6 +184,21 @@ function rrmdir(string $dir): void
 $validated = \FileRise\Domain\AuthModel::validateRememberToken($expiredToken);
 failIf($validated !== null, 'validateRememberToken: expired token should be rejected', $errors);
 
+$existingTotp = 'JBSWY3DPEHPK3PXP';
+$encryptedTotp = encryptData($existingTotp, $GLOBALS['encryptionKey']);
+file_put_contents(
+    $usersFile,
+    'alice:$2y$10$O5J7bX3GmJpJ6S.1oW6Hj.8L0N9csmXz7D8Gk4r.3hWBjC1u3n7De:0' . PHP_EOL .
+    'bob:$2y$10$O5J7bX3GmJpJ6S.1oW6Hj.8L0N9csmXz7D8Gk4r.3hWBjC1u3n7De:0:' . $encryptedTotp . PHP_EOL,
+    LOCK_EX
+);
+$setupExisting = \FileRise\Domain\UserModel::setupTOTP('bob');
+failIf(
+    ($setupExisting['statusCode'] ?? null) !== 409,
+    'setupTOTP: existing TOTP secret should not be re-emitted',
+    $errors
+);
+
 if ($errors) {
     echo "FAIL\n";
     foreach ($errors as $err) {

@@ -1,2 +1,2 @@
 // generated by CI
-window.APP_VERSION = 'v3.11.2';
+window.APP_VERSION = 'v3.12.0';