Fixed OTP field behavior (improper/empty submission) exposed in YMS
authorDan
Tue, 04 Aug 2009 19:37:38 -0400
changeset 29 7cd9707ed72f
parent 28 b9a3da602841
child 30 294bab0bb3e2
Fixed OTP field behavior (improper/empty submission) exposed in YMS
plugins/yubikey/corelib.php
--- a/plugins/yubikey/corelib.php	Fri Jul 31 23:59:06 2009 -0400
+++ b/plugins/yubikey/corelib.php	Tue Aug 04 19:37:38 2009 -0400
@@ -15,6 +15,7 @@
   $fid = substr(sha1(microtime() . mt_rand()), 0, 12);
   $class = $value ? 'wasfull' : 'wasempty';
   $html = '<input id="yubifield' . $fid . '" class="' . $class . '" type="hidden" name="' . $name . '" value="' . ( is_string($value) ? $value : '' ) . '" />';
+  $html .= '<noscript><input type="text" name="' . $name . '" class="yubikey_noscript" value="' . ( is_string($value) ? $value : '' ) . '" /> </noscript>';
   if ( $value )
   {
     $html .= '<span id="yubistat' . $fid . '" class="yubikey_status enrolled">' . $lang->get('yubiauth_ctl_status_enrolled') . '</span>';
@@ -34,8 +35,6 @@
              . $lang->get('yubiauth_ctl_btn_clear') .
              '</a>';
   }
-  $html = '<noscript><input type="text" name="' . $name . '" class="yubikey_noscript" value="' . ( is_string($value) ? $value : '' ) . '" /> </noscript>'
-          . $html; // '<script type="text/javascript">document.write(unescape("' . rawurlencode($html) . '"));</script>';
   return $html;
 }