TwoFactorX

With this package for MODX Revolution the manager login can be secured with a two-factor authentication. The ‘Login’ extra can be secured with a pre-hook and a QR Code for saving the authenticator secret can be generated with a snippet.

TwoFactorX is a complete rewrite of GoogleAuthenticatorX.

Install via package manager. When the system setting enable_2fa is enabled, a manager user has to verify the TOTP secret. Otherwise, the authenticator secret verify window is displayed with each manager load. When it is verified, the manager user has to use the TOTP key to login into the manager. The TOTP authentication can be disabled on manager user base.

Security

• Check the code in the TwoFactorXLogin hook for all users with enabled two-factor authentication.
• Limit the code attempts and accept each code only once.
• Don't reset all secrets, if the encryption key is invalid.
• Remove the secret from the QR code URL and the server paths from the manager.

Fixed

• Fix fatal errors, the GoogleAuthenticatorX migration and the email languages.
• Hide the TwoFactorX tab on the create user page.