diff --git a/.gitignore b/.gitignore index 31a0e5d9..fd8ceeec 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ vendor/ -build/ \ No newline at end of file +build/ diff --git a/lib/HOTP.php b/lib/HOTP.php index 3a4b3f27..08645641 100644 --- a/lib/HOTP.php +++ b/lib/HOTP.php @@ -29,8 +29,9 @@ public function verify($otp, $counter, $window = null) if (!is_integer($window)) { $window = 0; } + $window = abs($window); - for ($i=$counter; $i <= $counter+abs($window); $i++) { + for ($i=$counter; $i <= $counter+$window; $i++) { if ($otp === $this->at($i)) { $this->updateCounter($i+1); diff --git a/lib/TOTP.php b/lib/TOTP.php index dc335e70..8621458b 100644 --- a/lib/TOTP.php +++ b/lib/TOTP.php @@ -32,8 +32,9 @@ public function verify($otp, $timestamp = null, $window = null) if (!is_integer($window)) { return $otp === $this->at($timestamp); } + $window = abs($window); - for ($i=-abs($window); $i <= abs($window); $i++) { + for ($i=-$window; $i <= $window; $i++) { if ($otp === $this->at($i*$this->getInterval()+$timestamp)) { return true; }