From a93adce303fa98c9a8c81a3ebb6f3ebc6596ee57 Mon Sep 17 00:00:00 2001
From: Dane Everitt <dane@daneeveritt.com>
Date: Wed, 1 Feb 2017 23:02:54 -0500
Subject: [PATCH] Only allow up to 30 seconds of overlap on comparing the 2FA
 tokens.

---
 app/Http/Controllers/Auth/LoginController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php
index 8d9c94eb9..0be73ddd2 100644
--- a/app/Http/Controllers/Auth/LoginController.php
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -157,7 +157,7 @@ class LoginController extends Controller
         }
 
 
-        if (! is_null($request->input('2fa_token')) && $G2FA->verifyKey($user->totp_secret, $request->input('2fa_token'))) {
+        if (! is_null($request->input('2fa_token')) && $G2FA->verifyKey($user->totp_secret, $request->input('2fa_token'), 1)) {
             Auth::login($user, $request->has('remember'));
 
             return redirect()->intended($this->redirectPath());