From 13975b8b921bfeab354c07f60e330219c478cbd5 Mon Sep 17 00:00:00 2001
From: Torsten Dittmann <torsten.dittmann@googlemail.com>
Date: Thu, 29 Feb 2024 22:55:02 +0100
Subject: [PATCH] fix: totp backup code logic

---
 app/controllers/api/account.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php
index 210443bae5..632cb0a385 100644
--- a/app/controllers/api/account.php
+++ b/app/controllers/api/account.php
@@ -3985,7 +3985,7 @@ App::put('/v1/account/mfa/challenge')
         if (in_array($otp, $data['backups'])) {
             $success = true;
             $backups = array_diff($data['backups'], [$otp]);
-            $authenticator->setAttribute('totpBackup', $backups);
+            $authenticator->setAttribute('data', array_merge($data, ['backups' => $backups]));
             $dbForProject->updateDocument('authenticators', $authenticator->getId(), $authenticator);
             $dbForProject->purgeCachedDocument('users', $user->getId());
         }