diff --git a/interface/web/login/otp.php b/interface/web/login/otp.php index 8b80691da6f20a626c518db9a89d12c8cc335d9e..53490318d0f28548c9afaa07f712e5f615f9e4a3 100644 --- a/interface/web/login/otp.php +++ b/interface/web/login/otp.php @@ -129,6 +129,24 @@ if($_SESSION['otp']['type'] == 'email') { // Send code via email. if (!isset($_SESSION['otp']['sent']) || $_GET['action'] == 'resend') { + // Handle otp_email_override. + $sys_user = $app->db->queryOneRecord('SELECT otp_data FROM sys_user WHERE userid = ?', $_SESSION['s_pending']['user']['userid']); + $data = json_decode($sys_user['otp_data'], TRUE); + + if (!empty($data['otp_email_override'] )) { + $email_to = $data['otp_email_override']; + } + else { + $clientuser = $app->db->queryOneRecord('SELECT email FROM sys_user u LEFT JOIN client c ON (u.client_id=c.client_id) WHERE u.userid = ?', $_SESSION['s_pending']['user']['userid']); + if (!empty($clientuser['email'])) { + $email_to = $clientuser['email']; + } + else { + // Admin users are not related to a client, thus use the globally configured email address. + $email_to = $mail_config['admin_mail']; + } + } + $mail_otp_code_retry_timeout = 30; if (isset($_SESSION['otp']['starttime']) && $_SESSION['otp']['starttime'] > time() - $mail_otp_code_retry_timeout) { $token_sent_message = sprintf($wb['otp_code_email_sent_wait_txt'], $mail_otp_code_retry_timeout);