{"action":"created","issue":{"url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/27","labels_url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/27/labels{/name}","comments_url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/27/comments","events_url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/27/events","html_url":"https://github.com/tinfoil/devise-two-factor/pull/27","id":60831787,"number":27,"title":"Explicitly check that otp_attempt param is not nil in order to avoid 'RO...","user":{"login":"pic","id":9195,"avatar_url":"https://avatars.githubusercontent.com/u/9195?v=3","gravatar_id":"","url":"https://api.github.com/users/pic","html_url":"https://github.com/pic","followers_url":"https://api.github.com/users/pic/followers","following_url":"https://api.github.com/users/pic/following{/other_user}","gists_url":"https://api.github.com/users/pic/gists{/gist_id}","starred_url":"https://api.github.com/users/pic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pic/subscriptions","organizations_url":"https://api.github.com/users/pic/orgs","repos_url":"https://api.github.com/users/pic/repos","events_url":"https://api.github.com/users/pic/events{/privacy}","received_events_url":"https://api.github.com/users/pic/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-03-12T14:56:48Z","updated_at":"2015-07-08T18:27:40Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/tinfoil/devise-two-factor/pulls/27","html_url":"https://github.com/tinfoil/devise-two-factor/pull/27","diff_url":"https://github.com/tinfoil/devise-two-factor/pull/27.diff","patch_url":"https://github.com/tinfoil/devise-two-factor/pull/27.patch"},"body":"imho the gem should explicitly check that otp_attempt param is not nil before calling\r\n`resource.valid_otp?(params[scope]['otp_attempt'])`\r\notherwise an `ArgumentError Exception: ROTP only verifies strings` might be raised.\r\n\r\nThis happens for example when email and password params are set but not otp_attempt, in this case I would expect that current_user is nil and not that it raises an exception.\r\n\r\nI would have added tests but I have not found any existing controller spec"},"comment":{"url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/comments/119689582","html_url":"https://github.com/tinfoil/devise-two-factor/pull/27#issuecomment-119689582","issue_url":"https://api.github.com/repos/tinfoil/devise-two-factor/issues/27","id":119689582,"user":{"login":"bsedat","id":1216592,"avatar_url":"https://avatars.githubusercontent.com/u/1216592?v=3","gravatar_id":"","url":"https://api.github.com/users/bsedat","html_url":"https://github.com/bsedat","followers_url":"https://api.github.com/users/bsedat/followers","following_url":"https://api.github.com/users/bsedat/following{/other_user}","gists_url":"https://api.github.com/users/bsedat/gists{/gist_id}","starred_url":"https://api.github.com/users/bsedat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bsedat/subscriptions","organizations_url":"https://api.github.com/users/bsedat/orgs","repos_url":"https://api.github.com/users/bsedat/repos","events_url":"https://api.github.com/users/bsedat/events{/privacy}","received_events_url":"https://api.github.com/users/bsedat/received_events","type":"User","site_admin":false},"created_at":"2015-07-08T18:27:40Z","updated_at":"2015-07-08T18:27:40Z","body":"@pic Sorry about that - we thought there was something wrong with our implementation and didn't have time to fully test or fix it. I'll reopen this so we can still look at addressing your issue."}}