security: prevent same passcode from being reused

Reported by @cezar97.

1 files changed, 11 insertions, 0 deletions

diff --git a/models/user_cache.go b/models/user_cache.go
new file mode 100644
index 00000000..987c019a
--- /dev/null
+++ b/models/user_cache.go
@@ -0,0 +1,11 @@
+// Copyright 2018 The Gogs Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package models
+
+// TwoFactorCacheKey returns key used for cache two factor passcode.
+// e.g. TwoFactor_1_012664
+func (u *User) TwoFactorCacheKey(passcode string) string {
+	return "TwoFactor_" + u.IDStr() + "_" + passcode
+}