Update dependencies, refspam, geodb

go.mod

@@ -4,26 +4,26 @@ go 1.21
 
 require (
 	code.soquee.net/otp v0.0.4
-	github.com/BurntSushi/toml v1.3.2
+	github.com/BurntSushi/toml v1.4.0
 	github.com/PuerkitoBio/goquery v1.9.2
 	github.com/bmatcuk/doublestar/v4 v4.6.1
-	github.com/boombuler/barcode v1.0.1
-	github.com/go-chi/chi/v5 v5.0.12
+	github.com/boombuler/barcode v1.0.2
+	github.com/go-chi/chi/v5 v5.1.0
 	github.com/google/uuid v1.6.0
-	github.com/gorilla/websocket v1.5.1
+	github.com/gorilla/websocket v1.5.3
 	github.com/mattn/go-sqlite3 v1.14.22
 	github.com/monoculum/formam/v3 v3.6.1-0.20221106124510-6a93f49ac1f8
 	github.com/oschwald/geoip2-golang v1.4.0
 	github.com/russross/blackfriday/v2 v2.1.0
 	github.com/teamwork/reload v1.4.2
-	golang.org/x/crypto v0.23.0
-	golang.org/x/image v0.16.0
-	golang.org/x/net v0.25.0
-	golang.org/x/sync v0.7.0
-	golang.org/x/text v0.15.0
+	golang.org/x/crypto v0.26.0
+	golang.org/x/image v0.19.0
+	golang.org/x/net v0.28.0
+	golang.org/x/sync v0.8.0
+	golang.org/x/text v0.17.0
 	zgo.at/bgrun v0.0.0-00010101000000-000000000000
 	zgo.at/blackmail v0.0.0-20221021025740-b3fdfc32a1aa
-	zgo.at/errors v1.2.0
+	zgo.at/errors v1.3.0
 	zgo.at/follow v0.0.0-20240522232612-673fb184d32f
 	zgo.at/gadget v1.0.0
 	zgo.at/guru v1.1.0
@@ -34,12 +34,12 @@ require (
 	zgo.at/z18n v0.0.0-20240522230155-4d5af439f8c4
 	zgo.at/zcache v1.2.0
 	zgo.at/zcache/v2 v2.1.0
-	zgo.at/zdb v0.0.0-20240522231118-43a1cf220952
-	zgo.at/zhttp v0.0.0-20240522230924-481de30321c5
-	zgo.at/zli v0.0.0-20240522161040-91dbcffb2960
+	zgo.at/zdb v0.0.0-20240818155550-1a862f98cab0
+	zgo.at/zhttp v0.0.0-20240812113805-6333261ded60
+	zgo.at/zli v0.0.0-20240614180544-47534b1ce136
 	zgo.at/zlog v0.0.0-20211017235224-dd4772ddf860
 	zgo.at/zprof v0.0.0-20211217104121-c3c12596d8f0
-	zgo.at/zstd v0.0.0-20240521013615-10baa641d7d0
+	zgo.at/zstd v0.0.0-20240801180155-977f077a1a7f
 	zgo.at/ztpl v0.0.0-20240522225602-574aca1079e7
 	zgo.at/zvalidate v0.0.0-20221021025449-cb54fa8efade
 )
@@ -60,7 +60,7 @@ require (
 	github.com/oschwald/maxminddb-golang v1.10.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/sys v0.20.0 // indirect
-	golang.org/x/tools v0.21.0 // indirect
+	golang.org/x/sys v0.23.0 // indirect
+	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
 	zgo.at/runewidth v0.1.0 // indirect
 )

handlers/user.go

@@ -381,9 +381,7 @@ func (h user) enableTOTP(w http.ResponseWriter, r *http.Request) error {
 	// Check a 30 second window on either side of the current time as well. It's
 	// common for clocks to be slightly out of sync and this prevents most errors
 	// and is what the spec recommends.
-	if tokGen(0, nil) != int32(tokInt) &&
-		tokGen(-1, nil) != int32(tokInt) &&
-		tokGen(1, nil) != int32(tokInt) {
+	if tokGen(0, nil) != int32(tokInt) && tokGen(-1, nil) != int32(tokInt) && tokGen(1, nil) != int32(tokInt) {
 		zhttp.FlashError(w, mfaError)
 		return zhttp.SeeOther(w, "/user/auth")
 	}