v1.12.1 Hot Fix – Security patch for TOTP QR code

[BobWs]

v1.12.1 – Security patch

This is a hot fix release to address a security concern discovered during the development of Shared Notes.

---

🛡️ What was fixed

The TOTP QR code endpoint was previously accessible without authentication. This could allow visitors to view the QR code and, if combined with a guessed username and password, potentially gain full access.

What changed:

• QR code removed from the public login screen
• /api/totp-setup endpoint now requires authentication
• QR code is now located in Settings → Preferences (after login)

---

⚠️ If you use TOTP

The QR code is no longer on the login screen. To set up or view your TOTP QR code:

1. Log in with your username and password
2. Go to Settings → Preferences
3. Look for the "2FA QR code" button in the avatar section

---

Installation

docker pull dockerbobw/flatnotes-enhanced:latest
docker pull dockerbobw/flatnotes-enhanced:v1.12.1

Docker Compose

image: dockerbobw/flatnotes-enhanced:latest
# or pin to this version:
# image: dockerbobw/flatnotes-enhanced:v1.12.1

---

🔗 Links

• GitHub Repository
• Docker Hub

---

🙏 Thank You

This fix ensures your instance remains secure when sharing notes externally. Update now! 🛡️

/Bob