Notification of string changes

Author: Daniel Ziegenberg
MDL-79678 tool_mfa: Adapt to OTPHP changes in v11
With the OTPHP upgrade from v10.x to v11.x, the behaviour of the window
feature changed substantially. With version 10, the window of timestamps
goes from `timestamp - window * period` to `timestamp + window *
period`. For example, if the window is 5, the period 30 and the
timestamp 1476822000, the OTP tested are within 1476821850 (`1476822000
- 5 * 30`) and 1476822150 (`1476822000 + 5 * 30`). In other words, this
validated the 5 OTP before and after the current timestamp. With version
11, the TOTP window acts as a time drift. If the window is 15, the
period 30, and the current timestamp is 147682209, the OTP tested are
within 147682194 (`147682209 - 15`), 147682209 and 147682224 (`147682209
+ 15`). The window shall be lower than the period. Therefore, this test
includes the previous OTP but not the next one.

This change required an adaption to align our implementation with OTPHP.
The window of valid TOTP tokens is now much narrower. This change in
functionality is a security improvement, but it also means that the time
on the device generating the TOTP token must be more accurate. As OTPHP
restricts the window to be strictly lower than the period, our admin
setting now has a maximum allowed value of 29. To ensure we only have
valid window values, we need to update the admin setting to a value
lower than 30; therefore, we include an upgrade step.

Signed-off-by: Daniel Ziegenberg <daniel@ziegenberg.at>


http://git.moodle.org/gw?p=moodle.git;a=commit;h=dc25c83a5295921a526829c438c6843a2ddc48a2
http://github.com/moodle/moodle/commit/dc25c83a5295921a526829c438c6843a2ddc48a2

+ 4.5 en [settings:window_help,factor_totp]