When submitting a one time password during the 2FA check that is longer than 16 characters, an error is returned:

String data, right truncated: 1406 Data too long for column 'otp' at row 1 on line 196 .../path/to/PdoConnection.php

User input should not exceed 16 characters. The reporter of this bug included the following diff for our consideration:

diff --git a/blesta/app/models/users.php b/blesta/app/models/users.php
index 3b6fa517..75e4ec57 100644
— a/blesta/app/models/users.php
+++ b/blesta/app/models/users.php
@@ -66,6 +66,11 @@ class Users extends AppModel
// Validate OTP
$rules = [
'otp' => [
+ 'valid' => [
+ 'rule' => ['maxLength', 16],
+ 'message' => $this->_('Users.!error.otp.auth'),
+ 'final' => true
+ ],
'auth' => [
'rule' => [[$this, 'validateOtp'], $user],
'message' => $this->_('Users.!error.otp.auth')
@@ -986,6 +991,11 @@ class Users extends AppModel

// Validate OTP
$rules['otp'] = [
+ 'valid' => [
+ 'rule' => ['maxLength', 16],
+ 'message' => $this->_('Users.!error.otp.auth'),
+ 'final' => true
+ ],
'auth' => [
'rule' => [[$this, 'validateOtp'], $user],
'message' => $this->_('Users.!error.otp.auth')