robertwahler/two_factor_authentication_example — pull request #2 by cjlarose (2013-07-26 16:22:41+00:00)
Title: UserSessionController::validate_code does not correctly handle validation codes with leading zeros

Consider the user enters the validation code "012345". The list of `valid_codes` in `UserSessionController::validate_code` will contain `ROTP::TOTP.new(two_factor_secret).now`, which is the integer `12345`. When you call `.to_s` on that integer, you'll get "12345". `"012345" != "12345"`, so even though the code was correct, validation fails. The solution outlined in my pull request calls `.to_i` on the validation_code that the user passes in and no longer calls `.to_s` on the validation codes computed by ROTP.