Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

TOTP issuer shows HTML entities when the site title has an ampersand

Closed Beginner friendly
  • Is something wrong?
#1,022 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@ozenyunus35 is already working on this.

Since Oct 11, 2026.

  • #1023 by @ozenyunus35 — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
php, wordpress
Domain
authentication, security

Research direction

The bug is in Two_Factor_Totp::generate_qr_code_url(), which reads the site name with get_bloginfo( 'name', 'display' ) and then passes it to rawurlencode() for the issuer and label. Start by reading that function and checking how the display filter escapes the title. Done means an ampersand, apostrophe or quotation mark in the site title appears unescaped in the otpauth:// URL, and the existing TOTP tests still pass.

Written by the indexing model from the issue text.

Description

Description

When the site title contains an ampersand, the TOTP setup link and QR code carry the HTML entity instead of the character, so the authenticator app shows A & B as the account's issuer.

Two_Factor_Totp::generate_qr_code_url() reads the issuer with get_bloginfo( 'name', 'display' ). The display filter escapes the title for HTML, so A & B becomes A & B before it is passed to rawurlencode() for the issuer parameter and the label.

Steps to reproduce

  1. Set the site title to A & B.
  2. Open a user profile and start TOTP setup.
  3. Inspect the otpauth:// link, or scan the QR code.

Expected

otpauth://totp/A%20%26%20B%3A<login>?secret=…&issuer=A%20%26%20B, shown in the app as A & B.

Actual

The issuer and label contain %26amp%3B, shown in the app as A &amp; B. Titles with an apostrophe or quotation marks are affected the same way.

Suggested fix

Read the raw value and decode entities before encoding: wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES ).

Environment

Two Factor 0.17.0. The same line is on the default branch today.

Dominant language
PHP
Stars
824
Forks
191
Avg merge
2d 2h
Merged PRs (30d)
25

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from WordPress/two-factor

All issues in WordPress/two-factor

Similar issues

More PHP issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.