From 1a33050d380cda83e95c56a9f43401043142f454 Mon Sep 17 00:00:00 2001
From: andryyy <andre.peters@debinux.de>
Date: Sun, 29 Jan 2017 21:53:34 +0100
Subject: [PATCH] Fail with access denied when no Yubi api key was added

---
 data/web/inc/functions.inc.php | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php
index 8b5d6ad4..e49ace50 100644
--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
@@ -1806,6 +1806,13 @@ function set_tfa($postarray) {
   
 	switch ($postarray["tfa_method"]) {
 		case "yubi_otp":
+      if (!$yubi) {
+        $_SESSION['return'] = array(
+          'type' => 'danger',
+          'msg' => sprintf($lang['danger']['access_denied'])
+        );
+        return false;
+      }
 			if (!ctype_alnum($postarray["otp_token"]) || strlen($postarray["otp_token"]) != 44) {
 				$_SESSION['return'] = array(
 					'type' => 'danger',