To be completed by the original poster:
CMS Version
Docker install on ubuntu
Version 4.4.2
Player Type
Windows/Android
Player Version
R407,R410
Issue
Bug Report: Email Two-Factor Authentication Does Not Use Configured SMTP Transport
Environment
-
Xibo CMS Version: 4.4.2
-
Installation Method: Official Docker deployment
-
Operating System: Ubuntu 24.04
-
SMTP Provider: MXroute
-
SMTP Configuration: Configured through
config.env
Summary
Email-based Two Factor Authentication does not successfully deliver authentication codes, despite the CMS SMTP configuration being valid and the built-in Test Email function working correctly.
Expected Behavior
When a user with Email Two Factor Authentication enabled logs in:
-
The CMS should generate a one-time authentication code.
-
The code should be delivered using the configured SMTP server.
-
The user should receive the email and be able to complete authentication.
Actual Behavior
-
User logs in successfully.
-
User is redirected to
/tfa. -
The CMS displays:
“Two factor code email has been sent to your email address”
-
No email is received.
-
No SMTP errors are logged.
-
No PHP exceptions are generated.
Verification Performed
SMTP Configuration
The SMTP configuration is valid.
The CMS Test Email feature successfully sends mail through the configured MXroute SMTP server.
Therefore:
-
SMTP credentials are valid.
-
TLS configuration is valid.
-
Network connectivity is valid.
-
Recipient delivery is functioning.
User Configuration
Email 2FA was enabled on a test user with a valid email address.
Database confirms:
twoFactorTypeId = 1
email = REDACTED
Web Server Logs
Apache access logs show normal authentication flow:
POST /login
GET /tfa
No PHP exceptions or SMTP-related errors are generated.
Application Logs
Docker logs contain no mail transport errors.
Source Code Inspection
Inspection of:
/var/www/cms/lib/Controller/Login.php
shows that twoFactorAuthForm() creates a new PHPMailer instance before calling:
$mail->send();
The code does not appear to configure SMTP on the PHPMailer instance (for example, no calls to isSMTP(), Host, SMTPAuth, etc., were found during inspection of the CMS source tree).
Local Mail Transport Investigation
The Docker container contains a local Exim installation.
/usr/sbin/sendmail -> exim4
Running a manual sendmail test inside the container produces:
Mailing to remote domains not supported
indicating that the local mail transport is not configured to relay external email.
Mail Queue Evidence
The generated Two Factor Authentication email was found in the local mail spool (/var/mail/www-data).
The message body contains the generated authentication code, confirming that:
-
Xibo successfully generated the email.
-
The message was handed to the local mail transport.
-
The message was never relayed externally.
Reproduction Steps
-
Configure SMTP in
config.env. -
Verify Test Email succeeds.
-
Configure a user for Email Two Factor Authentication.
-
Log out.
-
Log back in.
-
Observe that:
-
The CMS reports the code has been sent.
-
No email arrives.
-
The email is instead delivered to the local Exim mail spool.
-
Notes
This behavior appears inconsistent with the CMS Test Email functionality, which successfully uses the configured SMTP server.
Based on the investigation above, it appears that the Email Two Factor Authentication mail path may not be using the configured SMTP transport and instead relies on the container’s local mail transport.
If this is intentional, the documentation should indicate that Email 2FA requires a configured local MTA.
If unintentional, Email 2FA should use the same configured SMTP transport as the CMS Test Email feature.