QR Code Disable / Remove

[ImmCoTech IT Lösungen]

Hello,

We find it unfortunate that the QR code cannot be hidden in the Windows App or the 3CX PWA. Rightly, employees have pointed out that theoretically, someone could scan this QR code (in an unguarded moment) and gain immediate access to all chat logs and call histories without anyone noticing.

Furthermore, it becomes more complicated when you cannot remove the QR code if you find a device in the administration interface that doesn't belong there. It seems you have to delete the entire extension or user. Is there another way to handle this?

Apparently, there is nothing official that allows you to hide the QR code, but perhaps there are tinkerers among you who have managed to do so. Is there any way to hide/remove or render the QR code useless?

We are using version V20, and on the Windows computers, we use the 3CX PWA App. In general, we need the QR code to provision mobile devices, but we would like to roll this out more controlled, rather than allowing any employee or non-employee to easily provision any phone with it.

Thank you!

 

[SteveITS]

Resetting the user password also disconnects all devices now.

 

[asaltykov]

Try to block access in nginx conf to provision a QR code link for the user. From the admin portal, QR will still be available. You can also add more conditions to this conf. But please, do a backup before. Also, notice that it will also block a provision link for Windows desktops. You will need to add something like:
location ~ ^/xapi/v1/MyUser/Pbx\.GenerateProvLink\(\) { allow 127.0.0.1; deny all; }

And restart nginx.

 

[Rookie24]

Hi everyone,

I’d like to suggest an improvement for the software regarding QR code generation for user registration.

Currently, the only way to restrict QR code access is by modifying the Nginx configuration, which either allows or denies access globally (except for the local system). This approach is not very flexible, especially for administrators managing multiple users.

My suggestion is to introduce a checkbox in the web GUI that allows administrators to enable or disable QR code display per extension or user. This way, admins with the necessary permissions could control access directly from the web interface without needing to modify configuration files manually.

This would improve usability and security while making management more intuitive.

What do you think? Would this be useful for others as well?

Best regards,
Rookie24

 

[marioasoler]

Resetting the user password also disconnects all devices now.

I Just found out the hard way resetting the password alone will not disconnect any device logged in with the QR code. This is becoming a safety issue in my work place.

 

[Vali_3CX]

I Just found out the hard way resetting the password alone will not disconnect any device logged in with the QR code. This is becoming a safety issue in my work place.

I just played with password reset few days ago on various PBXes and worked as expected on all of them. What's your PBX version, as specified in the dashboard? And how did you reset the password?

 

[marioasoler]

Version: 20.0 Update 8 (Build 1109)

Two ways to reset password, user interface and forgot my password option in the app and desktop.

But now I have a bigger problem, my coworker was playing with the deleting the email out of the user and deleted my admin email Suggestions on how to get back in?

Thanks

 

[SteveITS]

The forgot password link only changes the web client password.

If they didn’t also reset your password you can use the extension number to log in. That may be worth a separate thread…

 

[marioasoler]

The forgot password link only changes the web client password.

If they didn’t also reset your password you can use the extension number to log in. That may be worth a separate thread…

"The forgot password link only changes the web client password."
Got it.


"If they didn’t also reset your password you can use the extension number to log in. That may be worth a separate thread…"

Extension or email either one works


"That may be worth a separate thread…"

Thanks.

 

[Gasha]

The forgot password link only changes the web client password.

If they didn’t also reset your password you can use the extension number to log in. That may be worth a separate thread…

It also changes the SIP-Auth values.

Which is also a turbo head-ache if the user also has a DECT device for example, because the DECT managers/masters cannot be reprovisionied without having to gain remote access to the clients network without causing an outage for about a minute lol.

At least that's always been the case with Yealink DECT Managers, where you cannot reprovision it while lines are currently in use.
So that's always kind of been a bummer for us since V20.