diff --git a/Koha/Auth/TwoFactorAuth.pm b/Koha/Auth/TwoFactorAuth.pm
index f66379200d..8932006763 100644
--- a/Koha/Auth/TwoFactorAuth.pm
+++ b/Koha/Auth/TwoFactorAuth.pm
@@ -36,6 +36,12 @@ my $ok = $auth->verify($pin_code, 1, $secret32);
 
 It's based on Auth::GoogleAuth
 
+=head2 METHODS
+
+=head3 new
+
+    $obj = Koha::Auth::TwoFactorAuth->new({ patron => $p, secret => $s });
+
 =cut
 
 sub new {
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
index d067c2dcde..cddac9f1b4 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
@@ -39,8 +39,8 @@
                         <p>We recommend cloud-based mobile authenticator apps such as Authy, Duo Mobile, and LastPass. They can restore access if you lose your hardware device.</p>
                         <p>Can't scan the code?</p>
                         <p>To add the entry manually, provide the following details to the application on your phone.</p>
-                        <p>Account: [% issuer %]</p>
-                        <p>Key: [% key_id %]</p>
+                        <p>Account: [% issuer | html %]</p>
+                        <p>Key: [% key_id | html %]</p>
                         <p>Time based: Yes</p>
                     </div>
 
@@ -51,11 +51,11 @@
                         <fieldset class="rows">
                             <input type="hidden" name="csrf_token" value="[% csrf_token | html %]" />
                             <input type="hidden" name="op" value="register-2FA" />
-                            <input type="hidden" name="secret32" value="[% secret32 %]" />
+                            <input type="hidden" name="secret32" value="[% secret32 | html %]" />
                             <ol>
                                 <li>
                                     <label for="qr_code">QR code: </label>
-                                    <img id="qr_code" src="[% qr_code_url %]" />
+                                    <img id="qr_code" src="[% qr_code_url | $raw %]" />
                                 </li>
                                 <li>
                                     <label for="pin_code">Pin code: </label>
diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl
old mode 100644
new mode 100755