Clicking "I didn't receive a code" for e-mail auths lets the user login anyway

catalyst / moodle-tool_mfa

A Multi-Factor Authentication Moodle plugin with flexible support for TOTP, Email, IP and more

35 stars 38 forks source link

Clicking "I didn't receive a code" for e-mail auths lets the user login anyway #447

Closed OliverOPI closed 11 months ago

OliverOPI commented 1 year ago

Expected behaviour: Clicking "I didn't' receive a code" should not result in the user being logged in Observed behaviour: Clicking "I didn't' receive a code" successfully logs the user in without the auth code

Email auth doesn't appear to be working on our installation. When trying to login, the 2FA auth screen is presented. But clicking "I didn't receive a code" results in the user being logged in anyway. In the Moodle logs, we see this:

don't have a code

To be clear, we clicked "I didn't receive a code" even when it was in fact e-mailed to us, as we're just testing.

auth screen

Moodle 4.1.5 (IOMAD edition)

SOFASICode commented 1 year ago

hi, it not working with me when i clicked "I didn't receive a code". it display Capture i need issue because i can't access as admin

Peterburnett commented 11 months ago

Hi @OliverOPI

The logs indicate that you have 2 factors which DO allow for authentication, as the user passed a capability factor and an auth type factor. Email status was neutral, which shows that email did not provide points as indicated in this issue. The "I didn't receive a code" button does not end the authentication flow, just resolves the email factor and moves on to the next factor.

Peterburnett commented 11 months ago

Hi @SOFASICode, if you are locked out from the site as an administrator due to MFA, please run php /path/to/moodle/admin/cli/cfg.php --name=enabled component=tool_mfa --set=0 to disable the plugin via the CLI config tool and regain access to your site.