search

getgrav / grav-plugin-login

Grav Login Plugin
http://getgrav.org
MIT License
44 stars 54 forks source link

ADMIn 2FA saving a user with 2fa enabled regenerates the 2fa code and locks out the user #268

Closed Andy-Flack closed 3 years ago

Andy-Flack commented 3 years ago

BEWARE hitting save after looking at a user profile with 2fa enabled regenerates the 2fa code and locks out the user. I thought it was clock slippage until I realised that one user was OK and another one not. Just saving the user you can see that the alpha code is changed each time.

I only realised as I was trying to work out how to enable a (non admin) user to turn on 2fa for themselves.

Andy-Flack commented 3 years ago

problem is with line 6 of /grav/user/plugins/login/templates/forms/fields/2fa_secret/2fa_secret.html.twig set user = grav.user commenting / removing this line allows the load of the page to FIND the existing 2FA value, as the regen is a product of not finding it.