search

go-gitea / gitea

Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD
https://gitea.com
MIT License
44.65k stars 5.45k forks source link

Incorrect 2FA status detected #32293

Open Sywyar opened 2 days ago

Sywyar commented 2 days ago

Description

Hello! After I enabled 2FA authentication for my administrator account using the web interface, I tried to disable it and then logged in again and found that 2FA was still working. The user security interface still showed that I had enabled 2FA. When I tried to delete it again, although the web interface normally showed that 2FA authentication was disabled (when using the backend user management to try to disable 2FA, it would jump to the 500 page: auth.DeleteTwoFactorByID, user not enrolled in 2FA [uid: 1])At this time, the backend output auth.DeleteTwoFactorByID: user not enrolled in 2FA [uid: 1]. After searching for a while, I deleted the corresponding row in the table two_factor in the MySQL database in Gitea, and then I was able to successfully disable 2FA for my account. After that, I tried to surface the problem and found that it was 100% triggered, and even if the 2FA background was disabled for the first time, it would output ...ting/security/2fa.go:77:DisableTwoFactor() [E] SettingsTwoFactor: Failed to DeleteTwoFactorByID: user not enrolled in 2FA [uid: 1] and it worked normally when logging in

*Translated by Google, please forgive me if there are any errors

Gitea Version

1.22.3

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

2024/10/18 22:07:34 ...ting/security/2fa.go:77:DisableTwoFactor() [E] SettingsTwoFactor: Failed to DeleteTwoFactorByID: user not enrolled in 2FA [uid: 1]

Screenshots

No response

Git Version

git version 2.47.0.windows.1

Operating System

Windows 10 Pro 22H2

How are you running Gitea?

gitea-1.22.3-gogit-windows-4.0-386.exe

Database

MySQL/MariaDB

Sywyar commented 2 days ago

I'm sorry, I mistyped the content in the user security interface background output. It should be...ting/security/2fa.go:77:DisableTwoFactor() [E] SettingsTwoFactor: Failed to DeleteTwoFactorByID: user not enrolled in 2FA [uid: 1]. Instead of auth.DeleteTwoFactorByID: user not enrolled in 2FA [uid: 1]