Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
Users with some permission combinations are shown a broken link to the tfa.disable route when they can't actually access it.
- When a user has
administer tfa for other usersbut notdisable own tfawhile viewing own TFA page - When a user has
disable own tfabut notadminister tfa for other userswhile viewing another user's TFA page
Proposed resolution
Change the logic in TfaOverviewForm::buildForm from hasPermission to Url->access
| Comment | File | Size | Author |
|---|
Issue fork tfa-3531309
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #3
jvollebregt-swis commentedSubmitted an MR to fix it. I'm also uploading a patch file of the MR for 2.x and one for 1.x for use with composer-patches (Though they're the same code, the line numbers changed)
Comment #4
cmlara@jvollebregt-swis do you consider this ready for review or is there other work still to be done?
Comment #5
jvollebregt-swis commented@cmlara yes this is ready for review, was I supposed to tag this somehow?
Comment #6
cmlaraCurrently under Drupal.org issues are generally marked 'needs review' when ready, although I imagine when D.O. move's to GitLab issues it may just be the presence of a non-draft MR.
Just wanted to validate you were not working on any concerns before I proceed with testing
Comment #7
cmlaraI'm not able to duplicate having access to another users TFA page unless they have the administer tfa or other users permission.
If you are able to duplicate this scenario it should be rasied as a private security issue for further discussion.
I am able to duplicate this, and attached patch does appear to remove the link.
As noted in IS access is blocked when clicking on the link making the change purely cosmetic.
Comment #9
cmlara