The 'disable TFA' asks for password confirmation - but it always checks the password of the user for whom TFA is being disabled, rather than the current user.

CommentFileSizeAuthor
#3 2471799-tfa-basic-admin-disable-3.patch3.15 KBcoltrane
#1 tfa_basic-admin_disable_tfa-2471799-1.patch801 bytespjcdawkins
tfa_basic-admin_disable_tfa.patch0 bytespjcdawkins
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

pjcdawkins’s picture

pjcdawkins CreditAttribution: pjcdawkins commented
FileSize
tfa_basic-admin_disable_tfa-2471799-1.patch801 bytes
coltrane’s picture

coltrane
he/him
CreditAttribution: coltrane commented

Great catch @pjcdawkins! I'll review soon but in the meantime if you're able to add a test for this it'd be helpful.

coltrane’s picture

coltrane
he/him
CreditAttribution: coltrane commented
FileSize
2471799-tfa-basic-admin-disable-3.patch3.15 KB

Added test. Going to commit this next.

  • coltrane committed 17db775 on 7.x-1.x authored by pjcdawkins 
    Issue #2471799 by pjcdawkins, coltrane: Let admins disable users TFA
coltrane’s picture

coltrane
he/him
CreditAttribution: coltrane commented
Status: Needs review » Fixed

Committed

pjcdawkins’s picture

pjcdawkins CreditAttribution: pjcdawkins commented

Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.