Problem/Motivation

Currently, with TFA enabled, the number of times a user without having setup tfa validation can login (appears to be ) set to 3.
Admins can configure value to very large number at admin/config/people/tfa

Steps to reproduce

Go to admin/config/people/tfa
Set Skip Validation to any large number.

Proposed resolution

Set max limit to 50 for skipped validations

User interface changes

No changes

API changes

No changes

Data model changes

CommentFileSizeAuthor
#4 3263289-set-upper-limit.patch652 bytescodepress
#3 3265289-set-upper-limit.patch652 bytescodepress

Issue fork tfa-3263289

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

codepress created an issue. See original summary.

codepress opened merge request !7

codepress’s picture

codepress commented
StatusFileSize
new 3265289-set-upper-limit.patch652 bytes
codepress’s picture

codepress commented
StatusFileSize
new 3263289-set-upper-limit.patch652 bytes
jcnventura’s picture

jcnventura
Primary language English
commented
Status: Active » Closed (duplicate)

Duplicate of #3315549: Set an upper limit to TFA Skip Validations, which implemented a better fix, and gave credit to the original reporter of this problem in a security issue that was opened and closed before this issue was created.

jcnventura closed merge request !7