- Issue created by @prudloff
- 🇷🇺Russia mikhailkrainiuk
Hello!
The patch to fix it. It validates the code if user can enable/disable 2FA and he selected "Enable 2FA", or if 2FA is required for users.
While testing the module I noticed I could input random code and it would still enable 2FA.
Don't enable the "Allow Users to Enable/Disable 2FA?" option.
Browse to /user/1/2fa and input a random code.
This seems to happen because SettingsForm::validateForm() only validates the code if the enable_2fa is checked. But this checkbox is not displayed when allow_enable_disable is disabled.
Active
2.1
Code
Hello!
The patch to fix it. It validates the code if user can enable/disable 2FA and he selected "Enable 2FA", or if 2FA is required for users.