Redmine

When sudo_mode is enabled, which is the new default with Redmine 7, I encounter a lockout : the 2FA activation actions are protected by require_sudo_mode, so the page the user is sent to is the sudo password form , and the Lost password link of that form leads back to the 2FA activation page, back to the sudo form. An admin who no longer remembers their password has no way out.

AccountController skips the check_twofa_activation before action for logout only.

Steps to reproduce¶

• set Two-factor authentication to required in the authentication settings
• set sudo_mode: true in config/configuration.yml # Default value since 7.0.0
• log in with an admin account that has no 2FA scheme yet, then click Lost password on the sudo password form

• Expected: the lost password form.
• Actual: back to the sudo password form.

Patch¶

The attached patch adds lost_password to the actions exempted from check_twofa_activation.

This exemption grants a pending 2FA session nothing an anonymous visitor does not already have.

diff --git a/app/controllers/account_controller.rb b/app/controllers/account_controller.rb
index 2263ad07f..2f848d804 100644
--- a/app/controllers/account_controller.rb
+++ b/app/controllers/account_controller.rb
@@ -25,7 +25,7 @@ class AccountController < ApplicationController

   # prevents login action to be filtered by check_if_login_required application scope filter
   skip_before_action :check_if_login_required, :check_password_change
-  skip_before_action :check_twofa_activation, :only => :logout
+  skip_before_action :check_twofa_activation, :only => [:logout, :lost_password]

   # Login request and validation
   def login