Actions
Patch #44368
closed
Revert removal of user scope in 2FA backup code lookup
Status:
Closed
Priority:
Normal
Assignee:
Category:
Accounts / authentication
Target version:
Description
As it turns out, the where(user_id:) scope prepended to Token.find_token that was removed in #44074
was actually honored and served to prevent a user from removing another users' backup code in the
(very unlikely) case that they somehow managed to enter another users backup code.
This patch reverts that change and adds test that confirm effectiveness of the user-id scoping.
Files
Related issues
Updated by Go MAEDA about 10 hours ago
- Related to Patch #44074: ignored and unnecessary scope in twofa token lookup added
Updated by Go MAEDA about 10 hours ago
- Category set to Accounts / authentication
- Target version set to 7.0.1
Updated by Marius BĂLTEANU about 4 hours ago
- Subject changed from revert removal of user scope in 2FA backup code lookup to Revert removal of user scope in 2FA backup code lookup
- Status changed from New to Resolved
- Assignee set to Marius BĂLTEANU
Updated by Marius BĂLTEANU about 4 hours ago
- Status changed from Resolved to Closed
Actions