Project

General

Profile

Actions
Copy link

Patch #44368

closed

Revert removal of user scope in 2FA backup code lookup

Added by Jens Krämer about 15 hours ago. Updated about 5 hours ago.

Status:
Closed
Priority:
Normal
Assignee:
Marius BĂLTEANU
Category:
Accounts / authentication
Target version:
7.0.1

Description

As it turns out, the where(user_id:) scope prepended to Token.find_token that was removed in #44074
was actually honored and served to prevent a user from removing another users' backup code in the
(very unlikely) case that they somehow managed to enter another users backup code.

This patch reverts that change and adds test that confirm effectiveness of the user-id scoping.

Files

0001-Revert-Removes-ignored-and-unnecessary-scope-in-twof.patch (2.59 KB) 0001-Revert-Removes-ignored-and-unnecessary-scope-in-twof.patch Jens Krämer, 2026-08-24 11:21

Related issues

Related to Redmine - Patch #44074: ignored and unnecessary scope in twofa token lookupClosedMarius BĂLTEANUActions
Actions
Copy link

Also available in: Atom PDF