/user/<xyz>/2factor Access Denied

Open
#94 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
javascript
Domain
authentication, security

Research direction

Reproduce the two cases described for /user//2factor: an enforced-2FA moderator without setup and a user who already has 2FA. Start by tracing the plugin's route and access checks for that endpoint. Done means both users can reach the appropriate 2FA page or account area without an incorrect Access Denied response.

Written by the indexing model from the issue text.

Description

Got "Access Denied" and "You seem to have stumbled upon a page that you do not have access to." when different user accessed my NodeBB 3.7.2 site.

In one case, it is a user in the "Global Moderator" group, on which I just turned on enforced 2FA, but the user does not have 2FA set up yet. That user seems to be forced to visit /user//2factor no matter what the route is.

Another case is a user not in any group but does have 2FA set up. In this case, user2 can log in, and browse around. Just /user//2factor would give an Access Denied.

Dominant language
JavaScript
Stars
13
Forks
17
Avg merge
1m
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from NodeBB/nodebb-plugin-2factor

All issues in NodeBB/nodebb-plugin-2factor

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.