RocketChat / RocketChat/Rocket.Chat
Role editing 'Users must use Two Factor Authentication' doesn't work
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
Role editing 'Users must use Two Factor Authentication' doesn't work
Steps to reproduce:
- Go to Administration -> Permissions
- Click on any role (top of list) (e.g. user)
- In Role Editing enable 'Users must use Two Factor Authentication'
Expected behavior:
If an user has been assigned this role and the 'Users must use Two Factor Authentication' is active for that role we would expect that if that user would login some sort of 2FA setup would take place. And that the user wouldn't be able to continue if 2FA isn't active.
Actual behavior:
Nothing, the user can just login (without 2FA) and go about its business.
Server Setup Information:
- Version of Rocket.Chat Server: 4.2.2
- Operating System: ubuntu 18
- Deployment Method: manual nginx ssl
- Number of Running Instances: 1
- DB Replicaset Oplog:
- NodeJS Version: 12.18.4
- MongoDB Version: 5.0.5
Client Setup Information
- Desktop App or Browser Version: Firefox 95.0.2
- Operating System: Linux
Additional context
Possibly related to #18573
Relevant logs:
Console log from BROWSER:
Exception in defer callback: Error: Can't select in removed DomRange
$ https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:804
$ https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:804
find https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:804
e https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:997
withValue https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1
t https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1
bindEnvironment https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1
a https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1
bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js:1:6771
Object { stack: "r@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:4173\n_livedata_result@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:772:17821\nonMessage@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:772:20132\np@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:298611\ne/u/t/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:298741\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\nt@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:298711\nsendMessage@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:772:2229\napply@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:772:9725\ncall@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:772:8246\ne/u/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:997:799825\ne/o.call@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:997:800111\ne/a/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:281286\na@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:281264\ne/s/</<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:74963\nonLogin@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:997:787301\ne/s/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:74949\ns@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:999:74927\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:802195\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:788836\ne/e/</<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789428\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne/e/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789404\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789031\ne/e/</<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789428\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne/e/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789404\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789031\ne/e/</<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789428\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne/e/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789404\nn.bindEnvironment/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:1:8262\npromise callback*n/t.makeCompatible/n.prototype.then@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:728:1083\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789031\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:789447\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:802651\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:822774\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:822625\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:822310\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:800643\ne/e/</<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:797899\ne/e/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:797876\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:805265\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:797848\ne/e/this.unsubscribeFocus<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:807049\ne/e/<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:790189\ne@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:790168\ne/e/this.removeEventListener<@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:790055\nr@https://myURL/bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js?meteor_js_resource=true:679:790525\n", isClientSafe: true, error: "too-many-requests", reason: "Error, too many requests. Please slow down. You must wait 53 seconds before trying again.", details: {…}, message: "Error, too many requests. Please slow down. You must wait 53 seconds before trying again. [too-many-requests]", errorType: "Meteor.Error" }
bb5a52e8337857fcd23c63ac4ebf717cb197c58e.js:679:803005
SERVER LOG:
At the server side we get a lot of:
{"level":50,"time":"2022-01-04T15:00:29.360Z","pid":2099,"hostname":"myServer","name":"System","msg":"Exception while invoking method license:getModules 'Error, too many requests. Please slow down. You must wait 33 seconds before trying again. [too-many-requests]'"}
{"level":50,"time":"2022-01-04T15:00:33.401Z","pid":2099,"hostname":"myServer","name":"System","msg":"Exception while invoking method license:getModules 'Error, too many requests. Please slow down. You must wait 29 seconds before trying again. [too-many-requests]'"}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the behavior through Administration → Permissions, the role editor, and the login flow, while checking the browser and server logs for the reported errors. Done means users assigned a role requiring two-factor authentication are prompted to configure it and cannot continue without it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100