magento / magento/security-package
2FA modules using "content" as block name results in blank pages
- Dominant language
- PHP
- Stars
- 75
- Forks
- 73
- PR merge metrics
- No merged PRs in 30d
Description
### Preconditions (*)
1. Magento 2.4.8-p3
### Steps to reproduce (*)
1. Add a block to the `content` container on the default layout in any module, for the adminhtml area
2. Open any 2fa page like the first configure screen (tfa/tfa/configure), or the google setup for a new admin (tfa/google/configure)
### Expected result (*)
1. The configuration form is shown
### Actual result (*)
1. Section where the configuration form should be is blank
Inspecting the page, there is no block from the 2fa module being rendered, it isn't even being initialized (debugging with a breakpoint on the constructor)
This happens because block names in Magento are globally unique, and content is already a container. If you use the same name, that block or container will get overwritten which is what happens here. Inspecing the blocks of the layout shows the class of "content" is the standard Template, not whatever 2fa block it should be.
I'm sure that in a clean magento instance this won't be visible, I only saw it in one project that happens to add a block like that.
To fix this, all the new blocks being created with the name "content" in the adminhtml/layout should be renamed to anything else.
Contributor guide
Research direction
Start by searching the adminhtml/layout declarations for blocks named "content", then inspect the 2FA configure layouts referenced in the reproduction steps. Rename the conflicting block names and verify that the configuration forms render on tfa/tfa/configure and tfa/google/configure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100