[#38045] - Fix core update when 2FA or MFA is enabled
- Fixed in Code Base
- 14 Jun 2022
- Medium
- Build: 4.2-dev
- # 38045
- Diff
- nikosdion:fix/mfa-and-update
User tests: Successful: Unsuccessful:
Pull Request for Issue #38044 .
Summary of Changes
Allows Joomla! Update to finalise if you had previously enabled 2FA or MFA for the Super User executing the update.
Testing Instructions
Update a Joomla 4.1.x stable or development version or a 4.2 development version prior to 4.2.0-beta1 with Two Factor Authentication enabled and used for the current super user who runs the update to a 4.2.0-beta2 or current 4.2-dev version which includes the new Multi Factor Authentication introduced with PR #37912 .
Actual result BEFORE applying this Pull Request
When the update package has been unpacked (i.e. progress bar comes to the end), the update ends with an SQL error about the new table for MFA missing.
Expected result AFTER applying this Pull Request
The update completes cleanly.
Documentation Changes Required
None.
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Libraries |
I have tested this item
Hint for other testers: To reproduce the issue, I've updated with 2FA enabled and used to the custom update URL of the 4.2-dev nightlies.
To test the fix, I've updated to the custom update URL created by drone for this PR and which can currently be found here: https://ci.joomla.org/artifacts/joomla/joomla-cms/4.2-dev/38045/downloads/55243/
Update: New link is https://ci.joomla.org/artifacts/joomla/joomla-cms/4.2-dev/38045/downloads/55281/ .
With the fix, you get prompted for your 2FA (or now MFA) key or password or whatever it is (in my case the 6 digit code for Google Authenticator) on the new captive MFA page. After having submitted that, you see the normal success message for the update, and all is fine.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38045.
Screenshots of my test result:
After entering the code and validate:
P.S.: Log out and log in again works as it should with the new MFA.
That's a perfect test! Exactly how it should've worked in the first place
Yes, and all is like it should be in the MFA options. The code is there, backup keys are there ... all fine ... and I like the new MFA.
Thank you :) The new MFA is what I've always had in mind ever since I proposed integrating 2FA back in 2013. Finally the time was right to get this into the core. Onwards and upwards!
| Labels |
Added:
Release Blocker
?
|
||
I have tested this item
This time I've tested not only live update but also upload & update to be sure I haven't forgotten anything. Both works fine.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/38045.
I was able to take a live 4.1.4 site, use the nightly build for 4.2 both with and without 2fa and it updated successfully.
| Status | Pending | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2022-06-14 10:40:01 |
| Closed_By | ⇒ | HLeithner |
Tested successful thanks
@richard67 Please mark as release blocker