a11y PR-6.2-dev Pending

User tests: Successful: Unsuccessful:

avatar mbeganyi-a11y
mbeganyi-a11y
23 Oct 2026

Pull Request resolves #48375.

  • I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Simplifies the accessible names of the links used to select an MFA method during login, in both the frontend and administrator captive views.

Previously, a method link included its title multiple times through:

  • The method image’s alternative text
  • The primary visible title
  • The secondary method name hint

This PR:

  • Sets the method icons to alt="", as their meaning is already conveyed by the link text
  • Removes the secondary method name hint from both rendering branches
  • Preserves the existing primary title, including custom titles and the translated method name used for grouped entries

The image below depicts the NVDA speech viewer output before this PR. Note the control is conveyed three separate times.

Verbose output

The images below depict the NVDA speech viewer output for the frontend and backend after this PR:

Speech output for frontend Speech output for backend

Testing Instructions

Prerequisite: successfully configure an MFA method

At least one MFA verification method must be successfully configured and saved before this patch can be tested. Enabling an MFA plugin or opening its setup screen is not sufficient.

Use a disposable test account and retain access to a separate administrator account.

  1. Sign in to the Joomla administrator using the test account
  2. Go to Users > Manage
  3. Open the account you are currently signed in as
  4. Open its Multi-factor Authentication tab
  5. Choose Add a new Verification code
  6. Follow the setup instructions:
    • Scan the QR code with an authenticator app, or enter the provided setup key manually.
    • Enter the current six-digit code from the authenticator app
    • Save the method successfully
  7. Confirm that the configured method appears in the account’s MFA settings
  8. Keep any backup codes private and available
  9. Optionally, give the method a distinctive title, such as Test authenticator, to check that custom titles are preserved

Do not include QR codes, setup keys, verification codes, or backup codes in screenshots if you need to include any in this PR's comments.

Identify the correct screen

This patch affects the login MFA method selection screen. It does not affect the administrator account settings screen containing buttons such as “Add a new Verification code”, “Add a new Passkey”, or “Add a new Code by Email”.

The frontend (Cassiopeia) screen to test has the heading “Select a Multi-factor Authentication Method” and links for configured methods and available backup codes.

To test the frontend screen:

  1. Start a screen reader
  2. With an MFA method successfully configured, log into the test account in the frontend
  3. If the verification code entry form opens directly, activate the "Select a different method" link
  4. On the method selection screen, navigate through the method links:
    • Using Tab
    • Using the screen reader’s links navigation command
  5. Record the names announced for Verification code and Backup Codes, where available
  6. Complete verification if needed to regain access

To test the equivalent administrator screen:

  1. Log out of the administrator test account
  2. Start a screen reader
  3. Log in again
  4. Open the MFA method selection screen using the "Select a different method" button
  5. Navigate through the method links with the screen reader
  6. Confirm each link announces its primary title without additional repetitions from the icon
  7. Confirm the method icons remain visible
  8. Select Verification code and complete the challenge successfully

Actual result BEFORE applying this Pull Request

Method links have unnecessarily verbose accessible names because the image alternative, primary title, and secondary hint all contribute text to the same link.

The secondary hint also introduces low-contrast text, which has been removed with this PR.

Expected result AFTER applying this Pull Request

Method links derive their names from the existing primary title without redundant contributions from the method icon or secondary hint. They are only announced once. Custom titles and existing method selection behaviour are preserved. The redundant secondary hint is removed visually as well as programmatically.

Link to documentations

Please select:

  • Documentation link for guide.joomla.org:

  • No documentation changes for guide.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar mbeganyi-a11y mbeganyi-a11y - open - 23 Oct 2026
avatar mbeganyi-a11y mbeganyi-a11y - change - 23 Oct 2026
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 23 Oct 2026
Category ⇒ Administration com_users Front End
avatar cyns cyns - test_item - 23 Oct 2026 - Not tested
avatar cyns
cyns - comment - 23 Oct 2026

I have not tested this item.

Tested with Chrome + Voiceover and Safari + Voiceover. The authentication methods are read with a single name, giving an understandable user experience


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48689.

avatar cyns
cyns - comment - 23 Oct 2026

I have not tested this item.

Tested with Chrome + Voiceover and Safari + Voiceover. The authentication methods are read with a single name, giving an understandable user experience


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48689.

avatar cyns cyns - test_item - 23 Oct 2026 - Tested successfully
avatar cyns
cyns - comment - 23 Oct 2026

I have tested this item ✅ successfully on c299dde

Tested with Chrome + Voiceover and Safari + Voiceover. The authentication methods are read with a single name, giving an understandable user experience


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48689.

avatar cyns
cyns - comment - 23 Oct 2026

I have tested this item ✅ successfully on c299dde

Tested with Chrome + Voiceover and Safari + Voiceover. The authentication methods are read with a single name, giving an understandable user experience


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48689.

avatar richard67 richard67 - change - 24 Oct 2026
Title
…
[6.3] Admin / User login flow: Remove redundant text from MFA method selection links during login after an MFA method has been added
[6.2] Admin / User login flow: Remove redundant text from MFA method selection links during login after an MFA method has been added
avatar richard67 richard67 - edited - 24 Oct 2026
avatar brianteeman brianteeman - test_item - 3 Nov 2026 - Tested successfully
avatar brianteeman
brianteeman - comment - 3 Nov 2026

I have tested this item ✅ successfully on c299dde


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48689.

avatar brianteeman
brianteeman - comment - 3 Nov 2026

I have tested this item ✅ successfully on c299dde


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48689.

avatar QuyTon QuyTon - change - 4 Nov 2026
The description was changed
Status Pending ⇒ Ready to Commit
Labels Added: a11y PR-6.2-dev
avatar QuyTon
QuyTon - comment - 4 Nov 2026

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48689.

avatar QuyTon QuyTon - edited - 4 Nov 2026
avatar QuyTon
QuyTon - comment - 4 Nov 2026

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48689.

Add a Comment

Login with GitHub to post a comment