From 92cb451da80051f242fe1fce32421f89841f4adc Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Wed, 26 Jul 2017 23:36:33 +0200 Subject: [PATCH] Fix #4026 - Accept backup codes for disabling 2FA (#4382) --- .../settings/two_factor_authentications_controller.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/app/controllers/settings/two_factor_authentications_controller.rb b/app/controllers/settings/two_factor_authentications_controller.rb index 9834838817..863cc7351b 100644 --- a/app/controllers/settings/two_factor_authentications_controller.rb +++ b/app/controllers/settings/two_factor_authentications_controller.rb @@ -18,7 +18,7 @@ module Settings end def destroy - if current_user.validate_and_consume_otp!(confirmation_params[:code]) + if acceptable_code? current_user.otp_required_for_login = false current_user.save! redirect_to settings_two_factor_authentication_path @@ -38,5 +38,10 @@ module Settings def verify_otp_required redirect_to settings_two_factor_authentication_path if current_user.otp_required_for_login? end + + def acceptable_code? + current_user.validate_and_consume_otp!(confirmation_params[:code]) || + current_user.invalidate_otp_backup_code!(confirmation_params[:code]) + end end end