User sessions not reset after 2FA activation (#35417).

Patch by Felix Schäfer.

git-svn-id: http://svn.redmine.org/redmine/trunk@21069 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/app/controllers/twofa_controller.rb b/app/controllers/twofa_controller.rb
index 0583889074034eadc2d305044a7a42073c099ec1..87f65e8260f20f7464b069996550a96d6497383d 100644 (file)
--- a/app/controllers/twofa_controller.rb
+++ b/app/controllers/twofa_controller.rb
@@ -47,6 +47,8 @@ class TwofaController < ApplicationController
 
   def activate
     if @twofa.confirm_pairing!(params[:twofa_code].to_s)
+      # The session token was destroyed by the twofa pairing, generate a new one
+      session[:tk] = @user.generate_session_token
       flash[:notice] = l('twofa_activated', bc_path: my_twofa_backup_codes_init_path)
       redirect_to my_account_path
     else

diff --git a/app/models/user.rb b/app/models/user.rb
index 2591f56be99c76cb0f7d85b7f519dc00cecc3623..8a81b6a05982c18018c6348e763988fbf8274e80 100644 (file)
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -919,7 +919,7 @@ class User < Principal
   # This helps to keep the account secure in case the associated email account
   # was compromised.
   def destroy_tokens
-    if saved_change_to_hashed_password? || (saved_change_to_status? && !active?)
+    if saved_change_to_hashed_password? || (saved_change_to_status? && !active?) || (saved_change_to_twofa_scheme? && twofa_scheme.present?)
       tokens = ['recovery', 'autologin', 'session']
       Token.where(:user_id => id, :action => tokens).delete_all
     end