From: Go MAEDA <maeda@farend.jp>
Date: Thu, 15 Jul 2021 01:44:05 +0000 (+0000)
Subject: User sessions not reset after 2FA activation (#35417).
X-Git-Tag: 5.0.0~342
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=8f0d358533b97f02ce59896b9414fe31e88682d7;p=redmine.git

User sessions not reset after 2FA activation (#35417).

Patch by Felix Schäfer.


git-svn-id: http://svn.redmine.org/redmine/trunk@21069 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/app/controllers/twofa_controller.rb b/app/controllers/twofa_controller.rb
index 058388907..87f65e826 100644
--- a/app/controllers/twofa_controller.rb
+++ b/app/controllers/twofa_controller.rb
@@ -47,6 +47,8 @@ class TwofaController < ApplicationController
 
   def activate
     if @twofa.confirm_pairing!(params[:twofa_code].to_s)
+      # The session token was destroyed by the twofa pairing, generate a new one
+      session[:tk] = @user.generate_session_token
       flash[:notice] = l('twofa_activated', bc_path: my_twofa_backup_codes_init_path)
       redirect_to my_account_path
     else
diff --git a/app/models/user.rb b/app/models/user.rb
index 2591f56be..8a81b6a05 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -919,7 +919,7 @@ class User < Principal
   # This helps to keep the account secure in case the associated email account
   # was compromised.
   def destroy_tokens
-    if saved_change_to_hashed_password? || (saved_change_to_status? && !active?)
+    if saved_change_to_hashed_password? || (saved_change_to_status? && !active?) || (saved_change_to_twofa_scheme? && twofa_scheme.present?)
       tokens = ['recovery', 'autologin', 'session']
       Token.where(:user_id => id, :action => tokens).delete_all
     end