Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Require verified email before allowing user to enable 2FA #5866

Closed
brainwane opened this issue May 16, 2019 · 2 comments · Fixed by #5889
Closed

Require verified email before allowing user to enable 2FA #5866

brainwane opened this issue May 16, 2019 · 2 comments · Fixed by #5889
Labels
documentation feature request help needed We'd love volunteers to advise on or help fix/implement this.
Milestone
OTF Security work

Comments

@brainwane
Copy link
Contributor

What's the problem this feature will solve?
Sometimes people enable two-factor auth and then run into some kind of problem like losing access to their provisioned TOTP-generating app. We want to make it easier for PyPI admins to check the legitimacy of users' requests for account recovery in such circumstances.

Describe the solution you'd like
Prohibit users from enabling any 2FA until the user has verified at least one email address on their account.

Additional context
(followup to #5661, filed on @di's behalf)
@brainwane brainwane added documentation help needed We'd love volunteers to advise on or help fix/implement this. feature request labels May 16, 2019
@brainwane brainwane added this to the OTF Security work milestone May 16, 2019
This was referenced May 16, 2019
Closed
Closed
@woodruffw
Copy link
Member

Working on this now.

woodruffw added a commit to trail-of-forks/warehouse that referenced this issue May 20, 2019
@woodruffw
[WIP] warehouse: Require a verified email for 2FA
c5f93ea 
Closes pypi#5866.
@woodruffw woodruffw mentioned this issue May 20, 2019
Merged
@woodruffw
Copy link
Member

Opened #5889 for this.

@di di closed this as completed in #5889 May 30, 2019
di pushed a commit that referenced this issue May 30, 2019
@woodruffw @di
warehouse: Require a verified email for 2FA modifications (#5889)
2cf24b2 
* [WIP] warehouse: Require a verified email for 2FA

Closes #5866.

* warehouse: Fix import order

* warehouse: Simplify services check

The method within the User model does the work here.

* fix account factory

* warehouse: Update docstring

* tests: Fix tests

* tests: Coverage for two_factor_allowed

* warehouse: two_factor_allowed -> two_factor_provisioning_allowed

We should never disable 2FA for authentication just because
a user's primary email has changed to unverified.

* tests: Update tests

* warehouse: Nice warning flashes

* tests: Update tests

* tests, warehouse: Remove two_factor_prohibited

* warehouse: Remove unused migrations
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
documentation feature request help needed We'd love volunteers to advise on or help fix/implement this.
Projects
None yet
Milestone
OTF Security work
Development

Successfully merging a pull request may close this issue.

warehouse: Require a verified email for 2FA modifications trail-of-forks/warehouse
2 participants
@brainwane @woodruffw