Not super critical since you do have to input a 2FA code to disable.
getLoginSecurityLevel() in SpecialDisableOATHForUser is supposed to require users to re-enter their pass before disabling 2FA. This does not seem to work in practise.
Description
Description
Related Objects
Related Objects
- Mentioned Here
- T197153: Make some providers optional for reauthentication
Event Timeline
Comment Actions
SpecialDisableOATHForUser disables OAuth for other users. (Shame on someone for not documenting what the class does :) SpecialOATHDisable does not use getLoginSecurityLevel() (that would be bad, since it would require two tokens to disable).
Comment Actions
Ah, that's confusing. Thanks.
Still seems like it would be nice to require a pass and a token, in case e.g. someone has someone's phone for a limited window but does not know the password. But requiring multiple tokens would be silly.
Comment Actions
That would require T197153: Make some providers optional for reauthentication; otherwise probably doable.