forked from wallabag/wallabag
ConfigController: remove 2fa cancel step
This change annoys me, however this endpoint was anyway problematic: - it was vulnerable to a CSRF attack, see GHSA-56fm-hfp3-x3w3 - it is useless as we don't really handle a two-steps validation Still, if you send an incorrect code during the "activation" phase a flash error will pop up but the 2fa will stay enabled. This need rework when possible. Signed-off-by: Kevin Decherf <kevin@kdecherf.com>
This commit is contained in:
@ -50,9 +50,6 @@
|
||||
</div>
|
||||
</div>
|
||||
<div class="card-action">
|
||||
<a href="{{ path('config_otp_app_cancel') }}" class="waves-effect waves-light grey btn">
|
||||
{{ 'config.otp.app.cancel'|trans }}
|
||||
</a>
|
||||
<button class="btn waves-effect waves-light" type="submit" name="send">
|
||||
{{ 'config.otp.app.enable'|trans }}
|
||||
<i class="material-icons right">send</i>
|
||||
|
||||
Reference in New Issue
Block a user