darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-19 14:09:20 -04:00
Code Issues Packages Projects Releases Wiki Activity

Prevent switching auth type for Platform Admins

Browse Source 
This closes a security loophole, where the auth type of a Platform
Admin could be unwittingly changed when they accept an invite, or
by an admin of a service they are a member of.
This commit is contained in:
Ben Thorner
2021-05-25 15:58:33 +01:00
parent a10304d9c6
commit 6d0d9d46f7
5 changed files with 92 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/templates/views/manage-users/permissions.html
View File

@@ -11,7 +11,11 @@
{% endif %}
{% if service_has_email_auth %}
{% if not mobile_number %}
{% if user.platform_admin %}
<p class="bottom-gutter">
Platform admin users will login with a security key.
</p>
{% elif not mobile_number %}
{{ radios(
form.login_authentication,
disable=['sms_auth'],