aiden
/
mastodon
mirror of https://github.com/mastodon/mastodon
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
8,676 Commits
144 Branches
281 Tags
1.1 GiB
Commit Graph

8 Commits (4bf5aeae833ba4b751cd04d67a0697052a14e0ee)

Author SHA1 Message Date
Eugen Rochko e1066cd431
Add password challenge to 2FA settings, e-mail notifications () 
Fix
Eugen Rochko a4b60e9ba4
Fix TOTP codes not being filtered from logs during enabling/disabling () 
Not a serious issue because they are meaningless past single use
Eugen Rochko 964ae8eee5
Change unconfirmed user login behaviour () 
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.

Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.

After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.

Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
ThibG 650459f93c Fix some flash notices/alerts staying on unrelated pages ()
ysksn b048926e67 Create Settings::BaseController () 
Define `Settings::BaseController#set_body_classes` so that sub classes
inherit `Settings::BaseController` don't need to define
`#set_body_classes` agein.
Yamagishi Kazutoshi e8ffecbd36 Set @body_classes to admin layout ()
Aboobacker MK 112b1fa265 Redirect to 2FA creation page when otp_secret is not available ()
Matt Jankowski 67dea31b0f 2FA controller cleanup () 
* Add spec coverage for settings/two_factor_auth area

* extract setup method for qr code

* Move otp required check to before action

* Merge method only used once

* Remove duplicate view

* Consolidate creation of @codes for backup

* Move settings/2fq#recovery_codes to settings/recovery_codes#create

* Rename settings/two_factor_auth#disable to #destroy

* Add coverage for the otp required path on 2fa#show

* Clean up the recovery codes list styles

* Move settings/two_factor_auth to settings/two_factor_authentication

* Reorganize the settings two factor auth area

Updated to use a flow like:

- settings/two_factor_authentication goes to a #show view which has a button
  either enable or disable 2fa on the account
- the disable button turns off the otp requirement for the user
- the enable button cycles the user secret and redirects to a confirmation page
- the confirmation page is a #new view which shows the QR code for user
- that page posts to #create which verifies the code, and creates the recovery
  codes
- that create action shares a view with a recovery codes controller which can be
  used separately to reset codes if needed