From c32b45c33264d32fb7cdb7222711de8674229d3f Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Tue, 22 Mar 2022 18:03:42 +0100 Subject: [PATCH] Fix password-reset flow when MFA is enabled --- auth/handlers/handle_password-reset.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/auth/handlers/handle_password-reset.go b/auth/handlers/handle_password-reset.go index 92dca58da..8c631affa 100644 --- a/auth/handlers/handle_password-reset.go +++ b/auth/handlers/handle_password-reset.go @@ -56,6 +56,14 @@ func (h *AuthHandlers) resetPasswordForm(req *request.AuthReq) (err error) { // login user req.AuthUser = request.NewAuthUser(h.Settings, user, false, h.Opt.SessionLifetime) + if req.AuthUser.PendingEmailOTP() { + // Email OTP enabled & pending + // + // If we're here it means user clicked on a link in an email; + // we are effectively confirming email OTP + req.AuthUser.CompleteEmailOTP() + } + // redirect back to self (but without token and with user in session h.Log.Debug("valid password reset token found, refreshing page with stored user") req.RedirectTo = GetLinks().ResetPassword