nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-07-04 01:22:50 -05:00
Code Activity

[PM-6934] Prevent enabling two step login policy if any Org member has no master password and no 2FA set up (#3915)

Browse Source 
* [PM-6934] Prevent enabling two step login policy if any Org member has no master password and no 2FA set up

* [PM-6934] PR feedback

* [PM-6934] Updated policy check to only check users that will be deleted

* [PM-6934] Removed unnecessary code

* [PM-6934] Fixed unit tests and policy update logic

* [PM-6934] Updated error message
This commit is contained in:
Rui Tomé
2024-03-21 12:07:13 +00:00
committed by GitHub
parent 78ce1f8a5d
commit 366eef7e23
2 changed files with 169 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/Core/AdminConsole/Services/Implementations/PolicyService.cs
View File

@ -124,10 +124,17 @@ public class PolicyService : IPolicyService
switch (policy.Type)
{
case PolicyType.TwoFactorAuthentication:
foreach (var orgUser in removableOrgUsers)
// Reorder by HasMasterPassword to prioritize checking users without a master if they have 2FA enabled
foreach (var orgUser in removableOrgUsers.OrderBy(ou => ou.HasMasterPassword))
{
if (!await userService.TwoFactorIsEnabledAsync(orgUser))
{
if (!orgUser.HasMasterPassword)
{
throw new BadRequestException(
"Policy could not be enabled. Non-compliant members will lose access to their accounts. Identify members without two-step login from the policies column in the members page.");
}
await organizationService.DeleteUserAsync(policy.OrganizationId, orgUser.Id,
savingUserId);
await _mailService.SendOrganizationUserRemovedForPolicyTwoStepEmailAsync(