Bug 1578805 - When changing password or enabling 2fa, previous sessions should be...

diff --git a/template/en/default/account/prefs/account.html.tmpl b/template/en/default/account/prefs/account.html.tmpl
index 64501eef68c3a1420893c0967dd5fc0f72cecd2f..db8633751df55ec3bfe1c55f23995e81776c5a49 100644 (file)
--- a/template/en/default/account/prefs/account.html.tmpl
+++ b/template/en/default/account/prefs/account.html.tmpl
@@ -76,6 +76,13 @@
             [% Param('passwdqc_desc') FILTER html_light %]
           </td>
           </tr>
+          <tr>
+          <td>&nbsp;</td>
+          <td>
+            <em>Warning:</em> Changing your password will automatically log out
+            other login sessions except for the current one.
+          </td>
+          </tr>
           <tr>
             <th align="right">New password:</th>
             <td>

diff --git a/template/en/default/account/prefs/mfa.html.tmpl b/template/en/default/account/prefs/mfa.html.tmpl
index 8185a91bb691ab5675244e7c36dd8c952efe510c..66702ae4d2df717d80dcf7044a33a1e276c2f68c 100644 (file)
--- a/template/en/default/account/prefs/mfa.html.tmpl
+++ b/template/en/default/account/prefs/mfa.html.tmpl
@@ -277,6 +277,12 @@
       <a href="[% basepath FILTER none %]userprefs.cgi?tab=settings#api_key_only">Require API key authentication for API requests</a>
       preference after 2FA is enabled.
     </p>
+
+    <p>
+      <em>Warning:</em> Changing your Two-factor authentication settings will
+      automatically log out other login sessions except for the current one.
+    </p>
+
   </div>
 
 </div>

diff --git a/userprefs.cgi b/userprefs.cgi
index fdd921536f669597b14f8af74ac5ba576d090cf9..e2127fe4326eae9a5c7836d8933ead45af45b04b 100755 (executable)
--- a/userprefs.cgi
+++ b/userprefs.cgi
@@ -742,6 +742,11 @@ sub SaveMFAupdate {
     $user->update({keep_session => 1, keep_tokens => 1});
 
   }
+
+  # Invalidate all logins except for the current one
+  if ($action eq 'enable' || $action eq 'disable') {
+    Bugzilla->logout(LOGOUT_KEEP_CURRENT);
+  }
 }
 
 sub SaveMFAcallback {