Bug 1213757 - delegate password and 2fa resets to servicedesk

diff --git a/Bugzilla/Install.pm b/Bugzilla/Install.pm
index 71525115480471034ed34a3fac2b2d98f1d1ac83..97b8b677c93c16a66162b9fdb000d3c814c2a576 100644 (file)
--- a/Bugzilla/Install.pm
+++ b/Bugzilla/Install.pm
@@ -247,6 +247,10 @@ use constant SYSTEM_GROUPS => (
         name         => 'bz_quip_moderators',
         description  => 'Can moderate quips',
     },
+    {
+        name         => 'bz_can_disable_mfa',
+        description  => 'Can disable MFA when editing users',
+    },
 );
 
 use constant DEFAULT_CLASSIFICATION => {

diff --git a/Bugzilla/User.pm b/Bugzilla/User.pm
index d2de6b54887ca61c9b2516c674d17ba2b0c8cece..ebd82002fdbe61073dc93db31b086bddd605f197 100644 (file)
--- a/Bugzilla/User.pm
+++ b/Bugzilla/User.pm
@@ -270,6 +270,9 @@ sub update {
     }
 
     if (exists $changes->{mfa} && $self->mfa eq '') {
+        if (Bugzilla->user->id != $self->id) {
+            Bugzilla->audit(sprintf('%s disabled 2FA for %s', Bugzilla->user->login, $self->login));
+        }
         $dbh->do("DELETE FROM profile_mfa WHERE user_id = ?", undef, $self->id);
     }
 
@@ -369,6 +372,16 @@ sub _check_mfa {
     $provider = lc($provider // '');
     return 'TOTP' if $provider eq 'totp';
     return 'Duo' if $provider eq 'duo';
+
+    # you must be member of the bz_can_disable_mfa group to disable mfa for
+    # other accounts.
+    if ($provider eq '') {
+        my $user = Bugzilla->user;
+        if ($user->id != $self->id && !$user->in_group('bz_can_disable_mfa')) {
+            ThrowUserError('mfa_disable_denied');
+        }
+    }
+
     return '';
 }
 

diff --git a/editusers.cgi b/editusers.cgi
index c7851d00a70c6c10111f57eb901b8612722a8da7..c3ea9a49e14d309ea916415e4f23cf4254fbd3f9 100755 (executable)
--- a/editusers.cgi
+++ b/editusers.cgi
@@ -270,9 +270,8 @@ if ($action eq 'search') {
             ? $cgi->param('password_change_reason')
             : ''
         );
-        if ($user->in_group('admin') && $otherUser->mfa && $cgi->param('mfa') eq '') {
+        if ($user->in_group('bz_can_disable_mfa') && $otherUser->mfa && $cgi->param('mfa') eq '') {
             $otherUser->set_mfa('');
-            Bugzilla->audit(sprintf('%s disabled 2FA for %s', $user->login, $otherUser->login));
         }
         $changes = $otherUser->update();
     }

diff --git a/extensions/SecureMail/template/en/default/account/email/encryption-required.txt.tmpl b/extensions/SecureMail/template/en/default/account/email/encryption-required.txt.tmpl
index 3817f4fa13005ec175c564571d3d10470cedc06a..55b716864b2aea0aecde5a0a53faac30cb363246 100644 (file)
--- a/extensions/SecureMail/template/en/default/account/email/encryption-required.txt.tmpl
+++ b/extensions/SecureMail/template/en/default/account/email/encryption-required.txt.tmpl
@@ -1,3 +1,11 @@
+[%# This Source Code Form is subject to the terms of the Mozilla Public
+  # License, v. 2.0. If a copy of the MPL was not distributed with this
+  # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  #
+  # This Source Code Form is "Incompatible With Secondary Licenses", as
+  # defined by the Mozilla Public License, v. 2.0.
+  #%]
+
 This email would have contained sensitive information, but you have not set
 a PGP/GPG key or SMIME certificate in the "Secure Mail" section of your user
 preferences.
@@ -13,5 +21,5 @@ You can see this bug's current state at:
 [%+ urlbase %]show_bug.cgi?id=[% bug_id %]
 [% END %]
 [% ELSIF email_type == 'admin' %]
-You will have to contact [% maintainer %] to reset your password.
+You will have to contact servicedesk@mozilla.com to reset your password.
 [% END %]

diff --git a/template/en/default/admin/users/userdata.html.tmpl b/template/en/default/admin/users/userdata.html.tmpl
index a455ef84b00d013a6dfff7b65e653bc99a5b0d1d..449a1b1433201e8691be9f8097bb3aff0f472ba4 100644 (file)
--- a/template/en/default/admin/users/userdata.html.tmpl
+++ b/template/en/default/admin/users/userdata.html.tmpl
@@ -126,7 +126,7 @@
     <tr>
       <th><label for="mfa">Two-factor Auth:</label></th>
       <td>
-        [% IF user.in_group('admin') %]
+        [% IF user.in_group('bz_can_disable_mfa') %]
           [% IF otheruser.mfa %]
             <select name="mfa" value="mfa">
               <option value="">Disable</option>

diff --git a/template/en/default/global/user-error.html.tmpl b/template/en/default/global/user-error.html.tmpl
index 66573ecb198743f6df3d1bb0c344c10011965e9d..6996832aa0753a312cd9a37d5881d7e0d3d88ac4 100644 (file)
--- a/template/en/default/global/user-error.html.tmpl
+++ b/template/en/default/global/user-error.html.tmpl
@@ -1220,6 +1220,10 @@
     <br>
     The QR code has been deleted - please generate and scan a new code.
 
+  [% ELSIF error == "mfa_disable_denied" %]
+    [% title = "Change Denied" %]
+    You do not have permission to disable MFA for other users.
+
   [% ELSIF error == "migrate_config_created" %]
     The file <kbd>[% file FILTER html %]</kbd> contains configuration
     variables that must be set before continuing with the migration.