Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[hold for payment 2024-09-10] [$250] Require a 2FA code to disable 2FA #48215

Closed
tgolen opened this issue Aug 28, 2024 · 17 comments
Closed

[hold for payment 2024-09-10] [$250] Require a 2FA code to disable 2FA #48215

tgolen opened this issue Aug 28, 2024 · 17 comments
Assignees
@tgolen @parasharrajat @joekaufmanexpensify
Labels
Bug Something is broken. Auto assigns a BugZero manager. Engineering Internal Requires API changes or must be handled by Expensify staff Reviewing Has a PR in review Weekly KSv2

Comments

@tgolen
Copy link
Contributor

tgolen commented Aug 28, 2024 •
edited
Loading

Problem

Users can disable 2FA without entering a 2FA code.

Why this is important to solve?

It is a security risk. If someone can get your authToken, then they can disable your 2FA and keep access to your account.

Solution

When 2FA settings are disabled, we need to prompt the user to enter a valid 2FA code and validate it.

I already have a PR written for this, so it doesn't need a contributor but I do need a C+ to review it which is why I am creating this issue.

Upwork Automation - Do Not Edit
  • Upwork Job URL: https://www.upwork.com/jobs/~010c8f7bf5820798ba
  • Upwork Job ID: 1828889567388062710
  • Last Price Increase: 2024-08-28
Issue OwnerCurrent Issue Owner: @parasharrajat
@tgolen tgolen added External Added to denote the issue can be worked on by a contributor Engineering Daily KSv2 Bug Something is broken. Auto assigns a BugZero manager. labels Aug 28, 2024
@tgolen tgolen self-assigned this Aug 28, 2024
@melvin-bot melvin-bot bot changed the title Require a 2FA code to disable 2FA [$250] Require a 2FA code to disable 2FA Aug 28, 2024
@melvin-bot Melvin Bot
Copy link

melvin-bot bot commented Aug 28, 2024

Job added to Upwork: https://www.upwork.com/jobs/~010c8f7bf5820798ba

@melvin-bot melvin-bot bot added the Help Wanted Apply this label when an issue is open to proposals by contributors label Aug 28, 2024
@melvin-bot Melvin Bot
Copy link

melvin-bot bot commented Aug 28, 2024

Triggered auto assignment to @joekaufmanexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

@melvin-bot Melvin Bot
Copy link

melvin-bot bot commented Aug 28, 2024

Triggered auto assignment to Contributor-plus team member for initial proposal review - @parasharrajat (External)

@joekaufmanexpensify joekaufmanexpensify removed the Help Wanted Apply this label when an issue is open to proposals by contributors label Aug 28, 2024
@joekaufmanexpensify
Copy link
Contributor

@tgolen is the PR for this one already in review? If so, mind linking it to the issue so I can follow along?

@tgolen
Copy link
Contributor Author

tgolen commented Aug 29, 2024

Oops, sorry! Here it is: #48030

@tgolen tgolen added Internal Requires API changes or must be handled by Expensify staff and removed External Added to denote the issue can be worked on by a contributor labels Aug 29, 2024
@joekaufmanexpensify
Copy link
Contributor

All good. TY!

@joekaufmanexpensify
Copy link
Contributor

PR still in review

@joekaufmanexpensify
Copy link
Contributor

PR merged!

@melvin-bot melvin-bot bot added the Overdue label Sep 2, 2024
@joekaufmanexpensify joekaufmanexpensify added Reviewing Has a PR in review Weekly KSv2 and removed Daily KSv2 Overdue labels Sep 2, 2024
@tgolen
Copy link
Contributor Author

tgolen commented Sep 6, 2024

I'm gonna close this out since it was deployed to production.

@tgolen tgolen closed this as completed Sep 6, 2024
@joekaufmanexpensify
Copy link
Contributor

Ah, I think we still need to pay @parasharrajat for his review here.

@joekaufmanexpensify
Copy link
Contributor

@tgolen @parasharrajat was #48461 a regression introduced by the PR here? Seems like yes, but curious if that is correct?

@joekaufmanexpensify joekaufmanexpensify changed the title [$250] Require a 2FA code to disable 2FA [hold for payment 2024-09-10] [$250] Require a 2FA code to disable 2FA Sep 9, 2024
@joekaufmanexpensify
Copy link
Contributor

Bumped in Slack here.

@parasharrajat
Copy link
Member

yes, it seems that we missed in the PR.

@joekaufmanexpensify
Copy link
Contributor

Got it, thank you for confirming. Only payment here then is $125 to @parasharrajat for C+ review via NewDot (50% penalty for regression)!

@joekaufmanexpensify
Copy link
Contributor

Feel free to request payment whenever you're ready @parasharrajat , otherwise closing this for now!

@parasharrajat
Copy link
Member

Payment requested as per #48215 (comment)

@JmillsExpensify
Copy link

$125 approved for @parasharrajat

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tgolen tgolen

@parasharrajat parasharrajat

@joekaufmanexpensify joekaufmanexpensify

Labels
Bug Something is broken. Auto assigns a BugZero manager. Engineering Internal Requires API changes or must be handled by Expensify staff Reviewing Has a PR in review Weekly KSv2
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@JmillsExpensify @tgolen @parasharrajat @joekaufmanexpensify