Backend password confirmation issue

[fhamelin]

The backend password confirmation when navigating in the Admin tools section does not work if failedTries is set to 0 or the number of failed tries is over this setting.

Process

1. Navigate to Admin Tools > Settings. You will be prompted with a "Confirm with user password" modal.
2. If your failedTries setting is not 0, type as many wrong passwords as needed to get a captcha
3. Type your password

Expected result

Password is confirmed and the Settings page appears.

Current result

Invalid password

Possible Fix

• In the authUser() function of the CaptchaService class, validate that $this->login['status'] != 'sudo-mode' before validating the captcha response
  Or
• Add a captcha to the "Confirm with user password" modal

[dieMelanie]

Created internal ticket for this (sorry for the delay)