SudoModeService check failed response is ambiguous.

[n8-dev]

Module version(s) affected

5.4

Description

AdminRegistrationController::startRegistration() performs a sudo mode check.

However when this fails the response is Invalid session. Please refresh and try again.

That's not really a helpful response message when the check is all around sudo mode

Please refresh may fix it, but then you might get the message again if you didn't enable sudo mode at all

How to reproduce

I tried to enable MFA on a user that already existing on a site.

1. Set SS_MFA_SECRET_KEY="foobar"
2. Set up an additional user (User2) (follow all sign up processes, enable MFA on other user etc)
3. Log out of all users
4. Simulate a hosting platform change that looses the SS_MFA_SECRET_KEY by fully commenting it out of your .env and clearing all caches
5. Attempt to log in as User2 – MFA failure should happen – expecting This authentication method is unavailable
6. Now log in as the admin account that doesn't have MFA.
7. Navigate to user security area
8. Do not action the sudo mode
9. Attempt to edit the details on the User2 around MFA and save
10. Expecting to see Invalid session. Please refresh and try again.

Possible Solution

Update message to mention sudo mode.

Additional Context

No response

Validations

• Check that there isn't already an issue that reports the same bug
• Double check that your reproduction steps work in a fresh installation of silverstripe/installer (with any code examples you've provided)

[GuySartorelli]

Please add more fidelity to the reproduction steps. There's multiple ways to add MFA to a user (when logging in, and when visiting the member profile), it's not clear at what point you get the failure message, etc. I can't reproduce (and therefore can't fix) this without clear step-by-step instructions.

[n8-dev]

@GuySartorelli Updated with clarity.

[GuySartorelli]

Attempt to edit the details on the User2 around MFA and save

Can you please give me a screenshot of this? For example what I see looks like this:

It's completely read-only, so there is no way to attempt to edit any details until you verify with sudo mode.