discourse

mirror of https://github.com/discourse/discourse.git synced 2025-02-06 03:18:23 +00:00

History

FIX: Do not enforce 2FA for users who are using social logins

Previously, we did not allow setting `enforce_second_factor` to
`all` if any social/external auth providers were enabled for the
site. This was inconsistent, as you could still set it to `staff`,
and lead to a bad experience where since the users were forced to
enable 2FA, they were no longer able to use their social login.

This commit changes things so that:

* If a user only has social/external auth, they will not have 2FA
  enforced even if it is set to all/staff
* We no longer disallow turning on `enforce_second_factor` if
  social/external auth is configured for the site
* We update the site setting description for `enforce_second_factor`
  to reflect this

This way, site admins can enforce 2FA for people who are using
only local logins, and people using social logins can use
2FA on the external site and not need double-2FA on Discourse.

2024-06-12 14:35:57 +10:00

environments

DEV: Catch missing translations during test runs (#26258 )

2024-05-24 22:15:53 +08:00

initializers

DEV: Introduce hidden s3_inventory_bucket site setting (#27304 )

2024-06-10 13:16:00 +08:00

locales

FIX: Do not enforce 2FA for users who are using social logins

2024-06-12 14:35:57 +10:00

application.rb

FEATURE: Add experimental option for strict-dynamic CSP (#25664 )