We use a theme we have cloned from boost. While implementing a theme based version of drawers.php there was an error, when calling following pages.

• admin/tool/mfa/user_preferences.php
• admin/tool/mfa/action.php?factor=sms&action=manage
• admin/tool/mfa/action.php?factor=webauthn&action=replace
• admin/tool/mfa/action.php?factor=webauthn&action=setup

Same error occurs, when a user failed finally to authenticate using multifactor authentication.

The error disappears, when we remove the line:

global $OUTPUT; 

from our cloned drawers.php.

We understand that this line may not be used but like to suggest following changes:

Proposal:

I'd like to suggest not to use

$OUTPUT = $PAGE->get_renderer('tool_mfa');

(in upper chars) although it is technically not a problem in the most cases, because a plugin renderer may call the relevant methods of the core_renderer.

There is one place in tool_mfa where the global $OUTPUT object is really been overwritten (admin/tool/mfa/classes/manager.php::display_debug_notification()), what might have been avoided, when

$output = $PAGE->get_renderer('tool_mfa'); 

(in lower chars) is used as suggested here: https://moodledev.io/docs/4.4/apis/subsystems/output

And there is another place, where the plugin renderer is initialized twice  (admin/tool/mfa/user_preferences.php)