Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-83692

MFA SMS factor secret validity duration is forced to zero

XMLWordPrintable

    • MOODLE_405_STABLE
    • MDL-83692-405
    • MDL-83692-main
    • Hide

      Testing Instructions

      Test 1 - Settings - Fresh Moodle instance

      1. Create a fresh Moodle instance
      2. Apply the patch
      3. Go to the installation process.
      4. Access to Site admin / Plugins / Multi-factor authentication / SMS settings. 
      5. Confirm all settings are displayed and you see the following values:
        • Factor weight = 100
        • Secret validity duration = 30 Minutes
      6. Confirm you see the following notification banner: 
      7. Access to Site admin / Plugins SMS / SMS gateways, and create a new SMS gateway for testing.
      8. Access to Site admin / Plugins / Multi-factor authentication / SMS, settings and confirm you don't see the banner from step 6

      Test 2 - MFA Preferences

      1. Access to Site admin / Plugins / Multi-factor authentication / SMS / settings
      2. Enable the factor and select "SMS gateway" created in previous test. 
      3. Enable MFA plugin at Site admin / Plugins / Multi-factor authentication
      4. Access from your user profile to "Preferences / Multi-factor authentication preferences" and confirm you see the SMS factor 
      5. Access to Site admin / Plugins / Multi-factor authentication / SMS / settings and select "None" in "SMS gateway". 
      6. Access from your user profile to "Preferences / Multi-factor authentication preferences" and confirm you don't see the SMS factor.

      Test 1 - Settings - Update Moodle instance

      1. Before apply the patch, in your current Moodle instance, access to Site admin / Plugins / Multi-factor authentication / SMS settings. 
      2. Set the "Factor weight" value to '0'
      3. Set the "Secret validity duration"  to '0'
      4. Apply the patch
      5. Go to the update process.
      6. Access to Site admin / Plugins / Multi-factor authentication / SMS settings. 
      7. Confirm all settings are displayed and you see the following values:
        • Factor weight = 100
        • Secret validity duration = 30 Minutes

       

      NOTE: If you mess things up and locked yourself out, you can disable the whole MFA plugin from the CLI:

      php admin/cli/cfg.php --component=tool_mfa --name=enabled --set=0
      Show
      Testing Instructions Test 1 - Settings - Fresh Moodle instance Create a fresh Moodle instance Apply the patch Go to the installation process. Access to Site admin / Plugins / Multi-factor authentication / SMS settings.  Confirm all settings are displayed and you see the following values: Factor weight = 100 Secret validity duration = 30 Minutes Confirm you see the following notification banner:  To use SMS as an authentication factor, you first need to  set up an SMS gateway . Access to Site admin / Plugins SMS / SMS gateways, and create a new SMS gateway for testing. Access to Site admin / Plugins / Multi-factor authentication / SMS, settings and confirm you don't see the banner from step 6 Test 2 - MFA Preferences Access to Site admin / Plugins / Multi-factor authentication / SMS / settings Enable the factor and select "SMS gateway" created in previous test.  Enable MFA plugin at Site admin / Plugins / Multi-factor authentication Access from your user profile to "Preferences / Multi-factor authentication preferences" and confirm you see the SMS factor  Access to Site admin / Plugins / Multi-factor authentication / SMS / settings and select "None" in "SMS gateway".  Access from your user profile to "Preferences / Multi-factor authentication preferences" and confirm you don't see the SMS factor. Test 1 - Settings - Update Moodle instance Before apply the patch, in your current Moodle instance, access to Site admin / Plugins / Multi-factor authentication / SMS settings.  Set the "Factor weight" value to '0' Set the "Secret validity duration"  to '0' Apply the patch Go to the update process. Access to Site admin / Plugins / Multi-factor authentication / SMS settings.  Confirm all settings are displayed and you see the following values: Factor weight = 100 Secret validity duration = 30 Minutes   NOTE :  If you mess things up and locked yourself out, you can disable the whole MFA plugin from the CLI : php admin/cli/cfg.php --component=tool_mfa --name=enabled --set=0
    • Hide

      Code verified against automated checks.

      Checked MDL-83692 using repository: https://github.com/raortegar/moodle.git

      More information about this report

      Built on: Fri Mar 14 01:47:13 UTC 2025

      Show
      Code verified against automated checks. Checked MDL-83692 using repository: https://github.com/raortegar/moodle.git MOODLE_405_STABLE (0 errors / 0 warnings) [branch: MDL-83692-405 | CI Job ] main (0 errors / 0 warnings) [branch: MDL-83692-main | CI Job ] More information about this report Built on: Fri Mar 14 01:47:13 UTC 2025
    • Show
      Launching automatic jobs for branch MDL-83692 -405 https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/18586/ PHPUnit (sqlsrv) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/63679/ Behat (NonJS - boost and classic) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/63680/ Behat (Firefox - boost) Launching automatic jobs for branch MDL-83692 -main https://ci.moodle.org/view/Testing/job/DEV.02%20-%20Developer-requested%20PHPUnit/18587/ PHPUnit (sqlsrv) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/63681/ Behat (NonJS - boost and classic) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/63682/ Behat (Firefox - boost) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/63683/ Behat (Firefox - classic) https://ci.moodle.org/view/Testing/job/DEV.01%20-%20Developer-requested%20Behat/63684/ App tests (stable app version) Built on: Fri Mar 14 02:25:19 UTC 2025
    • 2
    • Team Hedgehogs 2025 Sprint 1.2, Team Hedgehogs 2025 Sprint 1.3, Team Hedgehogs 2025 Sprint 1.4

      After a fresh install, the MFA secret validity is forced to zero (it should be 30 as per the default value) and it might break the SMS factor integration with any gateway provider. I believe its a regression from SMS gateway MVP or might be already an existing issue with admin settings api.

        1. (1) 6 Passed -- (Main)MDL-83692.png
          (1) 6 Passed -- (Main)MDL-83692.png
          89 kB
        2. (1) 8 Passed -- (Main)MDL-83692.png
          (1) 8 Passed -- (Main)MDL-83692.png
          78 kB
        3. (2) 4 Passed -- (Main)MDL-83692.png
          (2) 4 Passed -- (Main)MDL-83692.png
          67 kB
        4. (2) 6 Passed -- (Main)MDL-83692.png
          (2) 6 Passed -- (Main)MDL-83692.png
          54 kB
        5. (3) 7 Passed -- (Main)MDL-83692.png
          (3) 7 Passed -- (Main)MDL-83692.png
          82 kB
        6. after.png
          after.png
          62 kB
        7. before.png
          before.png
          59 kB
        8. can-enable.png
          can-enable.png
          41 kB
        9. Screenshot from 2025-03-11 14-32-01.png
          Screenshot from 2025-03-11 14-32-01.png
          119 kB
        10. sms-enabled-bug.png
          sms-enabled-bug.png
          244 kB

            raquel.ortega@moodle.com Raquel Ortega
            safat.shahin@moodle.com Safat Shahin
            David Woloszyn David Woloszyn
            Jun Pataleta Jun Pataleta
            Kim Jared Lucas Kim Jared Lucas
            Votes:
            1 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved:

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 1 day, 6 hours, 24 minutes
                1d 6h 24m

                  Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.