Clicking any link while on 2FA-Input in Customer-Account will just let you in

[tobihille]

Serios security issue!

Way to reproduce:

1. Login
2. Click on "Back" or "Account > My Account"
3. You're in now

[avoelkl]

The two factor authentication for customers is not production ready yet, there's some more to do. Thanks for pointing that out.

[tobihille]

I think i fixed it, but it's very experimental, please test extensively before merging.
Just hacked it on a (hopefully) bright moment between MM15DE and aftershow party.
Branch: https://github.com/magento-hackathon/Magento-Two-factor-Authentication/tree/TFA_Customer

[avoelkl]

Hi Tobi,

I tried your fix and merged it with the latest changes, but it did not work.
I pushed it to the TFA_Customer branch if you want to have a look at it again.

lg Anna

[tobihille]

Hi,

tanks for the info. Will have a look again later. Currently I'm working on a Test-Framework based on Xtest, this task is taking all my free time atm ;-)

• Tobi