From f6c1f0f08f031778a491465d35ac694bfcdc12b0 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 1 Aug 2026 01:10:35 +0200 Subject: Require a fresh second factor for user management Administrative actions are gated behind a 30-minute elevation window: creating and retiring accounts, editing roles, clearing a second factor. Reading the list is not gated, and content work is untouched. elevated? is tied to is_admin?, so losing the role closes the window at once. The window opens when the second factor verifies at login, so an admin heading straight for user management is already elevated, and closes on logout with the other session state. Five wrong codes end the session, mirroring the login challenge. users#update carries no elevation filter, since self-service reaches it; the role field is gated in user_params instead and fails closed. --- app/controllers/users_controller.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'app/controllers/users_controller.rb') diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 052b2928..583ebac0 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -7,6 +7,7 @@ class UsersController < ApplicationController before_action :login_required before_action :find_user, :only => [:show, :edit, :update, :reset_otp, :deactivate, :reactivate] before_action :require_admin, :only => [:index, :new, :create, :reset_otp, :deactivate, :reactivate] + before_action :require_elevation, :only => [:new, :create, :reset_otp, :deactivate, :reactivate] before_action :verify_status, :except => [:index] layout 'admin' @@ -87,7 +88,7 @@ class UsersController < ApplicationController :roles => []) # Checkbox arrays post a leading blank from the hidden field. permitted[:roles] = Array(permitted[:roles]).reject(&:blank?) if permitted.key?(:roles) - permitted.delete(:roles) unless current_user.is_admin? + permitted.delete(:roles) unless current_user.is_admin? && elevated? permitted end -- cgit v1.3