relax mfa checks on service endpoints

This commit is contained in:
Mike Macgirvin 2024-06-12 09:30:07 +10:00
parent 0524ca1702
commit 5cde03fa49

View file

@ -71,7 +71,8 @@ function authenticate_success($user_record, $channel = false, $login_initial = f
// might want to log success here
}
if ($_SESSION['2FA_REQUIRED'] && !$_SESSION['2FA_VERIFIED'] && App::$module !== 'totp_check') {
if ($_SESSION['2FA_REQUIRED'] && !$_SESSION['2FA_VERIFIED']
&& !in_array(App::$module, ['totp_check', 'dav', 'cdav', 'api', 'addressbook', 'calendar'], true)) {
goaway(z_root() . '/totp_check');
}