2-Factor Authentication not Working After Upgrade to 4.9.3

[stresbiz]

After upgrading phpmyadmin to version 4.9.3, we are no longer prompted for Google's 2-factor authentication, after logging in. We've disabled, and re-enabled the 2FA multiple times. Cleared cache and tried a number of things, but we can't seem to get back the 2FA prompt. We haven't had this issue before, when upgrading to other versions.

[williamdes]

Thank you for the report @stresbiz
Can you send the php version ?

[stresbiz]

PHP 7.3.11 (cli)

[williamdes]

@stresbiz how did you install phpMyAdmin ?

[stresbiz]

We typically replace all phpMyAdmin files directly through FTP, and then copy our config.inc.php settings.

[williamdes]

Okay, thank you
I will try to reproduce this issue ASAP

[stresbiz]

Thank William!

[williamdes]

@stresbiz Can you try to install 5.0.0 version ?

[stresbiz]

I was just going to say - we tried with the latest 5.0.0 too - same issue. And we've tried both versions (4.9.3 and 5.0.0) on multiple servers.

[williamdes]

@stresbiz Interesting, thank you
If I can reproduce the issue I will fix it on 5.0.1 since 4.9.x are now only for security updates

Can you send php -m output ?

[stresbiz]

php -m

[PHP Modules]
bcmath
bz2
calendar
Core
ctype
curl
date
dom
exif
fileinfo
filter
ftp
gd
gettext
hash
iconv
intl
json
libxml
mbstring
mcrypt
mysqli
mysqlnd
openssl
pcntl
pcre
PDO
pdo_mysql
pdo_sqlite
Phar
posix
readline
Reflection
session
shmop
SimpleXML
sockets
SPL
sqlite3
ssh2
standard
sysvmsg
sysvsem
sysvshm
tokenizer
wddx
xml
xmlreader
xmlwriter
xsl
zip
zlib

[Zend Modules]

[stresbiz]

Please let me know if you can reproduce the issue and what it is. Thanks!

[seattledeveloper]

Hello ... I noticed when upgrading, first to 5.0.0, then downgrading to 4.9.3, that no custom settings were being read in, and the main settings screen says "You have no saved settings!", even though we do have saved settings.

So, neither two-factor auth, or other custom settings are being read in. I only have a few custom saved settings, so I can't vouch for all custom settings, but the few that I have are not being read in. This is occurring in both 4.9.3 and 5.0.0.

Hope this is helpful.

[seattledeveloper]

A bit more information, it seems that two-factor auth is actually removed from the configuration, because once I downgraded back to 4.9.2, it was no longer there.

And, FYI, I sftp the tar.gz file to the server, copy over the config file from a previous version, and just update a symlink. So I can easily move between versions.

[stresbiz]

Thank you for your input seattledeveloper! Hopefully they can fix the issue ASAP.

[raimund-schluessler]

I see the same issue on 5.0.0.

[ghost]

I confirm the same issue. 2fa worked on 4.9.2 but not on 4.9.3 and 5.0.0.

[williamdes]

git bisect said it was introduced by 542ba30

[williamdes]

Hi everyone I found a fix

diff --git a/libraries/classes/TwoFactor.php b/libraries/classes/TwoFactor.php
index 9ac4ee20b5..efdf89b4ce 100644
--- a/libraries/classes/TwoFactor.php
+++ b/libraries/classes/TwoFactor.php
@@ -51,6 +51,10 @@ class TwoFactor
      */
     public function __construct($user)
     {
+        /** @var DatabaseInterface $dbi */
+        global $dbi;
+        $dbi->postConnectControl();
+
         $this->userPreferences = new UserPreferences();
         $this->user = $user;
         $this->_available = $this->getAvailable();

Can you test it ?

[seattledeveloper]

I edited the TwoFactor.php file on the server in the 5.0.0 tree, adding the 3 new lines of code. 2FA is now working again, as verified by 2 different users, and logging in more than once (just to ensure that the configuration didn't go away between the first and second logins).

And, IMHO, it seems that this fix should be added to the 4.9.x tree as well, since this broke a feature that really is security related.

Thanks for taking care of this so quickly!

[williamdes]

@seattledeveloper Thank your for the feedback, the final fix is in #15724
I crafted a short version so you could test it

@thg2k Can you please apply (PR #15724) and let us know if the fix does not break the tree like it did in #15608 ?

For everyone, the fix will go into next 4.9 version (#15724)

[williamdes]

Will be part of 4.9.4+ and 5.0.1+