Fix redirect loop caused when both 2fa and password change are forced (…

…#3787)
pretix · Dec 29, 2023 · fabe476 · fabe476
1 parent 3101660
commit fabe476
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/pretix/control/middleware.py b/src/pretix/control/middleware.py
@@ -139,7 +139,7 @@ def __call__(self, request):
             return redirect_to_url(reverse('control:user.settings') + '?next=' + quote(request.get_full_path()))
 
         if not request.user.require_2fa and settings.PRETIX_OBLIGATORY_2FA \
-                and url_name not in self.EXCEPTIONS_2FA:
+                and url_name not in self.EXCEPTIONS_2FA and not request.user.needs_password_change:
             return redirect_to_url(reverse('control:user.settings.2fa'))
 
         if 'event' in url.kwargs and 'organizer' in url.kwargs: