disable admin features unless 2FA configured

2022-12-19 20:57:20 +02:00 · 2022-12-19 20:57:20 +02:00 · ecb3ee52b4
parent ab2889e3c3
commit ecb3ee52b4
1 changed files with 1 additions and 0 deletions
--- a/files/routes/wrappers.py
+++ b/files/routes/wrappers.py
@ -112,6 +112,7 @@ def admin_level_required(x):
 		def wrapper(*args, **kwargs):
 			v = get_logged_in_user()
 			if not v: abort(401)
+			if not v.mfa_secret: abort(403, "You need to enable 2FA to use admin features!")
 			if v.admin_level < x: abort(403)
 			return make_response(f(*args, v=v, **kwargs))