Making WordPress.org

Opened 5 months ago

Last modified 5 days ago

#7704 new enhancement

Release Confirmation should use 2FA for access

Reported by: dd32's profile dd32 Owned by:
Milestone: Priority: high
Component: Plugin Directory Keywords: has-patch
Cc:

Description

If an account has Two Factor enabled on their account, Release Confirmation should require revalidating their 2FA prior to confirming the release.

To streamline things, if the user has Two Factor enabled, an emailed link should not be required either. ie. They should be able to re-validate their 2FA to access the confirm button.

Change History (7)

This ticket was mentioned in PR #344 on WordPress/wordpress.org by @dd32.


5 months ago
#1

  • Keywords has-patch added

When a user has 2FA setup, we should rely upon that instead of email.

This is more secure, and for those who are using Keys, likely more streamlined.

This is a work in progress, and requires a few more steps.

See https://meta.trac.wordpress.org/ticket/7704

#2 @dd32
5 months ago

In 13929:

Plugin Directory: Release Confirmation: Rename a function to make it clearer it's purpose.

See https://github.com/WordPress/wordpress.org/pull/344.
See #7704.

#3 @dd32
5 months ago

In 13930:

Plugin Directory: Release Confirmation: Simplify the UI by moving the page-headers to the shortcode.

See https://github.com/WordPress/wordpress.org/pull/344.
See #7704.

#4 @dd32
5 months ago

In 13931:

Plugin Directory: Release Confirmation: Move the front-end notice logic from the theme to the Shortcode.

See https://github.com/WordPress/wordpress.org/pull/344.
See #7704.

@dd32 commented on PR #344:


5 months ago
#5

Rather than having a prompt to 2FA, this would be better implemented if the buttons were just shown as clickable, but upon click the JS handler for revalidation prompted it at that point.

#6 @dd32
4 months ago

In 13933:

Plugin Directory: Allow plugin reviewers to force approve releases.

This was broken in [13931].

See #7704.

#7 @dd32
5 days ago

In 14245:

Plugin Directory: Replace button markup with the new button classes.

This resolves the buttons being dark-text-on-dark-background when in a visited state.

See #7704.

Note: See TracTickets for help on using tickets.