fix cancel MFA: the secret needs to be reset too

2019-12-29 15:32:27 +01:00 · 2019-12-29 15:32:27 +01:00 · b51ed259b4
parent f46f2fd7f6
commit b51ed259b4
1 changed files with 1 additions and 0 deletions
--- a/app/dashboard/views/mfa_cancel.py
+++ b/app/dashboard/views/mfa_cancel.py
@ -27,6 +27,7 @@ def mfa_cancel():

        if totp.verify(token):
            current_user.enable_otp = False
+            current_user.otp_secret = None
            db.session.commit()
            flash("MFA is now disabled", "warning")
            return redirect(url_for("dashboard.index"))