From bfbd970f3b82624d625d296a8701fa1f12cb802f Mon Sep 17 00:00:00 2001 From: Erik Thiele Date: Fri, 10 Jul 2026 15:33:37 +0200 Subject: [PATCH] Fix: Passwort-Reset deaktiviert jetzt auch MFA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Beim Admin-Passwort-Reset werden mfa_enabled, mfa_secret, mfa_recovery_codes und trusted_devices zurückgesetzt. --- app.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/app.py b/app.py index f2b7d31..64def12 100755 --- a/app.py +++ b/app.py @@ -1922,8 +1922,12 @@ def admin_users_reset_password(email): temp_password = secrets.choice(string.ascii_lowercase) + secrets.choice(string.ascii_uppercase) + secrets.choice(string.digits) + secrets.token_hex(4) users[email]["password_hash"] = generate_password_hash(temp_password) users[email]["must_change_password"] = True + users[email]["mfa_enabled"] = False + users[email]["mfa_secret"] = "" + users[email]["mfa_recovery_codes"] = [] + users[email]["trusted_devices"] = [] save_users(users) - add_history_entry("user_password_reset", f"Passwort für User '{email}' zurückgesetzt", current_user.email) + add_history_entry("user_password_reset", f"Passwort für User '{email}' zurückgesetzt (MFA deaktiviert)", current_user.email) return redirect(f"/admin/users?reset={email}&temp={temp_password}")