tfa 7.x-2.4 | Drupal.org

This is a non-production site

- Drupal Core Drupal CMS puts the power of Drupal into the hands of marketers, designers and content creators
- Drupal CMS Drupal CMS puts the power of Drupal into the hands of marketers, designers and content creators
- Drupal AI Open limitless possibilities with Drupal AI
- Case Studies Powerful stories that show Drupal solutions in the real world
- Drupal for Government Drupal is the open-source CMS that enables digital transformation of government and increases citizen engagement
- Drupal for Higher Education See why 70% of the world's leading universities chose Drupal
- Drupal for Nonprofit See why Drupal is the open-source CMS choice for some of the world’s most influential nonprofits
- Drupal for eCommerce Natively integrate content and commerce
- Drupal for FinTech Secure and trustworthy FinTech infrastructure
- Drupal for Healthcare Drupal powers systems that are secure, patient-centric and engaging
- Drupal for Media & Publishing Create engaging multi-channel experiences to connect with your audiences - everywhere
- Download Drupal Download Drupal and the extensions you need
- Documentation Full knowledgebase including Drupal 7 resources
- Getting Started Guide to installing Drupal on a server
- Local Development Guide Guide to installing Drupal locally with Docker and DDEV
- Developer Resources Step-by-step guide for learning Drupal
- Drupal User Guide Learn to build with Drupal
- API Complete documentation of Drupal Core APIs
- Modules Extend your project's functionality
- Themes Change your project's look and feel
- Distributions Jumpstart your project with a pre-configured install
- Issues Queue Report issues and contribute improvements
- Security Advisories Stay on top of the latest security alerts and updates
- Find a Drupal Certified Partner Connect with the best Drupal agencies around the world
- Become an Drupal Certified Partner Join an elite network of agencies committed to Drupal excellence and innovation
- Find a Hosting Provider Find a hosting provider for your Drupal project
- Find a Migration Partner Get help with your migration to the latest version of Drupal
- Find Training Upskill your Drupal team
- Drupal Steward Ensure your website is protected with Drupal Steward
- About the Community Come for the code, stay for the community
- How to Contribute Get involved in growing and evolving Drupal
- DrupalCon DrupalCon unites experts from around the globe who create ambitious digital experiences. Network, learn, and be inspired
- Events Discover local events, meet-ups, and training
- Jobs / Careers Find opportunities to work in Drupal
- News & Blogs News and stories about Drupal
- Forum Got a question about Drupal? Find answers on the Drupal forums
- Slack Get support and communicate with the global Drupal community
- Newsletters Sign up for Drupal news and manage your subscriptions
- Drupal Swag Shop Get your Drupal branded merch!
- The Drupal Association Learn how we support Drupal's growth and innovation - and how you can help
- Become a Member Become a Ripplemaker and support the Drupal Association
- Become a Drupal Certified Partner Join an elite network of agencies committed to Drupal excellence and innovation
- Donate Make a donation to the nonprofit that supports Drupal
- Log in
- Create account
- Try Drupal CMS
- Try hosting

Posted by poker10 on October 2, 2024 at 2:24pm

Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043.

Changes since 7.x-2.3:

Regenerate the session before displaying the TFA form
#2656746 by damienmckenna, michaelmol, poker10: Check if Help module is enabled
#3436886 by poker10: Add GitLab CI D7
#3436885 by poker10: Creation of dynamic property TfaTestCase::$web_user is deprecated
#2694723 by nullkernel, junaidpv, Leeteq: Maintenance mode blocks TOTP TFA entry

VCS Label

7.x-2.4

Core compatibility

Release type

Security update

Packaged Git sha1

fc54c7e15daf16a962d6ccd436d8e11ccb340d53

Release files

36f2cf73c0ecbbf0345f1565429f1fcb

Release file SHA-1 hash

51e995c6c40bbc66e206b257ce6bdf73f3fbe991

Release file SHA-256 hash

6113a4198c423515251f08426402cd1813f78bf304f66a4e3b72a4b3078406ed

7230a97546a4719137d3b0d532ac5c4b

Release file SHA-1 hash

36b85c7ff58555727205dbb0704b3b3f725a68e9

Release file SHA-256 hash

4070a228ff0d35455fa0ea44c5e8163292911b0b6a577329f3beee87d141e698