[5.x] Always allow the captive page and captive.validate task even with PW reset requested

[zero-24]

Summary of Changes

Always allow the captive page and captive.validate task even with PW reset requested. I'm not 100% sure whether its a good way to put the code here but on the first look it looks ok and fixes the issue.

Testing Instructions

• Install 5.4.0rc2
• create secondary user within the "administrator" group
• force the user to reset his PW and set an inital PW
• force the administrator group to setup mfa (Users -> Manage -> Options -> Multi-factor Authentication)
• login with that secondary user
• setup mfa
• try to do the next step

Actual result BEFORE applying this Pull Request

endless loop as joomla wants you to fill the captive page and reset your PW at the same time

Expected result AFTER applying this Pull Request

first joomla will allow you to fill the mfa captcha after that it will force you to reset your PW.

Link to documentations

Please select:

• Documentation link for docs.joomla.org:

• No documentation changes for docs.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed

[muhme]

I have tested with 5.4-dev this item ✅ successfully on afec998

* Saw the problem 'The page isn’t redirecting properly'

• (Restarting the web server or browser was not enough to get rid of the redirect, I solved by using another browser)
• Applied the PR with Patch Tester, login with password, set-up 2nd factor and reset password is possible now, logout and login again successfully with booth users
• Created 3rd Administrator user without forces password to be reset -> forced to set-up Multi-Factor, logout, login again with password and passkey, logout and login with passkey and password
• Created 4th user editor and logged in on frontend

  ---

  _{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46247.}

[exlemor]

I have tested this item ✅ successfully on afec998

I have successfully tested this! Thanks @zero-24, I would never have found this bug - great job that you did!

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46247.}

[muhme]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46247.}

[joomdonation]

I haven't had a chance to check the details yet, but maybe we should check to see why we could not use existing code to bypass password reset check for these pages?

• For admin, the available code is https://github.com/joomla/joomla-cms/blob/5.4-dev/libraries/src/Application/AdministratorApplication.php#L192
• For site, the available code is https://github.com/joomla/joomla-cms/blob/5.4-dev/libraries/src/Application/SiteApplication.php#L256

[richard67]

Back to pending. @zero-24 Could you check @joomdonation 's suggestion?

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46247.}

[zero-24]

I have just tested and implemented the requested changes from @joomdonation Looks like the Backend was not tested when the PR was introduced and by that the task was missing and the view was an invalid view that we dont have within com_users, both fixed now.

[richard67]

@muhme @exlemor Could you test again with the latest change when you find some time? Thanks in advance.

[exlemor]

I have tested this item ✅ successfully on 88d9350

I have re-tested this PR successfully. Thanks @zero-24.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46247.}

[muhme]

I have tested this item ✅ successfully on 88d9350

Retested with JBT and graft PRs full package, used Passkey as second factor, on backend and frontend

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46247.}

[muhme]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46247.}

[zero-24]

Thanks to the testers and @joomdonation for the tip with that array 👍

[joomdonation]

Thanks to the testers and @joomdonation for the tip with that array 👍

Thanks for checking the suggestion and fixing the issue in the right way.

[richard67]

Thanks @zero-24 for that bug fix, @joomdonation for the suggested changes, and @exlemor and @muhme for testing.