diff --git a/SciPost_v1/urls.py b/SciPost_v1/urls.py index 0738a0e6c158e517993107ee1700e08cd364788d..cada26ad30bb060a8bcf07f5bc5120b11c92131f 100644 --- a/SciPost_v1/urls.py +++ b/SciPost_v1/urls.py @@ -3,6 +3,7 @@ __license__ = "AGPL v3" from django.conf import settings +from django.contrib.auth.decorators import login_required from django.conf.urls import include, url from django.conf.urls.static import static from django.contrib import admin @@ -28,7 +29,8 @@ router.register(r'news', NewsItemViewSet) router.register(r'conflicts', ConflictOfInterestViewSet) router.register(r'publications/GoogleScholar', PublicationViewSetForGoogleScholar) - +# Disable admin login view which is essentially a 2FA workaround. +admin.site.login = login_required(admin.site.login) # Base URLs urlpatterns = [ diff --git a/scipost/totp.py b/scipost/totp.py index 7beecf397af9bee7f5a6088d189fe5e372c2bdb8..b224bfa6cc7d9fdcd70aec67d53a37df483679b4 100644 --- a/scipost/totp.py +++ b/scipost/totp.py @@ -43,6 +43,7 @@ class TOTPVerification: # 1. Check if the current counter is higher than the value of last verified counter # 2. Check if entered token is correct valid_token = totp.verify(code, for_time=time_int, valid_window=self.tolerance) + if not valid_token: # Token not valid continue