Move permission checks for Multifactor forms into checkPermissions()

This avoids issues with requestReauthentication() being called for guests.

I verified that none of the actual processing happens before the
checkPermissions() check.

diff --git a/wcfsetup/install/files/lib/form/MultifactorDisableForm.class.php b/wcfsetup/install/files/lib/form/MultifactorDisableForm.class.php
index 53d31bc8028eb97f25eb782f927365d2d6cc8943..ece4900831e88cbb9e7494126ed5e40db2d586ef 100644 (file)
--- a/wcfsetup/install/files/lib/form/MultifactorDisableForm.class.php
+++ b/wcfsetup/install/files/lib/form/MultifactorDisableForm.class.php
@@ -71,6 +71,13 @@ class MultifactorDisableForm extends AbstractFormBuilderForm {
                $this->setup = $this->setups[$_GET['id']];
                $this->method = $this->setup->getObjectType();
                \assert($this->method->getDefinition()->definitionName === 'com.woltlab.wcf.multifactor');
+       }
+       
+       /**
+        * @inheritDoc
+        */
+       public function checkPermissions() {
+               parent::checkPermissions();
                
                $this->requestReauthentication(LinkHandler::getInstance()->getControllerLink(static::class, [
                        'object' => $this->setup,

diff --git a/wcfsetup/install/files/lib/form/MultifactorManageForm.class.php b/wcfsetup/install/files/lib/form/MultifactorManageForm.class.php
index 86a3ae74074a1cc91af4605ffe5ae0686831f24d..525563eb8d28efc89111fe33b36ea94a4e80af1a 100644 (file)
--- a/wcfsetup/install/files/lib/form/MultifactorManageForm.class.php
+++ b/wcfsetup/install/files/lib/form/MultifactorManageForm.class.php
@@ -87,6 +87,13 @@ class MultifactorManageForm extends AbstractFormBuilderForm {
                $this->method = $objectType;
                $this->processor = $this->method->getProcessor();
                $this->setup = Setup::find($this->method, WCF::getUser());
+       }
+       
+       /**
+        * @inheritDoc
+        */
+       public function checkPermissions() {
+               parent::checkPermissions();
                
                $this->requestReauthentication(LinkHandler::getInstance()->getControllerLink(static::class, [
                        'object' => $this->method,