From 0d18d5bfe917be5911d7884d62d9045a69328b80 Mon Sep 17 00:00:00 2001 From: jelveh Date: Thu, 16 Jul 2026 19:46:41 -0700 Subject: [PATCH] fix: sync window.user.otp when enabling 2FA from the Dashboard The disable path clears window.user.otp (in UIWindowDisable2FA), but the enable path updated only the card's DOM, never the in-memory flag. TabSecurity html() reads user.otp to decide the toggle/badge state, so after enabling 2FA a re-render of the Security tab from the cached window.user showed it as disabled for an account that actually had 2FA on. Set window.user.otp = enabling on success so both directions stay consistent. --- src/gui/src/UI/Dashboard/TabSecurity.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/gui/src/UI/Dashboard/TabSecurity.js b/src/gui/src/UI/Dashboard/TabSecurity.js index 8acd7358d..c45f365f9 100644 --- a/src/gui/src/UI/Dashboard/TabSecurity.js +++ b/src/gui/src/UI/Dashboard/TabSecurity.js @@ -155,6 +155,11 @@ const TabSecurity = { return; } + // Keep the in-memory flag in sync so a later re-render reflects the + // real 2FA state. The disable dialog already clears window.user.otp; + // the enable path never set it, so the two directions disagreed. + if ( window.user ) window.user.otp = enabling; + const $card = $el_window.find('.dashboard-section-security .dashboard-settings-card-2fa'); if ( enabling ) { $el_window.find('.dashboard-section-security .user-otp-state').text(i18n('two_factor_enabled'));