Fix MFA enforcement on login and page load (#6356)

api4/context.go

@@ -271,9 +271,13 @@ func (c *Context) MfaRequired() {
 			return
 		}
 
+		// Special case to let user get themself
+		if c.Path == "/api/v4/users/me" {
+			return
+		}
+
 		if !user.MfaActive {
-			c.Err = model.NewLocAppError("", "api.context.mfa_required.app_error", nil, "MfaRequired")
-			c.Err.StatusCode = http.StatusUnauthorized
+			c.Err = model.NewAppError("", "api.context.mfa_required.app_error", nil, "MfaRequired", http.StatusForbidden)
 			return
 		}
 	}

api4/user.go

@@ -41,8 +41,8 @@ func InitUser() {
 	BaseRoutes.Users.Handle("/email/verify/send", ApiHandler(sendVerificationEmail)).Methods("POST")
 
 	BaseRoutes.Users.Handle("/mfa", ApiHandler(checkUserMfa)).Methods("POST")
-	BaseRoutes.User.Handle("/mfa", ApiSessionRequired(updateUserMfa)).Methods("PUT")
-	BaseRoutes.User.Handle("/mfa/generate", ApiSessionRequired(generateMfaSecret)).Methods("POST")
+	BaseRoutes.User.Handle("/mfa", ApiSessionRequiredMfa(updateUserMfa)).Methods("PUT")
+	BaseRoutes.User.Handle("/mfa/generate", ApiSessionRequiredMfa(generateMfaSecret)).Methods("POST")
 
 	BaseRoutes.Users.Handle("/login", ApiHandler(login)).Methods("POST")
 	BaseRoutes.Users.Handle("/login/switch", ApiHandler(switchAccountType)).Methods("POST")

webapp/actions/user_actions.jsx

@@ -742,6 +742,12 @@ export function webLogin(loginId, password, token, success, error) {
                 success();
             } else if (!ok && error) {
                 const serverError = getState().requests.users.login.error;
+                if (serverError.server_error_id === 'api.context.mfa_required.app_error') {
+                    if (success) {
+                        success();
+                    }
+                    return;
+                }
                 error({id: serverError.server_error_id, ...serverError});
             }
         }

webapp/components/mfa/components/confirm.jsx

@@ -8,6 +8,8 @@ import React from 'react';
 import {FormattedMessage, FormattedHTMLMessage} from 'react-intl';
 import {browserHistory} from 'react-router/es6';
 
+import {loadMe} from 'actions/user_actions.jsx';
+
 export default class Confirm extends React.Component {
     constructor(props) {
         super(props);
@@ -25,7 +27,9 @@ export default class Confirm extends React.Component {
 
     submit(e) {
         e.preventDefault();
-        browserHistory.push('/');
+        loadMe(() => {
+            browserHistory.push('/');
+        });
     }
 
     onKeyPress(e) {

webapp/package.json

@@ -22,7 +22,7 @@
     "localforage": "1.5.0",
     "marked": "mattermost/marked#8f5902fff9bad793cd6c66e0c44002c9e79e1317",
     "match-at": "0.1.0",
-    "mattermost-redux": "mattermost/mattermost-redux#webapp-part4",
+    "mattermost-redux": "mattermost/mattermost-redux#webapp-3.9",
     "object-assign": "4.1.1",
     "pdfjs-dist": "1.7.363",
     "perfect-scrollbar": "0.6.16",