require OTP code even on trusted hosts (for the first time)

phoenixctms · Mar 7, 2024 · dee9544 · dee9544
1 parent c674d33
commit dee9544
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/web/src/main/java/org/phoenixctms/ctsms/web/model/SessionScopeBean.java b/web/src/main/java/org/phoenixctms/ctsms/web/model/SessionScopeBean.java
@@ -1215,7 +1215,9 @@ public synchronized String login() {
 			auth.setLocalPassword(null);
 			clearAuthenticationFailedMessage();
 			if (logon.getEnable2fa()
-					&& (Settings.getBoolean(SettingCodes.TRUSTED_HOST_2FA_REQUIRED, Bundle.SETTINGS, DefaultSettings.TRUSTED_HOST_2FA_REQUIRED) || !WebUtil.isTrustedHost())) {
+					&& (logon.getShowOtpRegistrationInfo()
+							|| Settings.getBoolean(SettingCodes.TRUSTED_HOST_2FA_REQUIRED, Bundle.SETTINGS, DefaultSettings.TRUSTED_HOST_2FA_REQUIRED)
+							|| !WebUtil.isTrustedHost())) {
 				otpRequired = true;
 				outcome = getLoginOutcome(false);
 			} else {