What does this MR do?
As seen in #247461 (closed), nonexistent routes should not redirect to the 2FA page, as there can be missing resources, which would cause the 2FA secret to be regenerated
For UploadsController#show routes, any resource trying to be loaded while on the 2FA page (avatar, custom header etc) would redirect to the 2FA page, also regenerating the token after the QR/key was already rendered in the view.
This skips the 2FA check for
UploadsController#show routes and
ApplicationController#route_not_found ones. The latter is correct, but the
UploadsController#show may not be the best idea from a security p.o.v. - it would allow users with enforced 2FA to still view uploads if they had a direct link.
Does this MR meet the acceptance criteria?
Documentation (if required)
Code review guidelines
Merge request performance guidelines
Separation of EE specific content
Availability and Testing
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
Tested in all supported browsers
Informed Infrastructure department of a default or new setting change, if applicable per definition of done
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
Label as security and @ mention
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
Security reports checked/validated by a reviewer from the AppSec team