Exclude 2FA from upload#show routes and 404s
What does this MR do?
As seen in #247461 (closed), nonexistent routes should not redirect to the 2FA page, as there can be missing resources, which would cause the 2FA secret to be regenerated
For UploadsController#show routes, any resource trying to be loaded while on the 2FA page (avatar, custom header etc) would redirect to the 2FA page, also regenerating the token after the QR/key was already rendered in the view.
This skips the 2FA check for UploadsController#show routes and ApplicationController#route_not_found ones. The latter is correct, but the UploadsController#show may not be the best idea from a security p.o.v. - it would allow users with enforced 2FA to still view uploads if they had a direct link.
WDYT @dblessing @mksionek?
Screenshots
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry -
Documentation (if required) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers -
Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec -
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team