Forums / Bug Reports / MFA redirect error when not SuperUser (v2.1.0, v2.2.1, v2.2.2)

MFA redirect error when not SuperUser (v2.1.0, v2.2.1, v2.2.2)

Views: 356

Results 1 to 5 of 5
13 May 2026, 10:12 PM
#1
jeking avatar

jeking

Totally Zenned

Join Date:
Oct 2005
Location:
Chicago, IL USA
Posts:
1,592
Plugin Contributions:
0

MFA redirect error when not SuperUser (v2.1.0, v2.2.1, v2.2.2)

I enabled MFA for a client using ZC 2.1. Several users now get a too many redirects error when logging in. In troubleshooting, it only happens with users who are not SuperUsers. I don't see this mentioned as a fix in 2.2. Is this an unknow bug?

Thank you,
Jim

Jim
Wheaton Website Services

19 May 2026, 11:45 PM
#2
jeking avatar

jeking

Totally Zenned

Join Date:
Oct 2005
Location:
Chicago, IL USA
Posts:
1,592
Plugin Contributions:
0

Re: MFA redirect error when not SuperUser (v2.1.0, v2.2.1, v2.2.2)

I went to report this as a known bug, but the thread is closed. The MFA page is not allowed for any user profile but Super Users and it's not listed as a page in the profile editor. We had to add the page to the admin_pages_to_profiles table.

Jim
Wheaton Website Services

21 May 2026, 4:59 PM
#3
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,515
Plugin Contributions:
176

Re: MFA redirect error when not SuperUser (v2.1.0, v2.2.1, v2.2.2)

In admin's init_admin_auth.php file, does adding FILENAME_MFA to the array solve the problem?

        // check page authorization access
        if (!in_array($page, ['keepalive', FILENAME_DEFAULT, FILENAME_ADMIN_ACCOUNT, FILENAME_LOGOFF, FILENAME_ALERT_PAGE, FILENAME_PASSWORD_FORGOTTEN, FILENAME_DENIED, FILENAME_ALT_NAV], true)
            && !zen_is_superuser())
        {

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

21 May 2026, 8:40 PM
#4
jeking avatar

jeking

Totally Zenned

Join Date:
Oct 2005
Location:
Chicago, IL USA
Posts:
1,592
Plugin Contributions:
0

Re: MFA redirect error when not SuperUser (v2.1.0, v2.2.1, v2.2.2)

I've already implemented a fix for this client site so can't try this fix there. I think I have a ZC 2.1 test site I can try this on.

Jim
Wheaton Website Services

22 May 2026, 5:34 AM
#5
jeking avatar

jeking

Totally Zenned

Join Date:
Oct 2005
Location:
Chicago, IL USA
Posts:
1,592
Plugin Contributions:
0

Re: MFA redirect error when not SuperUser (v2.1.0, v2.2.1, v2.2.2)

I tested this on my demo 2.1 installation and it does work. Thanks for the help.

Jim
Wheaton Website Services