merchant

commit 8716bd670aa84421dae2939f3f4c8cd830ed7a03
parent bfa630e9b00670217e44be6d3a452ca02e24c83c
Author: Christian Grothoff <christian@grothoff.org>
Date:   Thu, 13 Aug 2026 19:32:20 +0200

refuse reset without MFA

Diffstat:
M
src/backend/taler-merchant-httpd_post-management-instances-INSTANCE-auth.c
 | 
15
+++++++++++++++

1 file changed, 15 insertions(+), 0 deletions(-)
diff --git a/src/backend/taler-merchant-httpd_post-management-instances-INSTANCE-auth.c b/src/backend/taler-merchant-httpd_post-management-instances-INSTANCE-auth.c
@@ -309,6 +309,21 @@ TMH_public_post_instances_ID_auth (const struct TMH_RequestHandler *rh,
       TALER_EC_MERCHANT_GENERIC_MFA_MISSING,
       "not allowed for 'admin' account");
   }
+  if (TMH_TCS_NONE == TEH_mandatory_tan_channels)
+  {
+    /* This endpoint changes the instance password *without* requiring
+       the current password; the only thing standing between an
+       anonymous client and a full account takeover is the MFA
+       challenge.  If no TAN channel is mandatory, we have no second
+       factor to require and thus must refuse the request. */
+    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+                "Refusing password reset: no mandatory TAN channel configured\n");
+    return TALER_MHD_reply_with_error (
+      connection,
+      MHD_HTTP_FORBIDDEN,
+      TALER_EC_MERCHANT_GENERIC_MFA_MISSING,
+      "MANDATORY_TAN_CHANNELS");
+  }
   return post_instances_ID_auth (mi,
                                  connection,
                                  hc,