From 0dc436067fa971c97e7c4ed95f1f50a0e611222b Mon Sep 17 00:00:00 2001
From: Mira Weller <weller@rami.io>
Date: Fri, 20 Mar 2026 12:56:38 +0100
Subject: [PATCH] always perform 2fa activation as dedicated step

---
 .../pretixcontrol/user/2fa_confirm_totp.html  |  4 --
 .../user/2fa_confirm_webauthn.html            |  7 +---
 src/pretix/control/views/user.py              | 40 +++++--------------
 3 files changed, 11 insertions(+), 40 deletions(-)

diff --git a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html
index a25ca03cf7..95b2f2715d 100644
--- a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html
+++ b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_totp.html
@@ -73,10 +73,6 @@
                 <button class="btn btn-primary" type="submit">
                     {% trans "Continue" %}
                 </button><br>
-                <label>
-                    <input type="checkbox" name="activate" checked="checked" value="on">
-                    {% trans "Require second factor for future logins" %}
-                </label>
             </form>
         </li>
     </ol>
diff --git a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html
index 1b064b8aab..c20da58875 100644
--- a/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html
+++ b/src/pretix/control/templates/pretixcontrol/user/2fa_confirm_webauthn.html
@@ -13,12 +13,7 @@
     <form class="form form-inline" method="post" action="" id="webauthn-form">
         {% csrf_token %}
         <input type="hidden" id="webauthn-response" name="token" class="form-control" required="required">
-        <p>
-            <label>
-                <input type="checkbox" name="activate" checked="checked" value="on">
-                {% trans "Require second factor for future logins" %}
-            </label>
-        </p>
+
         <button class="btn btn-primary sr-only" type="submit"></button>
     </form>
 
diff --git a/src/pretix/control/views/user.py b/src/pretix/control/views/user.py
index 412a56bc3f..dc03110307 100644
--- a/src/pretix/control/views/user.py
+++ b/src/pretix/control/views/user.py
@@ -465,25 +465,15 @@ class User2FADeviceConfirmWebAuthnView(RecentAuthenticationRequiredMixin, Templa
             notices = [
                 _('A new two-factor authentication device has been added to your account.')
             ]
-            activate = request.POST.get('activate', '')
-            if activate == 'on' and not self.request.user.require_2fa:
-                self.request.user.require_2fa = True
-                self.request.user.save()
-                self.request.user.log_action('pretix.user.settings.2fa.enabled', user=self.request.user)
-                notices.append(
-                    _('Two-factor authentication has been enabled.')
-                )
             self.request.user.send_security_notice(notices)
             self.request.user.update_session_token()
             update_session_auth_hash(self.request, self.request.user)
 
-            note = ''
-            if not self.request.user.require_2fa:
-                note = ' ' + str(_('Please note that you still need to enable two-factor authentication for your '
-                                   'account using the buttons below to make a second factor required for logging '
-                                   'into your account.'))
-            messages.success(request, str(_('The device has been verified and can now be used.')) + note)
-            return redirect(reverse('control:user.settings.2fa'))
+            messages.success(request, str(_('The device has been verified and can now be used.')))
+            if self.request.user.require_2fa:
+                return redirect(reverse('control:user.settings.2fa'))
+            else:
+                return redirect(reverse('control:user.settings.2fa.enable'))
         except Exception:
             messages.error(request, _('The registration could not be completed. Please try again.'))
             logger.exception('WebAuthn registration failed')
@@ -514,7 +504,6 @@ class User2FADeviceConfirmTOTPView(RecentAuthenticationRequiredMixin, TemplateVi
 
     def post(self, request, *args, **kwargs):
         token = request.POST.get('token', '')
-        activate = request.POST.get('activate', '')
         if self.device.verify_token(token):
             self.device.confirmed = True
             self.device.save()
@@ -526,24 +515,15 @@ class User2FADeviceConfirmTOTPView(RecentAuthenticationRequiredMixin, TemplateVi
             notices = [
                 _('A new two-factor authentication device has been added to your account.')
             ]
-            if activate == 'on' and not self.request.user.require_2fa:
-                self.request.user.require_2fa = True
-                self.request.user.save()
-                self.request.user.log_action('pretix.user.settings.2fa.enabled', user=self.request.user)
-                notices.append(
-                    _('Two-factor authentication has been enabled.')
-                )
             self.request.user.send_security_notice(notices)
             self.request.user.update_session_token()
             update_session_auth_hash(self.request, self.request.user)
 
-            note = ''
-            if not self.request.user.require_2fa:
-                note = ' ' + str(_('Please note that you still need to enable two-factor authentication for your '
-                                   'account using the buttons below to make a second factor required for logging '
-                                   'into your account.'))
-            messages.success(request, str(_('The device has been verified and can now be used.')) + note)
-            return redirect(reverse('control:user.settings.2fa'))
+            messages.success(request, str(_('The device has been verified and can now be used.')))
+            if self.request.user.require_2fa:
+                return redirect(reverse('control:user.settings.2fa'))
+            else:
+                return redirect(reverse('control:user.settings.2fa.enable'))
         else:
             messages.error(request, _('The code you entered was not valid. If this problem persists, please check '
                                       'that the date and time of your phone are configured correctly.'))