[4.1] Extend 2FA Enforcement option to select usergroups

[jgerman-bot]

New language relevant PR in upstream repo: joomla/joomla-cms#30522 Here are the upstream changes:

Click to expand the diff!

diff --git a/administrator/components/com_users/config.xml b/administrator/components/com_users/config.xml
index 4238d255eeba..f02345cff79c 100644
--- a/administrator/components/com_users/config.xml
+++ b/administrator/components/com_users/config.xml
@@ -123,6 +123,16 @@
 			<option value="3">COM_USERS_CONFIG_FIELD_ENFORCE_2FA_FIELD_BOTH</option>
 		</field>
 
+		<field
+			name="enforce_2fa_usergroups"
+			type="usergrouplist"
+			label="COM_USERS_CONFIG_FIELD_ENFORCE_2FA_GROUPS_LABEL"
+			multiple="true"
+			filter="int_array"
+			size="10"
+			showon="enforce_2fa_options!:0"
+		/>
+
 	</fieldset>
 
 	<fieldset
diff --git a/administrator/language/en-GB/com_users.ini b/administrator/language/en-GB/com_users.ini
index 2b90ad68bb19..dce12ede36d7 100644
--- a/administrator/language/en-GB/com_users.ini
+++ b/administrator/language/en-GB/com_users.ini
@@ -35,6 +35,7 @@ COM_USERS_CONFIG_FIELD_ENFORCE_2FA_FIELD_ADMIN="Admin (Backend)"
 COM_USERS_CONFIG_FIELD_ENFORCE_2FA_FIELD_BOTH="Both"
 COM_USERS_CONFIG_FIELD_ENFORCE_2FA_FIELD_LABEL="Enforce Two Factor Authentication"
 COM_USERS_CONFIG_FIELD_ENFORCE_2FA_FIELD_SITE="Site (Frontend)"
+COM_USERS_CONFIG_FIELD_ENFORCE_2FA_GROUPS_LABEL="Enforce Two Factor Authentication for Usergroups"
 COM_USERS_CONFIG_FIELD_FRONTEND_LANG_LABEL="Frontend Language"
 COM_USERS_CONFIG_FIELD_FRONTEND_RESET_COUNT_LABEL="Maximum Reset Count"
 COM_USERS_CONFIG_FIELD_FRONTEND_RESET_TIME_LABEL="Reset Time"
diff --git a/libraries/src/Application/CMSApplication.php b/libraries/src/Application/CMSApplication.php
index 5e7e0c349eb5..1e0664995e48 100644
--- a/libraries/src/Application/CMSApplication.php
+++ b/libraries/src/Application/CMSApplication.php
@@ -1175,9 +1175,9 @@ public function isCli()
 	 */
 	protected function isTwoFactorAuthenticationRequired(): bool
 	{
-		$userId = $this->getIdentity()->id;
+		$user = $this->getIdentity();
 
-		if (!$userId)
+		if (!$user->id)
 		{
 			return false;
 		}
@@ -1188,7 +1188,22 @@ protected function isTwoFactorAuthenticationRequired(): bool
 			return false;
 		}
 
-		$enforce2faOptions = ComponentHelper::getComponent('com_users')->getParams()->get('enforce_2fa_options', 0);
+		$comUsersParams = ComponentHelper::getComponent('com_users')->getParams();
+
+		// Check if 2fa is enforced for the logged in user.
+		$forced2faGroups = (array) $comUsersParams->get('enforce_2fa_usergroups', []);
+
+		if (!empty($forced2faGroups))
+		{
+			$userGroups = (array) $user->get('groups', []);
+
+			if (!array_intersect($forced2faGroups, $userGroups))
+			{
+				return false;
+			}
+		}
+
+		$enforce2faOptions = $comUsersParams->get('enforce_2fa_options', 0);
 
 		if ($enforce2faOptions == 0 || !$enforce2faOptions)
 		{

[tecpromotion]

oh. @zero-24 this is 4.1 and not 4.0? do we already need a 4.1-dev branch?

[zero-24]

Yes its 4.1 will do a 4.1 branch in a minute

[zero-24]

https://github.com/joomlagerman/joomla/tree/4.1-dev

[tecpromotion]

Wait for PR #1091
Please merge 4.0-dev into 4.1-dev after merge

[tecpromotion]

is merged in 4.1? please close issue #1233 @zero-24

[zero-24]

hmm ja diese PR: #1091 ist jetzt auch in 4.1 aber für diesen issue hier müssten wir dann noch einen PR machen welcher den Sprachstring COM_USERS_CONFIG_FIELD_ENFORCE_2FA_GROUPS_LABEL in 4,1 einbaut.