Solved TFA can still be configured even if disabled via config.php

[Kirby]

If TFA is disabled via config.php $config['enableTfa'] ) false; and users to have permission to use TFA, they can still configure it but it does not have any effect.

This is confusing and might/will lead users to believe there accout is protected while in fact it is not.

Therefore I think it should not be possible to confgure TFA if it is disabled via config.php

Continue reading...