Check the TwoFactorProvider.

5 years ago · 4c76c107b9
1 changed files with 3 additions and 1 deletions
--- a/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs
+++ b/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs
@ -137,7 +137,9 @@ namespace Volo.Abp.IdentityServer.AspNetIdentity
                        var twoFactorCode = context.Request?.Raw?["TwoFactorCode"];
                        if (!twoFactorProvider.IsNullOrWhiteSpace() && !twoFactorCode.IsNullOrWhiteSpace())
                        {
-                            if (await UserManager.VerifyTwoFactorTokenAsync(user, twoFactorProvider, twoFactorCode))
+                            var providers = await UserManager.GetValidTwoFactorProvidersAsync(user);
+                            if (providers.Contains(twoFactorProvider) &&
+                                await UserManager.VerifyTwoFactorTokenAsync(user, twoFactorProvider, twoFactorCode))
                            {
                                await SetSuccessResultAsync();
                                return;