From 4c76c107b93e9a7360ac3689335f871881969d91 Mon Sep 17 00:00:00 2001
From: maliming <malimings@gmail.com>
Date: Fri, 28 May 2021 14:57:33 +0800
Subject: [PATCH] Check the TwoFactorProvider.

---
 .../AspNetIdentity/AbpResourceOwnerPasswordValidator.cs       | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs b/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs
index acbbaa1f9b..81f2552e97 100644
--- a/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs
+++ b/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs
@@ -137,7 +137,9 @@ namespace Volo.Abp.IdentityServer.AspNetIdentity
                         var twoFactorCode = context.Request?.Raw?["TwoFactorCode"];
                         if (!twoFactorProvider.IsNullOrWhiteSpace() && !twoFactorCode.IsNullOrWhiteSpace())
                         {
-                            if (await UserManager.VerifyTwoFactorTokenAsync(user, twoFactorProvider, twoFactorCode))
+                            var providers = await UserManager.GetValidTwoFactorProvidersAsync(user);
+                            if (providers.Contains(twoFactorProvider) &&
+                                await UserManager.VerifyTwoFactorTokenAsync(user, twoFactorProvider, twoFactorCode))
                             {
                                 await SetSuccessResultAsync();
                                 return;