Maybe oneClickResults should require 2FA too?

Actually, I'm not so sure this solves the problem completely. Thinking about it, it doesn't really make sense that everyone is able to see the "complete the update" screen, maybe that can be the complete fix (for a later release, not necessarily in this PR).

Actually, I'm not so sure this solves the problem completely. Thinking about it, it doesn't really make sense that everyone is able to see the "complete the update" screen, maybe that can be the complete fix (for a later release, not necessarily in this PR).

You mean the screen where the DB is being upgraded etc? I think it is because sometimes the login may not function anymore without the DB upgrade etc

It might not, but it probably should work regardless. I think that's something we can test for before releasing (the one click update test might be a possible place).

It depends though eg from which version you up date.

@tsteur do you think the oneClickResults controller action should also require 2FA?

@diosmosis I think it shouldn't. There may be various issues where you may not be logged in or have other problems etc. It should be fine to access this page even logged out.