Allow XHR requests with tokenauth (e.g. from widgetized pages) to skip 2FA (#14657)

1 files changed, 5 insertions, 8 deletions

diff --git a/plugins/TwoFactorAuth/TwoFactorAuth.php b/plugins/TwoFactorAuth/TwoFactorAuth.php
index 4f550df53d..fe1c3f465f 100644
--- a/plugins/TwoFactorAuth/TwoFactorAuth.php
+++ b/plugins/TwoFactorAuth/TwoFactorAuth.php
@@ -180,14 +180,11 @@ class TwoFactorAuth extends \Piwik\Plugin
             return false;
         }
 
-        if (Piwik::getModule() === 'Widgetize') {
-            // we cannot use $module as it would be different when dispatching other requests within the widgetized request
-            $auth = StaticContainer::get('Piwik\Auth');
-            if ($auth && !$auth->getLogin() && method_exists($auth, 'getTokenAuth') && $auth->getTokenAuth()) {
-                // when authenticated by token only, we do not require 2fa
-                // needed eg for rendering exported widgets authenticated by token
-                return false;
-            }
+        $auth = StaticContainer::get('Piwik\Auth');
+        if ($auth && !$auth->getLogin() && method_exists($auth, 'getTokenAuth') && $auth->getTokenAuth()) {
+            // when authenticated by token only, we do not require 2fa
+            // needed eg for rendering exported widgets authenticated by token
+            return false;
         }
 
         $requiresAuth = true;