Revalidate two factor settings prior to allowing any two-factor changes to an account.

[dd32]

What?

This PR requires that the user "revalidate" their two-factor details prior to changing their two-factor settings.
The grace-time from last-2fa-validation to changes is 10 minutes (Twice this for the save, so you can start editing at minute 9, and save at 18 minutes).

Why?

It's generally accepted that a user should not be able to change their 2FA settings without validating that the user currently has their 2FA token.
For example, consider an account left logged in on a public computer (or left unattended in an office), a malicious user should not be able to add a new key or create new backup codes.

How?

This works by building off #528 to track when the user last validated their 2FA tokens, and preventing updates unless the session is 2fa'd recently.

Testing Instructions

1. Login
2. Validate you can change 2FA settings
3. Wait 15 minutes (Or change the grace time via two_factor_revalidate_time to a lower time)
4. Validate you can't change 2FA settings after the grace-time is expired
5. Revalidate your 2FA, check you can change 2FA settings again.

Screenshots or screencast

Changelog Entry

Added Security - Validate the user has access to their 2FA keys prior to changing 2FA details.

Tickets

Fixes #484.

#527 and #528 have been split out of this, but are included in the git commit history of this branch.

[iandunn]

This looks great, kudos!

Increasing the test coverage would be nice, but not necessarily a blocker.

[dd32]

Changes in the commits above that are notable since reviews:

• Disabling revalidation by setting a false/0 time: 6502d24
• When initially setting 2FA, mark the session as 2FA so that the users current session can continue to edit their 2FA settings. 6721a41 Without this, if you login without 2FA, setup 2FA, and save, the next page load prompted for 2FA revalidation, annoying if you hadn't properly setup your 2FA settings yet.
• Don't return true for logged out requests to Two_Factor_Core::current_user_can_update_two_factor_options(). d3e024c This should really be used in addition to a current_user_can() check, but better to include a check here.