Bug: After updating to latest release send email otp fails to load and cannot login, had to disable OTP via cli to login as a workaround

[www-jedi]

Actual behavior

When logging in with a redirect to https://<MISP_INSTANCE>/users/email_otp is currently unable to handle this request.
HTTP ERROR 500

Expected behavior

I expect MISP to send an email for OTP.

Steps to reproduce

Login with username and password then login with OTP code.

I had to disable OTP to login to MISP.

sudo -u www-data /var/www/MISP/app/Console/cake admin setSetting Security.email_otp_enabled false

Version

2.4.191 Hotfix

Operating System

Ubuntu

Operating System version

20.04

PHP version

7.4

Browser

No response

Browser version

No response

Relevant log output

2024-05-02 10:32:36 Error: [TypeError] Argument 1 passed to ACLComponent::{closure}() must be of the type array, null given, called in /datadisk/MISP/var/www/MISP/app/Controller/Component/ACLComponent.php on line 1324
Request URL: /users/email_otp
Stack Trace:
#0 /datadisk/MISP/var/www/MISP/app/Controller/Component/ACLComponent.php(1324): ACLComponent->{closure}()
#1 /datadisk/MISP/var/www/MISP/app/Controller/AppController.php(366): ACLComponent->checkAccess()
#2 /datadisk/MISP/var/www/MISP/app/Controller/UsersController.php(29): AppController->beforeFilter()
#3 /datadisk/MISP/var/www/MISP/app/Lib/Tools/BetterCakeEventManager.php(23): UsersController->beforeFilter()
#4 /datadisk/MISP/var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(682): BetterCakeEventManager->dispatch()
#5 /datadisk/MISP/var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(189): Controller->startupProcess()
#6 /datadisk/MISP/var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke()
#7 /datadisk/MISP/var/www/MISP/app/webroot/index.php(101): Dispatcher->dispatch()
#8 {main}
2024-05-02 10:32:36 Error: Fatal Error (1): Uncaught TypeError: Argument 1 passed to ACLComponent::{closure}() must be of the type array, null given, called in /datadisk/MISP/var/www/MISP/app/Controller/Component/ACLComponent.php on line 1324 and defined in /datadisk/MISP/var/www/MISP/app/Controller/Component/ACLComponent.php:928
Stack trace:
#0 /datadisk/MISP/var/www/MISP/app/Controller/Component/ACLComponent.php(1324): ACLComponent->{closure}()
#1 /datadisk/MISP/var/www/MISP/app/Controller/AppController.php(366): ACLComponent->checkAccess()
#2 /datadisk/MISP/var/www/MISP/app/Lib/Tools/BetterCakeEventManager.php(23): AppController->beforeFilter()
#3 /datadisk/MISP/var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(682): BetterCakeEventManager->dispatch()
#4 /datadisk/MISP/var/www/MISP/app/Lib/cakephp/lib/Cake/Error/ExceptionRenderer.php(158): Controller->startupProcess()
#5 /datadisk/MISP/var/www/MISP/app/Lib/cakephp/lib/Cake/Error/ExceptionRenderer.php(95): ExceptionRenderer->_getController()
#6 /datadisk/MISP/var/www/MISP/app/Lib/cakeph in [/datadisk/MISP/var/www/MISP/app/Controller/Component/ACLComponent.php, line 928]
2024-05-02 10:32:36 Error: [InternalErrorException] Internal Server Error
Request URL: /users/email_otp
Stack Trace:
#0 /datadisk/MISP/var/www/MISP/app/Lib/cakephp/lib/Cake/Error/ErrorHandler.php(212): ErrorHandler::handleFatalError()
#1 /datadisk/MISP/var/www/MISP/app/Lib/cakephp/lib/Cake/Core/App.php(970): ErrorHandler::handleError()
#2 /datadisk/MISP/var/www/MISP/app/Lib/cakephp/lib/Cake/Core/App.php(943): App::_checkFatalError()
#3 [internal function]: App::shutdown()
#4 {main}

Extra attachments

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[iglocska]

Woah, haven't seen that one before. Will test this tomorrow if 192 is still affected.

[elvidence]

Confirming the issue with all OTP, not just email OTP.

[elvidence]

Woah, haven't seen that one before. Will test this tomorrow if 192 is still affected.

I am on v2.4.192 and had to disable OTP this morning. So, it is affected, at least my instance.
[Update] fixed now. Thanks to [iglocska].

[www-jedi]

@elvidence What is the fix?

[iglocska]

It should be fixed if you git pull!

[www-jedi]

@iglocska Thank you. I can confirm I do receive OTP via email. In the event this happens ago with a different problem, how do I roll back via git to previous release?