{"record":{"id":"416fdf86c52573cb","repo":"phacility/phabricator","slug":"this-comment-was-signed-with-mfa-so-edits-to-it-m","errorCode":null,"errorMessage":"This comment was signed with MFA, so edits to it must also be signed with MFA. You do not have any MFA factors attached to your account, so you can not sign this edit. Add MFA to your account in Settings.","messagePattern":"This comment was signed with MFA, so edits to it must also be signed with MFA\\. You do not have any MFA factors attached to your account, so you can not sign this edit\\. Add MFA to your account in Settings\\.","errorType":"validation","errorClass":"PhabricatorApplicationTransactionValidationException","httpStatus":null,"severity":"error","filePath":"src/applications/transactions/editor/PhabricatorApplicationTransactionCommentEditor.php","lineNumber":254,"sourceCode":"        ->withUserPHIDs(array($this->getActingAsPHID()))\n        ->withFactorProviderStatuses(\n          array(\n            PhabricatorAuthFactorProviderStatus::STATUS_ACTIVE,\n            PhabricatorAuthFactorProviderStatus::STATUS_DEPRECATED,\n          ))\n        ->execute();\n      if (!$factors) {\n        $error = new PhabricatorApplicationTransactionValidationError(\n          $xaction->getTransactionType(),\n          pht('No MFA'),\n          pht(\n            'This comment was signed with MFA, so edits to it must also be '.\n            'signed with MFA. You do not have any MFA factors attached to '.\n            'your account, so you can not sign this edit. Add MFA to your '.\n            'account in Settings.'),\n          $xaction);\n\n        throw new PhabricatorApplicationTransactionValidationException(\n          array(\n            $error,\n          ));\n      }\n    }\n\n    $workflow_key = sprintf(\n      'comment.edit(%s, %d)',\n      $xaction->getPHID(),\n      $xaction->getComment()->getID());\n\n    $hisec_token = id(new PhabricatorAuthSessionEngine())\n      ->setWorkflowKey($workflow_key)\n      ->requireHighSecurityToken($actor, $request, $cancel_uri);\n  }\n\n}\n","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/transactions/editor/PhabricatorApplicationTransactionCommentEditor.php#L236-L272","documentation":"When a comment was originally published with an MFA signature, Phabricator requires every later edit of that comment to be signed with MFA as well. Before applying the edit, PhabricatorApplicationTransactionCommentEditor loads the acting user's auth factors; if the query returns none, this PhabricatorApplicationTransactionValidationException is raised with a 'No MFA' field error.","triggerScenarios":"Calling PhabricatorApplicationTransactionCommentEditor->applyEdits() (the comment-edit workflow) on a comment whose original transaction has a multi-factor signature requirement, while the acting user has zero rows in their PhabricatorAuthFactorConfig (no TOTP, passphrase, or other factor enrolled).","commonSituations":"A user who signed comments with MFA removed all their factors and then tries to edit an old signed comment; an administrator without MFA tries to edit another user's signed comment; edits attempted by automation accounts that never enrolled factors.","solutions":["Add an MFA factor to the editing account: Settings -> Multi-Factor Authentication -> Add Authentication Factor, then retry the edit.","Have a user who does have MFA factors perform the edit.","If the factors were removed by accident, re-enroll the same factor type before editing.","As a last resort, delete the comment and post a new one (requires appropriate privileges)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Block the edit UI early when the viewer cannot sign\n$factors = id(new PhabricatorAuthFactorConfigQuery())\n  ->setViewer($viewer)\n  ->withUserPHIDs(array($viewer->getPHID()))\n  ->execute();\nif (!$factors && $comment_requires_mfa) {\n  // Show guidance instead of submitting the edit\n  return $this->newDialog()\n    ->setTitle(pht('MFA Required'))\n    ->appendChild(pht('Add an MFA factor in Settings to edit this comment.'));\n}","typeGuard":null,"tryCatchPattern":"try {\n  id(new PhabricatorApplicationTransactionCommentEditor())\n    ->setActor($viewer)\n    ->setContentSource($source)\n    ->applyEdits($comment, $xactions);\n} catch (PhabricatorApplicationTransactionValidationException $ex) {\n  foreach ($ex->getErrors() as $error) {\n    if ($error->getType() === pht('No MFA')) {\n      // Direct the user to Settings -> Multi-Factor Authentication\n    }\n  }\n}","preventionTips":["Enroll MFA factors on accounts that routinely edit signed comments.","Do not remove all factors from an account that authored MFA-signed comments.","In custom comment-edit UIs, pre-check the viewer's factor count and disable the form with a clear message."],"tags":["phabricator","mfa","security","comments","transactions"],"backgroundTag":"mfa-factor-missing","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}