{"record":{"id":"660d23e42d0db0ec","repo":"phacility/phabricator","slug":"the-has-mfa-query-constraint-may-only-be-used-by","errorCode":null,"errorMessage":"The \"Has MFA\" query constraint may only be used by administrators, to prevent attackers from using it to target weak accounts.","messagePattern":"The \"Has MFA\" query constraint may only be used by administrators, to prevent attackers from using it to target weak accounts\\.","errorType":"validation","errorClass":"PhabricatorSearchConstraintException","httpStatus":null,"severity":"error","filePath":"src/applications/people/query/PhabricatorPeopleSearchEngine.php","lineNumber":175,"sourceCode":"      $query->withIsDisabled($map['isDisabled']);\n    }\n\n    if ($map['isMailingList'] !== null) {\n      $query->withIsMailingList($map['isMailingList']);\n    }\n\n    if ($map['isBot'] !== null) {\n      $query->withIsSystemAgent($map['isBot']);\n    }\n\n    if ($map['needsApproval'] !== null) {\n      $query->withIsApproved(!$map['needsApproval']);\n    }\n\n    if (idx($map, 'mfa') !== null) {\n      $viewer = $this->requireViewer();\n      if (!$viewer->getIsAdmin()) {\n        throw new PhabricatorSearchConstraintException(\n          pht(\n            'The \"Has MFA\" query constraint may only be used by '.\n            'administrators, to prevent attackers from using it to target '.\n            'weak accounts.'));\n      }\n\n      $query->withIsEnrolledInMultiFactor($map['mfa']);\n    }\n\n    if ($map['createdStart']) {\n      $query->withDateCreatedAfter($map['createdStart']);\n    }\n\n    if ($map['createdEnd']) {\n      $query->withDateCreatedBefore($map['createdEnd']);\n    }\n\n    return $query;","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/people/query/PhabricatorPeopleSearchEngine.php#L157-L193","documentation":"The People directory search engine throws PhabricatorSearchConstraintException when a non-administrator viewer applies the 'Has MFA' constraint (mfa on the query). The guard exists because filtering by MFA enrollment enumerates exactly which accounts lack MFA - a targeting primitive for attackers - so only administrators may use it. Saved-query parameters still carry the constraint, so a non-admin opening such a query triggers it immediately.","triggerScenarios":"A non-admin opens a People search URL or saved query containing `mfa=0` / `mfa=1`; a shared dashboard panel embeds an MFA-constrained user query viewed by regular users; a Conduit search built with the mfa field runs with a non-admin token.","commonSituations":"An admin shares a 'users without MFA' query link with a team; a dashboard panel with the constraint is visible org-wide; security-audit queries left in navigation that non-admins click.","solutions":["Run the query as an administrator - the constraint requires getIsAdmin() on the viewer","Share results, not queries: export the list as admin instead of distributing the constrained query URL","Remove the 'Has MFA' constraint from saved queries and dashboard panels intended for non-admin audiences"],"exampleFix":"// before: saved query visible to everyone carries mfa=0\n// after: strip the constraint for shared queries, keep MFA reporting admin-only\nif ($viewer->getIsAdmin()) {\n  $query->withIsEnrolledInMultiFactor($map['mfa']);\n}","handlingStrategy":"validation","validationCode":"// Only apply the MFA constraint for administrators\nif (idx($map, 'mfa') !== null) {\n  if (!$viewer->getIsAdmin()) {\n    unset($map['mfa']); // or reject the request explicitly\n  } else {\n    $query->withIsEnrolledInMultiFactor($map['mfa']);\n  }\n}","typeGuard":"function canUseMfaConstraint(PhabricatorUser $viewer) {\n  return (bool)$viewer->getIsAdmin();\n}","tryCatchPattern":null,"preventionTips":["Gate any 'Has MFA' filter on viewer->getIsAdmin()","Never share constrained query URLs or dashboards with non-admin audiences","Export MFA-compliance lists as admin instead of distributing the query itself"],"tags":["phabricator","search","mfa","permissions","security","people"],"backgroundTag":"permission-denied","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}