Merge #19925 - Fix #19900 - two factor auth disappears

Pull-request: #19925
Fixes: #19900
Signed-off-by: William Desportes <williamdes@wdes.fr>

libraries/classes/UserPreferences.php

@@ -125,6 +125,16 @@ class UserPreferences
      */
     public function save(array $config_array)
     {
+        // Smart merge: If this looks like a partial save (missing 2fa but we have it stored),
+        // automatically merge to prevent accidental overwrites
+        if (! isset($config_array['2fa'])) {
+            $existingPrefs = $this->load();
+            if (isset($existingPrefs['config_data']['2fa'])) {
+                // This is likely a partial save from page settings - merge to preserve 2fa
+                $config_array = array_merge($existingPrefs['config_data'], $config_array);
+            }
+        }
+
         global $dbi;
 
         $relationParameters = $this->relation->getRelationParameters();

phpstan-baseline.neon

@@ -48750,6 +48750,16 @@ parameters:
 			count: 1
 			path: test/classes/UserPreferencesTest.php
 
+		-
+			message: "#^Cannot access offset '2fa' on mixed\\.$#"
+			count: 1
+			path: test/classes/UserPreferencesTest.php
+
+		-
+			message: "#^Cannot access offset 'Console/Mode' on mixed\\.$#"
+			count: 1
+			path: test/classes/UserPreferencesTest.php
+
 		-
 			message: "#^Cannot access offset 'DisableIS' on mixed\\.$#"
 			count: 1
@@ -48777,7 +48787,12 @@ parameters:
 
 		-
 			message: "#^Cannot access offset 'db' on mixed\\.$#"
-			count: 2
+			count: 3
+			path: test/classes/UserPreferencesTest.php
+
+		-
+			message: "#^Cannot access offset 'secret' on mixed\\.$#"
+			count: 1
 			path: test/classes/UserPreferencesTest.php
 
 		-
@@ -48785,6 +48800,11 @@ parameters:
 			count: 1
 			path: test/classes/UserPreferencesTest.php
 
+		-
+			message: "#^Cannot access offset 'settings' on mixed\\.$#"
+			count: 1
+			path: test/classes/UserPreferencesTest.php
+
 		-
 			message: "#^Cannot access offset 'ts' on mixed\\.$#"
 			count: 1

test/classes/UserPreferencesTest.php

@@ -226,6 +226,23 @@ class UserPreferencesTest extends AbstractNetworkTestCase
         self::assertInstanceOf(Message::class, $result);
         self::assertSame('Could not save configuration<br><br>err1'
         . '<br><br>The phpMyAdmin configuration storage database could not be accessed.', $result->getMessage());
+
+        // Test 2fa preservation on partial save
+        $_SESSION['relation'] = [];
+        $_SESSION['relation'][$GLOBALS['server']] = RelationParameters::fromArray([])->toArray();
+
+        // Initial save with 2fa
+        $initialConfig = ['2fa' => ['backend' => 'application', 'settings' => ['secret' => 'thisisasecret']], 'theme' => 'dark'];
+        $this->userPreferences->save($initialConfig);
+
+        // Partial save without 2fa
+        $partialConfig = ['Console/Mode' => 'collapse'];
+        $this->userPreferences->save($partialConfig);
+
+        // Check that 2fa is still present
+        $resultConfig = $_SESSION['userconfig']['db'];
+        self::assertSame('thisisasecret', $resultConfig['2fa']['settings']['secret']);
+        self::assertSame('collapse', $resultConfig['Console/Mode']);
     }
 
     /**