Prevent users disabling MFA when it is enforced

post/user/profile.php

@@ -261,6 +261,13 @@ if (isset($_POST['enable_mfa'])) {
 
 if (isset($_GET['disable_mfa'])){
 
+    if ($session_user_config_force_mfa) {
+        $_SESSION['alert_type'] = "error";
+        $_SESSION['alert_message'] = "Multi-Factor authentication cannot be disabled for your account";
+        header("Location: " . $_SERVER["HTTP_REFERER"]);
+        exit();
+    }
+
     // CSRF Check
     validateCSRFToken($_GET['csrf_token']);