Skip to content

[stable32] fix: Add missing PasswordConfirmationRequired attributes #59788

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
come-nc merged 5 commits into from
Apr 21, 2026
Merged

[stable32] fix: Add missing PasswordConfirmationRequired attributes #59788

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0dced85
fix: Add missing PasswordConfirmationRequired attributes
come-nc Mar 19, 2026
f49a9bd
chore(openapi): Rebuild openapi JSON files
come-nc Apr 21, 2026
b350df0
chore(cypress): Add handling for added password confirmation dialog
come-nc Apr 21, 2026
85dd814
fix(frontend): add strict password confirmation for sensitive admin a…
pringelmann Mar 23, 2026
673477f
chore(assets): Recompile assets
pringelmann Apr 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions apps/oauth2/lib/Controller/SettingsController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
use OCA\OAuth2\Db\ClientMapper;
use OCP\AppFramework\Controller;
use OCP\AppFramework\Http;
use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
use OCP\AppFramework\Http\JSONResponse;
use OCP\Authentication\Token\IProvider as IAuthTokenProvider;
use OCP\IL10N;
Expand Down Expand Up @@ -40,6 +41,7 @@ public function __construct(
parent::__construct($appName, $request);
}

#[PasswordConfirmationRequired(strict: true)]
public function addClient(string $name,
string $redirectUri): JSONResponse {
if (filter_var($redirectUri, FILTER_VALIDATE_URL) === false) {
Expand All @@ -66,6 +68,7 @@ public function addClient(string $name,
return new JSONResponse($result);
}

#[PasswordConfirmationRequired]
public function deleteClient(int $id): JSONResponse {
$client = $this->clientMapper->getByUid($id);

Expand Down
2 changes: 1 addition & 1 deletion apps/provisioning_api/lib/Controller/AppsController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ public function getAppInfo(string $app): DataResponse {
*
* 200: App enabled successfully
*/
#[PasswordConfirmationRequired]
#[PasswordConfirmationRequired(strict: true)]
public function enable(string $app): DataResponse {
try {
$app = $this->verifyAppId($app);
Expand Down
2 changes: 1 addition & 1 deletion apps/settings/lib/Controller/AppSettingsController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -565,7 +565,7 @@ public function enableApp(string $appId, array $groups = []): JSONResponse {
* @param array $groups
* @return JSONResponse
*/
#[PasswordConfirmationRequired]
#[PasswordConfirmationRequired(strict: true)]
public function enableApps(array $appIds, array $groups = []): JSONResponse {
try {
$updateRequired = false;
Expand Down
2 changes: 2 additions & 0 deletions apps/settings/lib/Controller/AuthorizedGroupController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
use OCA\Settings\Service\AuthorizedGroupService;
use OCA\Settings\Service\NotFoundException;
use OCP\AppFramework\Controller;
use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
use OCP\AppFramework\Http\DataResponse;
use OCP\DB\Exception;
use OCP\IRequest;
Expand All @@ -27,6 +28,7 @@ public function __construct(
* @throws NotFoundException
* @throws Exception
*/
#[PasswordConfirmationRequired(strict: true)]
public function saveSettings(array $newGroups, string $class): DataResponse {
$currentGroups = $this->authorizedGroupService->findExistingGroupsForClass($class);

Expand Down
2 changes: 2 additions & 0 deletions apps/settings/lib/Controller/TwoFactorSettingsController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
use OC\Authentication\TwoFactorAuth\EnforcementState;
use OC\Authentication\TwoFactorAuth\MandatoryTwoFactor;
use OCP\AppFramework\Controller;
use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
use OCP\AppFramework\Http\JSONResponse;
use OCP\IRequest;

Expand All @@ -31,6 +32,7 @@ public function index(): JSONResponse {
return new JSONResponse($this->mandatoryTwoFactor->getState());
}

#[PasswordConfirmationRequired(strict: true)]
public function update(bool $enforced, array $enforcedGroups = [], array $excludedGroups = []): JSONResponse {
$this->mandatoryTwoFactor->setState(
new EnforcementState($enforced, $enforcedGroups, $excludedGroups)
Expand Down
3 changes: 3 additions & 0 deletions core/Controller/TwoFactorApiController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
use OC\Authentication\TwoFactorAuth\ProviderManager;
use OCP\AppFramework\Http;
use OCP\AppFramework\Http\Attribute\ApiRoute;
use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
use OCP\AppFramework\Http\DataResponse;
use OCP\AppFramework\OCSController;
use OCP\Authentication\TwoFactorAuth\IRegistry;
Expand Down Expand Up @@ -60,6 +61,7 @@ public function state(string $user): DataResponse {
* 404: user not found
*/
#[ApiRoute(verb: 'POST', url: '/enable', root: '/twofactor')]
#[PasswordConfirmationRequired]
public function enable(string $user, array $providers = []): DataResponse {
$userObject = $this->userManager->get($user);
if ($userObject !== null) {
Expand All @@ -84,6 +86,7 @@ public function enable(string $user, array $providers = []): DataResponse {
* 404: user not found
*/
#[ApiRoute(verb: 'POST', url: '/disable', root: '/twofactor')]
#[PasswordConfirmationRequired(strict: true)]
public function disable(string $user, array $providers = []): DataResponse {
$userObject = $this->userManager->get($user);
if ($userObject !== null) {
Expand Down
4 changes: 2 additions & 2 deletions core/openapi-administration.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,7 +290,7 @@
"post": {
"operationId": "two_factor_api-enable",
"summary": "Enable two factor authentication providers for specific user",
"description": "This endpoint requires admin access",
"description": "This endpoint requires admin access\nThis endpoint requires password confirmation",
"tags": [
"two_factor_api"
],
Expand Down Expand Up @@ -468,7 +468,7 @@
"post": {
"operationId": "two_factor_api-disable",
"summary": "Disable two factor authentication providers for specific user",
"description": "This endpoint requires admin access",
"description": "This endpoint requires admin access\nThis endpoint requires password confirmation",
"tags": [
"two_factor_api"
],
Expand Down
4 changes: 2 additions & 2 deletions core/openapi-full.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11637,7 +11637,7 @@
"post": {
"operationId": "two_factor_api-enable",
"summary": "Enable two factor authentication providers for specific user",
"description": "This endpoint requires admin access",
"description": "This endpoint requires admin access\nThis endpoint requires password confirmation",
"tags": [
"two_factor_api"
],
Expand Down Expand Up @@ -11815,7 +11815,7 @@
"post": {
"operationId": "two_factor_api-disable",
"summary": "Disable two factor authentication providers for specific user",
"description": "This endpoint requires admin access",
"description": "This endpoint requires admin access\nThis endpoint requires password confirmation",
"tags": [
"two_factor_api"
],
Expand Down
3 changes: 3 additions & 0 deletions cypress/e2e/settings/apps.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,9 @@ describe('Settings: App management', { testIsolation: true }, () => {
.find('span')
.contains('admin')
.click()

handlePasswordConfirmation(admin.password)

cy.get('span.name-parts__first')
.contains('admin')
.should('be.visible')
Expand Down
4 changes: 2 additions & 2 deletions openapi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15161,7 +15161,7 @@
"post": {
"operationId": "core-two_factor_api-enable",
"summary": "Enable two factor authentication providers for specific user",
"description": "This endpoint requires admin access",
"description": "This endpoint requires admin access\nThis endpoint requires password confirmation",
"tags": [
"core/two_factor_api"
],
Expand Down Expand Up @@ -15339,7 +15339,7 @@
"post": {
"operationId": "core-two_factor_api-disable",
"summary": "Disable two factor authentication providers for specific user",
"description": "This endpoint requires admin access",
"description": "This endpoint requires admin access\nThis endpoint requires password confirmation",
"tags": [
"core/two_factor_api"
],
Expand Down
⚡