upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-25 02:34:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

fix: Add missing PasswordConfirmationRequired attributes

Browse source 
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
This commit is contained in:
Côme Chilliet 2026-03-19 14:49:11 +01:00 committed by backportbot[bot]
parent 505fff1190
commit 0dced8577f
6 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
apps/oauth2/lib/Controller/SettingsController.php
View file

@ -13,6 +13,7 @@ use OCA\OAuth2\Db\Client;
use OCA\OAuth2\Db\ClientMapper;
use OCP\AppFramework\Controller;
use OCP\AppFramework\Http;
use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
use OCP\AppFramework\Http\JSONResponse;
use OCP\Authentication\Token\IProvider as IAuthTokenProvider;
use OCP\IL10N;
@ -40,6 +41,7 @@ class SettingsController extends Controller {
parent::__construct($appName, $request);
}
#[PasswordConfirmationRequired(strict: true)]
public function addClient(string $name,
string $redirectUri): JSONResponse {
if (filter_var($redirectUri, FILTER_VALIDATE_URL) === false) {
@ -66,6 +68,7 @@ class SettingsController extends Controller {
return new JSONResponse($result);
}
#[PasswordConfirmationRequired]
public function deleteClient(int $id): JSONResponse {
$client = $this->clientMapper->getByUid($id);

2
apps/provisioning_api/lib/Controller/AppsController.php
View file

@ -109,7 +109,7 @@ class AppsController extends OCSController {
*
* 200: App enabled successfully
*/
#[PasswordConfirmationRequired]
#[PasswordConfirmationRequired(strict: true)]
public function enable(string $app): DataResponse {
try {
$app = $this->verifyAppId($app);

2
apps/settings/lib/Controller/AppSettingsController.php
View file

@ -565,7 +565,7 @@ class AppSettingsController extends Controller {
* @param array $groups
* @return JSONResponse
*/
#[PasswordConfirmationRequired]
#[PasswordConfirmationRequired(strict: true)]
public function enableApps(array $appIds, array $groups = []): JSONResponse {
try {
$updateRequired = false;

2
apps/settings/lib/Controller/AuthorizedGroupController.php
View file

@ -10,6 +10,7 @@ use OC\Settings\AuthorizedGroup;
use OCA\Settings\Service\AuthorizedGroupService;
use OCA\Settings\Service\NotFoundException;
use OCP\AppFramework\Controller;
use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
use OCP\AppFramework\Http\DataResponse;
use OCP\DB\Exception;
use OCP\IRequest;
@ -27,6 +28,7 @@ class AuthorizedGroupController extends Controller {
* @throws NotFoundException
* @throws Exception
*/
#[PasswordConfirmationRequired(strict: true)]
public function saveSettings(array $newGroups, string $class): DataResponse {
$currentGroups = $this->authorizedGroupService->findExistingGroupsForClass($class);

2
apps/settings/lib/Controller/TwoFactorSettingsController.php
View file

@ -11,6 +11,7 @@ namespace OCA\Settings\Controller;
use OC\Authentication\TwoFactorAuth\EnforcementState;
use OC\Authentication\TwoFactorAuth\MandatoryTwoFactor;
use OCP\AppFramework\Controller;
use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
use OCP\AppFramework\Http\JSONResponse;
use OCP\IRequest;
@ -31,6 +32,7 @@ class TwoFactorSettingsController extends Controller {
return new JSONResponse($this->mandatoryTwoFactor->getState());
}
#[PasswordConfirmationRequired(strict: true)]
public function update(bool $enforced, array $enforcedGroups = [], array $excludedGroups = []): JSONResponse {
$this->mandatoryTwoFactor->setState(
new EnforcementState($enforced, $enforcedGroups, $excludedGroups)

3
core/Controller/TwoFactorApiController.php
View file

@ -11,6 +11,7 @@ namespace OC\Core\Controller;
use OC\Authentication\TwoFactorAuth\ProviderManager;
use OCP\AppFramework\Http;
use OCP\AppFramework\Http\Attribute\ApiRoute;
use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
use OCP\AppFramework\Http\DataResponse;
use OCP\AppFramework\OCSController;
use OCP\Authentication\TwoFactorAuth\IRegistry;
@ -60,6 +61,7 @@ class TwoFactorApiController extends OCSController {
* 404: user not found
*/
#[ApiRoute(verb: 'POST', url: '/enable', root: '/twofactor')]
#[PasswordConfirmationRequired]
public function enable(string $user, array $providers = []): DataResponse {
$userObject = $this->userManager->get($user);
if ($userObject !== null) {
@ -84,6 +86,7 @@ class TwoFactorApiController extends OCSController {
* 404: user not found
*/
#[ApiRoute(verb: 'POST', url: '/disable', root: '/twofactor')]
#[PasswordConfirmationRequired(strict: true)]
public function disable(string $user, array $providers = []): DataResponse {
$userObject = $this->userManager->get($user);
if ($userObject !== null) {