upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 54

fix(app-password): Require strict password confirmation

Browse source 
Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling 2026-01-09 17:59:01 +01:00 committed by Maksim Sukharev
parent a82827dff5
commit 3713f40d5b
3 changed files with 12 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apps/settings/lib/Controller/AuthSettingsController.php
View file

@ -59,7 +59,7 @@ class AuthSettingsController extends Controller {
* @param bool $qrcodeLogin If set to true, the returned token could be (depending on server settings) a onetime password, that can only be used to get the actual app password a single time
*/
#[NoAdminRequired]
#[PasswordConfirmationRequired]
#[PasswordConfirmationRequired(strict: true)]
public function create(string $name = '', bool $qrcodeLogin = false): JSONResponse {
if ($this->checkAppToken()) {
return $this->getServiceNotAvailableResponse();

6
apps/settings/src/store/authtoken.ts
View file

@ -6,12 +6,13 @@ import axios from '@nextcloud/axios'
import { showError } from '@nextcloud/dialogs'
import { loadState } from '@nextcloud/initial-state'
import { translate as t } from '@nextcloud/l10n'
import { confirmPassword } from '@nextcloud/password-confirmation'
import { addPasswordConfirmationInterceptors, confirmPassword, PwdConfirmationMode } from '@nextcloud/password-confirmation'
import { generateUrl } from '@nextcloud/router'
import { defineStore } from 'pinia'
import logger from '../logger.ts'
const BASE_URL = generateUrl('/settings/personal/authtokens')
addPasswordConfirmationInterceptors(axios)
/**
*
@ -89,9 +90,8 @@ export const useAuthTokenStore = defineStore('auth-token', {
logger.debug('Creating a new app token')
try {
await confirmPassword()
const { data } = await axios.post<ITokenResponse>(BASE_URL, { name, oneTime: true }, { confirmPassword: PwdConfirmationMode.Strict })
const { data } = await axios.post<ITokenResponse>(BASE_URL, { name, oneTime: true })
this.tokens.push(data.deviceToken)
logger.debug('App token created')
return data

12
core/src/components/AccountMenu/AccountMenuProfileEntry.vue
View file

@ -36,7 +36,7 @@ import axios from '@nextcloud/axios'
import { getCapabilities } from '@nextcloud/capabilities'
import { subscribe, unsubscribe } from '@nextcloud/event-bus'
import { loadState } from '@nextcloud/initial-state'
import { confirmPassword } from '@nextcloud/password-confirmation'
import { addPasswordConfirmationInterceptors, PwdConfirmationMode } from '@nextcloud/password-confirmation'
import { generateUrl } from '@nextcloud/router'
import { spawnDialog } from '@nextcloud/vue/functions/dialog'
import { defineComponent } from 'vue'
@ -46,6 +46,8 @@ import NcLoadingIcon from '@nextcloud/vue/components/NcLoadingIcon'
import IconQrcodeScan from 'vue-material-design-icons/QrcodeScan.vue'
import AccountQrLoginDialog from './AccountQRLoginDialog.vue'
addPasswordConfirmationInterceptors(axios)
const { profileEnabled } = loadState('user_status', 'profileEnabled', { profileEnabled: false })
// @ts-expect-error capabilities is missing the capability to type it...
@ -115,9 +117,11 @@ export default defineComponent({
},
async handleQrCodeClick() {
await confirmPassword()
const { data } = await axios.post<ITokenResponse>(generateUrl('/settings/personal/authtokens'), { qrcodeLogin: true })
const { data } = await axios.post<ITokenResponse>(
generateUrl('/settings/personal/authtokens'),
{ qrcodeLogin: true },
{ confirmPassword: PwdConfirmationMode.Strict },
)
await spawnDialog(AccountQrLoginDialog, { data })
},