nextcloud/apps/settings/src/main-admin-security.js
Peter Ringelmann a070301443
fix(frontend): add strict password confirmation for sensitive admin actions
Register axios password confirmation interceptors in the apps
management, admin delegation, admin security, and OAuth2 settings
bundles, and pass PwdConfirmationMode.Strict on requests to endpoints
protected with #[PasswordConfirmationRequired(strict: true)], so that
the user password is verified via Basic auth on the request itself
rather than relying on the session timestamp.

Signed-off-by: Peter Ringelmann <peter.ringelmann@nextcloud.com>
2026-04-21 10:21:08 +02:00

28 lines
931 B
JavaScript

import { getCSPNonce } from '@nextcloud/auth'
/**
* SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
* SPDX-License-Identifier: AGPL-3.0-or-later
*/
import axios from '@nextcloud/axios'
import { loadState } from '@nextcloud/initial-state'
import { addPasswordConfirmationInterceptors } from '@nextcloud/password-confirmation'
import Vue from 'vue'
import AdminTwoFactor from './components/AdminTwoFactor.vue'
import EncryptionSettings from './components/Encryption/EncryptionSettings.vue'
import store from './store/admin-security.js'
addPasswordConfirmationInterceptors(axios)
__webpack_nonce__ = getCSPNonce()
Vue.prototype.t = t
store.replaceState(loadState('settings', 'mandatory2FAState'))
const View = Vue.extend(AdminTwoFactor)
new View({
store,
}).$mount('#two-factor-auth-settings')
const EncryptionView = Vue.extend(EncryptionSettings)
new EncryptionView().$mount('#vue-admin-encryption')