nextcloud/server

Ask for authentication before removing 'Device & Sessions'

Open

Aperta il 14 lug 2023

Vedi su GitHub
 (2 commenti) (0 reazioni) (0 assegnatari)PHP (34.953 star) (4865 fork)batch import
0. Needs triageenhancementfeature: authenticationfeature: settingsgood first issue

Descrizione

Describe the solution you'd like As user I want to make sure that when I remove a device or session from my NextCloud account I'm prompted to authenticate with my password So that if my account is compromised no one can remove access without the original password

Additional context I think this feature could help prevent users that leave their account open in a shared device from other users de-authenticating them from their devices and therefore loosing access.

Guida contributor

Tech stack
php
Dominio
securityauthentication
Tipo issue
feature
DifficoltàQuanto dovrebbe essere impegnativa per un nuovo contributor.
3
Tempo stimatoTempo stimato per completare e verificare uno scope piccolo.
half day
Stato attivitàQuanto è probabile che la issue sia ancora attiva e reviewable.
fresh
ChiarezzaQuanto chiaramente la issue descrive problema, scope e risultato atteso.
clear
Prerequisiti
Nextcloud server basicsPHPAuthentication flow
Adatta ai principiantiQuanto la issue è adatta a contributor alla prima esperienza.
60
Direzione di ricerca
This issue requests adding a password confirmation step before removing devices or sessions. The implementation should modify the controller handling the removal to check the user's password. Look for existing password confirmation patterns in the server, such as during account deletion or sensitive settings changes. Files likely involved: lib/private/Authentication/ or apps/settings/lib/Controller/. Read comments on the issue for any additional context.