Ask for authentication before removing 'Device & Sessions' · nextcloud/server#39390

(2 comments) (0 reactions) (0 assignees)PHP (34,953 stars) (4,865 forks)batch import

0. Needs triageenhancementfeature: authenticationfeature: settingsgood first issue

説明

Describe the solution you'd like As user I want to make sure that when I remove a device or session from my NextCloud account I'm prompted to authenticate with my password So that if my account is compromised no one can remove access without the original password

Additional context I think this feature could help prevent users that leave their account open in a shared device from other users de-authenticating them from their devices and therefore loosing access.

コントリビューターガイド

技術スタック: php
領域: securityauthentication
Issue 種別: feature
難度: 3
推定時間: half day
活動状況: fresh
明確さ: clear
前提条件: Nextcloud server basicsPHPAuthentication flow
初心者向け度: 60
調査方針: This issue requests adding a password confirmation step before removing devices or sessions. The implementation should modify the controller handling the removal to check the user's password. Look for existing password confirmation patterns in the server, such as during account deletion or sensitive settings changes. Files likely involved: lib/private/Authentication/ or apps/settings/lib/Controller/. Read comments on the issue for any additional context.