nextcloud/server

Ask for authentication before removing 'Device & Sessions'

Open

#39.390 aberto em 14 de jul. de 2023

Ver no GitHub
 (2 comments) (0 reactions) (0 assignees)PHP (34.953 stars) (4.865 forks)batch import
0. Needs triageenhancementfeature: authenticationfeature: settingsgood first issue

Description

Describe the solution you'd like As user I want to make sure that when I remove a device or session from my NextCloud account I'm prompted to authenticate with my password So that if my account is compromised no one can remove access without the original password

Additional context I think this feature could help prevent users that leave their account open in a shared device from other users de-authenticating them from their devices and therefore loosing access.

Guia do colaborador

Pilha de tecnologia
php
Domain
securityauthentication
Tipo Issue
feature
DifficultyDificuldade de implementação estimada para um novo contribuidor, de 1 para alterações muito pequenas a 5 para trabalho de nível especializado.
3
Tempo estimadoUm intervalo de tempo aproximado para um colaborador experiente investigar, implementar, testar e preparar um pull request.
half day
Status da atividadeQuão disponível o issue aparece agora: novo, ativo, obsoleto, bloqueado ou aguardando entrada do mantenedor.
fresh
ClarityCom que clareza o issue explica a mudança esperada, os critérios de aceitação e a próxima etapa.
clear
Prerequisites
Nextcloud server basicsPHPAuthentication flow
Simpatia para novatosUma pontuação de 1 a 100 que estima o quão acessível este issue é para colaboradores iniciantes.
60
Direção de pesquisa
This issue requests adding a password confirmation step before removing devices or sessions. The implementation should modify the controller handling the removal to check the user's password. Look for existing password confirmation patterns in the server, such as during account deletion or sensitive settings changes. Files likely involved: lib/private/Authentication/ or apps/settings/lib/Controller/. Read comments on the issue for any additional context.