nextcloud/server

Ask for authentication before removing 'Device & Sessions'

Open

#39,390 建立於 2023年7月14日

在 GitHub 查看
 (2 留言) (0 反應) (0 負責人)PHP (34,953 star) (4,865 fork)batch import
0. Needs triageenhancementfeature: authenticationfeature: settingsgood first issue

描述

Describe the solution you'd like As user I want to make sure that when I remove a device or session from my NextCloud account I'm prompted to authenticate with my password So that if my account is compromised no one can remove access without the original password

Additional context I think this feature could help prevent users that leave their account open in a shared device from other users de-authenticating them from their devices and therefore loosing access.

貢獻者指南

技術棧
php
領域
securityauthentication
議題類型
feature
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
half day
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
fresh
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
Nextcloud server basicsPHPAuthentication flow
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
60
研究方向
This issue requests adding a password confirmation step before removing devices or sessions. The implementation should modify the controller handling the removal to check the user's password. Look for existing password confirmation patterns in the server, such as during account deletion or sensitive settings changes. Files likely involved: lib/private/Authentication/ or apps/settings/lib/Controller/. Read comments on the issue for any additional context.