Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support endpoints with password confirmation #1492

Closed
provokateurin opened this issue Jan 21, 2024 · 9 comments
Closed

Support endpoints with password confirmation #1492

provokateurin opened this issue Jan 21, 2024 · 9 comments
Assignees
Labels
bug Something isn't working package: nextcloud

Comments

@provokateurin
Copy link
Member

To use those endpoints the password has to be entered by the user and sent to https://github.com/nextcloud/server/blob/1612d025cf21ac0ae70327c46dd59be66c096627/core/Controller/LoginController.php#L362.
This endpoint is currently not reachable for us and we would need to support CSRF endpoints too (which is some more work).
The better approach would probably be to open up the endpoint and allow us to use it.

@provokateurin
Copy link
Member Author

Let's see where this goes nextcloud/server#43000

@provokateurin
Copy link
Member Author

Ok, so this is actually a bug in the server auth logic. I will make a fix and then we have to wait for new releases of all the versions we support :/

@provokateurin
Copy link
Member Author

This will fix it nextcloud/server#43034

@provokateurin provokateurin added bug Something isn't working and removed feature New feature or request labels Jan 28, 2024
@provokateurin
Copy link
Member Author

In the end we went with nextcloud/server#43668.
We will have to handle the errors in a generic way to display the dialog to do the password confirmation. On unsupported versions we will just have to say that it is not possible to execute the action.

@Leptopoda
Copy link
Member

Is there any way we can unblock this?
You meant that it is only an issue when sending cookies; we should be able to patch our client to not send them (at least on non web platforms).

I think #1580 should make this really easy.

@provokateurin
Copy link
Member Author

No this is different from the WebDAV thing. There is no way around this, it will only be available on server 29+.

@provokateurin provokateurin added the blocked Blocked on other things label Mar 22, 2024
@provokateurin provokateurin removed the blocked Blocked on other things label May 7, 2024
@provokateurin
Copy link
Member Author

This can be implemented now (but only on 29+)

@provokateurin
Copy link
Member Author

I thought this would be not so easy to implement, but we can simply assume that only API endpoints called within wrapAction can trigger the password confirmation. We can simply catch the error there and show the dialog and afterwards retry. I first thought it would be necessary to mess around with the RequestManager so it also supports password confirmation for the cached endpoints, but that is simply not required.

@provokateurin
Copy link
Member Author

Actually done already, just not in the framework so far (I'm working on it).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working package: nextcloud
Projects
None yet
Development

No branches or pull requests

2 participants