Administrative changes should be confirmed by an 2FA token instead of a password by default
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
Expected behavior
If the twofactor_u2f app has been installed and an external U2F key has been registered all password confirmation dialogs should be replaced by an U2F key confirmation.
Current behavior
If you're going to change a personal setting, a confirmation is usually be requested. Although the twofactor_u2f app has been installed and an external U2F key has been registered, the login password need to be entered manually instead of requesting a confirmation via the available U2F key.
Steps to reproduce
- Open the personal settings.
- Change e.g. the language setting.
- The login password need to be entered to confirm the change.
Environment
Server Configuration
OS: Linux 3.16.47
Web server: Apache2 2.4.29
Database: MariaDB 10.0.32
PHP version: 5.6.29
Nextcloud version: 12.0.3
Client Configuration
Browser: Mozilla Firefox 57.0
Operating system: Windows 7
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the personal-settings language-change flow described in the issue, then trace the password confirmation path and its integration with the installed twofactor_u2f app. Done means administrative confirmation dialogs use the registered external U2F key by default when it is available, while the described settings change still completes successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100