diff options
| author | Christoph Wurst <christoph@winzerhof-wurst.at> | 2021-11-17 18:42:21 +0100 |
|---|---|---|
| committer | Arthur Schiwon <blizzz@arthur-schiwon.de> | 2021-11-18 13:03:39 +0100 |
| commit | ea38a798f3c7982e25cf10df9a2fea9403ebec9f (patch) | |
| tree | fcf551e8cf14c6d53bfc1cd8079933eae710f5d0 /core | |
| parent | 7be83b23f4858e1901f11b2cda15b67a792e40e5 (diff) | |
| download | nextcloud-server-ea38a798f3c7982e25cf10df9a2fea9403ebec9f.tar.gz nextcloud-server-ea38a798f3c7982e25cf10df9a2fea9403ebec9f.zip | |
Explicitly allow some routes without 2FA
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
Diffstat (limited to 'core')
| -rw-r--r-- | core/Controller/OCJSController.php | 1 | ||||
| -rw-r--r-- | core/Middleware/TwoFactorMiddleware.php | 6 |
2 files changed, 7 insertions, 0 deletions
diff --git a/core/Controller/OCJSController.php b/core/Controller/OCJSController.php index 71f0941b46c..379b08bf22e 100644 --- a/core/Controller/OCJSController.php +++ b/core/Controller/OCJSController.php @@ -98,6 +98,7 @@ class OCJSController extends Controller { /** * @NoCSRFRequired + * @NoTwoFactorRequired * @PublicPage * * @return DataDisplayResponse diff --git a/core/Middleware/TwoFactorMiddleware.php b/core/Middleware/TwoFactorMiddleware.php index fbdb106b7bb..4c13a99a1aa 100644 --- a/core/Middleware/TwoFactorMiddleware.php +++ b/core/Middleware/TwoFactorMiddleware.php @@ -83,6 +83,12 @@ class TwoFactorMiddleware extends Middleware { * @param string $methodName */ public function beforeController($controller, $methodName) { + if ($this->reflector->hasAnnotation('NoTwoFactorRequired')) { + // Route handler explicitly marked to work without finished 2FA are + // not blocked + return; + } + if ($controller instanceof APIController && $methodName === 'poll') { // Allow polling the twofactor nextcloud notifications state return; |