From abfab44663412d9786104c614aa57ee6166c29ba Mon Sep 17 00:00:00 2001 From: Christoph Wurst Date: Wed, 17 Nov 2021 18:42:21 +0100 Subject: [PATCH] Explicitly allow some routes without 2FA Signed-off-by: Christoph Wurst --- core/Controller/OCJSController.php | 1 + core/Middleware/TwoFactorMiddleware.php | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/core/Controller/OCJSController.php b/core/Controller/OCJSController.php index c3a74733b98..9a4991ddd3e 100644 --- a/core/Controller/OCJSController.php +++ b/core/Controller/OCJSController.php @@ -99,6 +99,7 @@ class OCJSController extends Controller { /** * @NoCSRFRequired + * @NoTwoFactorRequired * @PublicPage * * @return DataDisplayResponse diff --git a/core/Middleware/TwoFactorMiddleware.php b/core/Middleware/TwoFactorMiddleware.php index c0e01cbe033..a6c8a131cee 100644 --- a/core/Middleware/TwoFactorMiddleware.php +++ b/core/Middleware/TwoFactorMiddleware.php @@ -84,6 +84,12 @@ class TwoFactorMiddleware extends Middleware { * @param string $methodName */ public function beforeController($controller, $methodName) { + if ($this->reflector->hasAnnotation('NoTwoFactorRequired')) { + // Route handler explicitly marked to work without finished 2FA are + // not blocked + return; + } + if ($controller instanceof APIController && $methodName === 'poll') { // Allow polling the twofactor nextcloud notifications state return;