Merge pull request #62906 from nextcloud/backport/62884/stable32

[stable32] feat: Add setting to bypass password confirmation on a selected ip ranges

Author: CarlSchwan

config/config.sample.php

@@ -2477,6 +2477,20 @@
  */
 'allowed_admin_ranges' => ['192.0.2.42/32', '233.252.0.0/24', '2001:db8::13:37/64'],
 
+
+/**
+ * List of trusted IP ranges that can bypass password confirmation.
+ * If non-empty, all endpoints marked with the PasswordConfirmationRequired attribute
+ * won't need a password confirmation when originating from IPs within these ranges.
+ *
+ * Supported formats:
+ * - IPv4 addresses or ranges, e.g., ``192.0.2.42/32``, ``233.252.0.0/24``
+ * - IPv6 addresses or ranges, e.g., ``2001:db8::13:37/64``
+ *
+ * Defaults to ``[]`` (empty array)
+ */
+'allowed_no_password_confirmation_ranges' => ['192.0.2.42/32', '233.252.0.0/24', '2001:db8::13:37/64'],
+
 /**
  * Maximum file size (in megabytes) for animating GIFs on public sharing pages.
  * If a GIF exceeds this size, a static preview is shown.

lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php

@@ -21,6 +21,7 @@
 use OCP\IRequest;
 use OCP\ISession;
 use OCP\IUserSession;
+use OCP\Security\Ip\IRemoteAddress;
 use OCP\Session\Exceptions\SessionNotAvailableException;
 use OCP\User\Backend\IPasswordConfirmationBackend;
 use Psr\Log\LoggerInterface;
@@ -38,6 +39,7 @@ public function __construct(
 		private readonly LoggerInterface $logger,
 		private readonly IRequest $request,
 		private readonly Manager $userManager,
+		private readonly IRemoteAddress $remoteAddress,
 	) {
 	}
 
@@ -71,6 +73,10 @@ public function beforeController(Controller $controller, string $methodName) {
 				return;
 			}
 		} catch (SessionNotAvailableException|InvalidTokenException|WipeTokenException|ExpiredTokenException) {
+			if ($this->remoteAddress->allowsBypassPasswordConfirmation()) {
+				return;
+			}
+
 			// No scope to test
 		}
 

lib/private/Security/Ip/RemoteAddress.php

@@ -17,6 +17,7 @@
 
 class RemoteAddress implements IRemoteAddress, IAddress {
 	public const SETTING_NAME = 'allowed_admin_ranges';
+	public const SETTING_PASSWORD_CONFIRMATION_NAME = 'allowed_no_password_confirmation_ranges';
 
 	private readonly ?IAddress $ip;
 
@@ -65,6 +66,32 @@ public function allowsAdminActions(): bool {
 		return false;
 	}
 
+	#[\Override]
+	public function allowsBypassPasswordConfirmation(): bool {
+		if ($this->ip === null) {
+			return false;
+		}
+
+		$allowedAdminRanges = $this->config->getSystemValue(self::SETTING_PASSWORD_CONFIRMATION_NAME, false);
+
+		// Apply restrictions on empty or invalid configuration
+		if (
+			$allowedAdminRanges === false
+			|| !is_array($allowedAdminRanges)
+			|| empty($allowedAdminRanges)
+		) {
+			return false;
+		}
+
+		foreach ($allowedAdminRanges as $allowedAdminRange) {
+			if ((new Range($allowedAdminRange))->contains($this->ip)) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
 	public function __toString(): string {
 		return (string)$this->ip;
 	}

lib/public/Security/Ip/IRemoteAddress.php

@@ -19,4 +19,10 @@ interface IRemoteAddress {
 	 * @since 30.0.0
 	 */
 	public function allowsAdminActions(): bool;
+
+	/**
+	 * Check if the current remote address is allowed to bypass the password confirmation.
+	 * @since 35.0.0
+	 */
+	public function allowsBypassPasswordConfirmation(): bool;
 }

tests/lib/AppFramework/Middleware/Security/PasswordConfirmationMiddlewareTest.php

@@ -18,6 +18,8 @@
 use OCP\ISession;
 use OCP\IUser;
 use OCP\IUserSession;
+use OCP\Security\Ip\IRemoteAddress;
+use PHPUnit\Framework\MockObject\MockObject;
 use Psr\Log\LoggerInterface;
 use Test\AppFramework\Middleware\Security\Mock\PasswordConfirmationMiddlewareController;
 use Test\TestCase;
@@ -43,6 +45,7 @@ class PasswordConfirmationMiddlewareTest extends TestCase {
 	private IRequest $request;
 	/** @var Manager&\PHPUnit\Framework\MockObject\MockObject */
 	private Manager $userManager;
+	private IRemoteAddress&MockObject $remoteAddress;
 
 	protected function setUp(): void {
 		$this->reflector = new ControllerMethodReflector(\OCP\Server::get(LoggerInterface::class));
@@ -58,6 +61,7 @@ protected function setUp(): void {
 			'test',
 			$this->createMock(IRequest::class)
 		);
+		$this->remoteAddress = $this->createMock(IRemoteAddress::class);
 
 		$this->middleware = new PasswordConfirmationMiddleware(
 			$this->reflector,
@@ -68,6 +72,7 @@ protected function setUp(): void {
 			$this->logger,
 			$this->request,
 			$this->userManager,
+			$this->remoteAddress,
 		);
 	}