[Bug]: "Update all apps" asks for password confirmation separately for every single app since NC34

[marcetto333]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

In Apps → Your apps → "Update all", the password-confirmation (sudo mode) dialog now pops up once per app. With several pending app updates you have to re-enter your password over and
over. Previously "Update all" asked for the password only once for the whole batch. This started after upgrading to Nextcloud 34 (from 33.0.5).

Steps to reproduce

1.Have several apps with pending updates.
2.Go to Apps → Your apps and click "Update all".
3.A password-confirmation prompt appears; enter the password.
4. The prompt appears again for the next app, and again for the next — one password prompt per app instead of one for the whole batch.

Expected behavior

Clicking "Update all" should require confirming the password only once, then update all pending apps in a single batch — not prompt for the password again for each individual app.

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
      "system": {
          "passwordsalt": "***REMOVED SENSITIVE VALUE***",
          "secret": "***REMOVED SENSITIVE VALUE***",
          "trusted_domains": [
              "nc",
              "cloud.example.tld",
              "192.168.x.x"
          ],
          "datadirectory": "***REMOVED SENSITIVE VALUE***",
          "dbtype": "mysql",
          "version": "34.0.1.2",
          "overwrite.cli.url": "https://cloud.example.tld",
          "dbname": "***REMOVED SENSITIVE VALUE***",
          "dbhost": "***REMOVED SENSITIVE VALUE***",
          "dbport": "",
          "dbtableprefix": "oc_",
          "mysql.utf8mb4": true,
          "dbuser": "***REMOVED SENSITIVE VALUE***",
          "dbpassword": "***REMOVED SENSITIVE VALUE***",
          "installed": true,
          "instanceid": "***REMOVED SENSITIVE VALUE***",
          "overwritehost": "cloud.example.tld",
          "activity_expire_days": 14,
          "allow_local_remote_servers": true,
          "auth.bruteforce.protection.enabled": true,
          "cron_log": true,
          "default_phone_region": "DE",
          "enable_previews": true,
          "filesystem_check_changes": 0,
          "filelocking.enabled": "true",
          "htaccess.RewriteBase": "/",
          "integrity.check.disabled": false,
          "knowledgebaseenabled": false,
          "loglevel": 2,
          "logtimezone": "Europe/Berlin",
          "memcache.local": "\\OC\\Memcache\\APCu",
          "memcache.locking": "\\OC\\Memcache\\Redis",
          "overwriteprotocol": "https",
          "maintenance_window_start": 1,
          "maintenance": false,
          "upgrade.disable-web": true

List of activated Apps

Enabled:
    - activity: 7.0.0
    - admin_audit: 1.24.0
    - app_api: 34.0.0
    - appstore: 1.0.0
    - audiocoverpreview: 0.12.1
    - audioplayer: 3.9.0
    - bruteforcesettings: 7.0.0
    - calendar: 6.5.0
    - circles: 34.0.0
    - cloud_federation_api: 1.18.0
    - comments: 1.24.0
    - contacts: 8.7.2
    - contactsinteraction: 1.15.0
    - csp_editor: 2.0.0
    - dashboard: 7.14.0
    - dav: 1.39.0
    - federatedfilesharing: 1.24.0
    - federation: 1.24.0
    - files: 2.6.0
    - files_automatedtagging: 5.0.0
    - files_downloadlimit: 5.2.0-dev.0
    - files_external: 1.26.0
    - files_lock: 34.0.0
    - files_pdfviewer: 7.0.0-dev.0
    - files_reminders: 1.7.0
    - files_sharing: 1.26.0
    - files_trashbin: 1.24.0
    - files_versions: 1.27.0
    - fileslibreofficeedit: 2.0.1
    - gpxpod: 8.2.1
    - groupfolders: 22.0.2
    - htmlviewer: 34.0.0
    - integration_google: 4.4.0
    - integration_paperless: 1.0.13
    - logreader: 7.0.0
    - lookup_server_connector: 1.22.0
    - mail: 5.10.5
    - markdownreadme: 1.0.3
    - music: 3.1.0
    - nextcloud_announcements: 6.0.0
    - notifications: 7.0.0-dev.1
    - notify_push: 1.3.3
    - oauth2: 1.22.0
    - office: 1.0.0
    - password_policy: 6.0.0-dev.0
    - photos: 7.0.0
    - privacy: 6.0.0-dev.1
    - profile: 1.3.0
    - provisioning_api: 1.24.0
    - recognize: 12.0.0
    - recommendations: 7.0.0
    - related_resources: 5.0.0-dev.0
    - richdocuments: 11.0.0
    - richdocumentscode: 26.4.104
    - serverinfo: 6.0.0
    - settings: 1.17.0
    - sharebymail: 1.24.0
    - systemtags: 1.24.0
    - text: 8.0.0
    - theming: 2.9.0
    - twofactor_backupcodes: 1.23.0
    - twofactor_totp: 16.0.0
    - updatenotification: 1.24.0
    - user_status: 1.14.0
    - viewer: 7.0.0-dev.0
    - weather_status: 1.14.0
    - webhook_listeners: 1.6.0
    - workflow_pdf_converter: 5.0.0
    - workflowengine: 2.16.0
  Disabled:
    - encryption: 2.22.0
    - user_ldap: 1.25.0
    (weitere deaktivierte Apps ausgelassen)

Nextcloud Signing status

Nextcloud Logs

Additional info

Note: two-factor authentication (twofactor_totp) is enabled on the account. When using "Update all" in Apps → Your apps, the password-confirmation (sudo mode) prompt re-appears for
every single app instead of once for the whole batch, so with ~68 enabled apps you have to re-enter the password over and over. This started after the major upgrade from 33.0.5 to
34.0.1.

[szaimen]

Cc @susnux

[susnux]

This is currently by design as every app update is its own code execution, meaning you install new "untrusted" code.
So you need to confirm this.

We are aware of this inconvenience and working on a more user friendly but equally secure solution.

[alkanex-xyz]

This is currently by design as every app update is its own code execution, meaning you install new "untrusted" code. So you need to confirm this.

We are aware of this inconvenience and working on a more user friendly but equally secure solution.

It's not really secure the way it is right now.

I can't see which update the password is prompted for. So there is no security enhancement by showing n times the same dialog without additional information.
The new dialog which shows the version changes is nice, but would be better if there was a changelog for the apps and probably the option to uncheck single apps.

But the password for every update app, especially without the notice which update is asking for the password, is just annoying and opens a vector for password phishing, as the users won't take care if the password request is valid. Please give at least the ability to disable additional prompts.

(BTW why can I update the instance even without password, when I have to enter the password for every app?)

[smartysmart34]

This is currently by design as every app update is its own code execution, meaning you install new "untrusted" code. So you need to confirm this.

Sorry but a password is not to confirm agreement, it is to ensure the user is the user, in this case the admin.
The admin is logged in -> needs password
The admin then decides to purposely click "Update ALL"
And then enter the password for any single app, without knowing which app he is confirming or which changes he is confirming for. Also: If it is about recognising the RISK, then at least provide information about THE ACTUAL RISK he is confirming.

To me, this is a half hearted features for the sake of the feature but without any thought about usability.
To me, a proper workflow would be:

• Admin clicks "Update all"
• A list of all the updates, which app goes from which version to which version, possibly a dropdown with the Changelog and/or some meaningful information about associated risk is shown.
• Each app can be selected or deselected based on the information
• A button at the end says "Update selected"
• Admin password requested
• Done

Anything less than that is not even industry standard.

I understand from your message above you are working on improvements and I kind of hope they are going into the direction I outlined. Until this is available, for the love of God, remove the current code, PLEASE.

P.S.: Apart from the above: I agree to the statement an APP poses a possible risk, being external code. With that said, the ONLY point to really actually confirm acceptance of the risk this imposes, would be during INSTALLATION of an App. Once I installed an app, questioning this consent for every subsequent update makes close to no sense to me.

[Albirew]

i don't wanna waste time waiting for the password prompt on each of the 15 apps updates, so, i stopped updating apps altogether, they updates automatically (and don't ask the password every time) when upgrading NxC.
well, it looks like that's what devs wanted anyway...