Andras BacsaiandClaude Opus 5.5 f75ffd329f fix(auth): let OAuth-only users enable 2FA without a password confirmation ...

Users with a linked OAuth identity or no password cannot confirm a
password they do not know. The password.confirm middleware now follows
User::requiresPasswordConfirmation(), like destructive actions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-02 16:01:10 +02:00

..

AddServerTimingHeaders.php

…

ApiAbility.php

…

ApiAllowed.php

…

ApiSensitiveData.php

…

Authenticate.php

…

CanAccessTerminal.php

…

CanCreateResources.php

…

CanUpdateResource.php

feat(auth): authorize sqlite databases with the database policy

2026-09-24 19:03:42 +02:00

CheckForcePasswordReset.php

…

DecideWhatToDoWithUser.php

refactor(auth): remove OAuth re-authentication for destructive actions

2026-09-30 21:37:02 +02:00

EncryptCookies.php

…

EnsureMcpEnabled.php

…

EnsureTeamMcpEnabled.php

…

EnsureTokenBelongsToCurrentTeamMember.php

…

PreventRequestsDuringMaintenance.php

…

RedirectIfAuthenticated.php

…

RequirePassword.php

fix(auth): let OAuth-only users enable 2FA without a password confirmation

2026-10-02 16:01:10 +02:00

TrimStrings.php

…

TrustProxies.php

…

ValidateSignature.php

…

VerifyCsrfToken.php

…