Merge pull request #29752 from nextcloud/fix/allow-some-pages-without-two-factor

Explicitly allow access on some (public) routes also without 2FA

Author: nickvergessen

core/Controller/OCJSController.php

@@ -98,6 +98,7 @@ public function __construct($appName,
 
 	/**
 	 * @NoCSRFRequired
+	 * @NoTwoFactorRequired
 	 * @PublicPage
 	 *
 	 * @return DataDisplayResponse

core/Middleware/TwoFactorMiddleware.php

@@ -83,6 +83,12 @@ public function __construct(Manager $twoFactorManager, Session $userSession, ISe
 	 * @param string $methodName
 	 */
 	public function beforeController($controller, $methodName) {
+		if ($this->reflector->hasAnnotation('NoTwoFactorRequired')) {
+			// Route handler explicitly marked to work without finished 2FA are
+			// not blocked
+			return;
+		}
+
 		if ($controller instanceof APIController && $methodName === 'poll') {
 			// Allow polling the twofactor nextcloud notifications state
 			return;