Limit to Groups still displays TOTP second-factor auth in all users' settings

[72Zn]

When the App is limited to specific groups, the security settings page of all users still shows the option:

TOTP second-factor auth
[ ] Enable TOTP

Checking the checkbox on an account not in any enabled group results in a reload and automatic unchecking.

Steps to reproduce:

1. as admin user goto Apps -> Security and enable 'Two Factor TOTP Provider'
2. Goto Apps -> Enabled apps
   • find 'Two Factor TOTP Provider'
   • check 'limit to groups', choose group 'admin'
3. Login as normal user
4. Goto settings -> security page
   • scroll down, find 'TOTP second-factor auth' and click 'Enable TOTP'

This might not be a big problem in a private setting, however in a corporate environment that leads to irritated users calling for support.

[ChristophWurst]

Does this only affect TOTP or do other apps load as well even though they are just enabled for a specific group. Could you please check? Thanks.

[72Zn]

I tested the 'Two Factor U2F' App. It seems to have the same problem. Except here I get an error: "Cannot read property 'appId' of undefined" when clicking on 'Add U2F device'. So maybe it's not an App issue, but a core problem?

[ChristophWurst]

So maybe it's not an App issue, but a core problem?

Smells like one, yes. Would you mind opening a ticket in the server repo at https://github.com/nextcloud/server/issues/new? If it's indeed a server issue we should look into that.

Thanks a lot for reporting this!

[ChristophWurst]

This actually might be an issue with the settings pages. @blizzz is it possible that we're showing settings sections for all apps, not just the ones that are enabled for a user?

[blizzz]

@ChristophWurst i expect the settings class won't be loaded when the app is not. I did not try to reproduce it yet.

[ChristophWurst]

Okay, no worries. I'll try to find some time next week to give this a test run. Thanks for your input.

[72Zn]

I opened an issue in the server repo:
nextcloud/server#10051