Updating Applications now requires Authentication?

ℹ️ Support
1
Support intro

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 34.0.1
  • Operating system and version (e.g., Ubuntu 24.04):
    • Debian 13
  • Web server and version (e.g, Apache 2.4.25):
    • 2.4.68
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • 1.31.3
  • PHP version (e.g, 8.3):
    • 8.3
  • Is this the first time you’ve seen this error? (Yes / No):
    • Yes
  • When did this problem seem to first start?
    • today
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • Bare Metal
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • No

Summary of the issue you are facing:

I upgraded to 34 (running 34.0.1 now) some weeks ago. Today I wanted to update the installed apps (like cookbook, calendar, etc.) but as soon I hit the “update to..” or “update all applications” button NC prompts for a password authentication.

This was the first time I encounter this behavior and as I’m always hesitant to enter passwords in fields which never were there before, I wanted to ask if this authentication prompt is really on purpose in NC 34.

I found something in the 34.0.0 changelog ( fix(apppasswords): Require password also on delete and update by nickvergessen · Pull Request #59602 · nextcloud/server · GitHub ) which seems be responsible for the authentication prompt. But as it is not 100% clear (at least to me) … I decided to create this thread. Especially because the “Apps Management” section at https://docs.nextcloud.com/ Administration Manual doesn’t mention authentication for updating apps.

Greetings
Hoiba

Steps to replicate it (hint: details matter!):

  1. Update an Application

2

For a few administrative task they require to re-enter the admin password. Not sure if there is a timer or something that if you do it directly after login that it is not required.

3

Up until NC34, when I updated multiple apps, I only had to enter the password for the first one. Since NC34, I have to enter the password for every single app…

I don’t know if this is by design or a bug…

4

I can’t say for sure whether it’s a bug, but the behavior is the same on all my Nextcloud instances.

It’s fine as long as it’s not all the apps; if they all needed an update at once, it would get really annoying.

5

Definitely looks like a bug. Demanding another password check for app updates after already logged in is one thing, but, when already offering an ‘update all’ button, then still asking for the password for every single app after clicking it does not seem to be what the developers wanted to do…