From 70546589f8e86e0b6dca079d631dc7905d6cf366 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Thu, 23 Jul 2026 10:24:27 +0200
Subject: [PATCH 1/2] fix(onetime-qrcode): Fix onetime QR code with 2FA enable

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 core/Controller/AppPasswordController.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/core/Controller/AppPasswordController.php b/core/Controller/AppPasswordController.php
index 1dbeaa66a4599..ee8ad99fd2fb2 100644
--- a/core/Controller/AppPasswordController.php
+++ b/core/Controller/AppPasswordController.php
@@ -16,6 +16,7 @@
 use OCP\AppFramework\Http\Attribute\ApiRoute;
 use OCP\AppFramework\Http\Attribute\BruteForceProtection;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoTwoFactorRequired;
 use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\Attribute\UseSession;
 use OCP\AppFramework\Http\DataResponse;
@@ -204,6 +205,7 @@ public function confirmUserPassword(string $password): DataResponse {
 	 * 200: App password returned
 	 */
 	#[NoAdminRequired]
+	#[NoTwoFactorRequired]
 	#[ApiRoute(verb: 'GET', url: '/getapppassword-onetime', root: '/core')]
 	public function getAppPasswordWithOneTimePassword(): DataResponse {
 		// Only allow with one-time app passwords

From 44b256e854feb25e69f445eb8fcf43db7756227a Mon Sep 17 00:00:00 2001
From: Carl Schwan <carl@carlschwan.eu>
Date: Thu, 23 Jul 2026 11:19:20 +0200
Subject: [PATCH 2/2] fix: Use NoTwoFactorRequired annotation instead of
 attribute

Co-authored-by: Carl Schwan <carl@carlschwan.eu>
Signed-off-by: Carl Schwan <carl@carlschwan.eu>
---
 core/Controller/AppPasswordController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/Controller/AppPasswordController.php b/core/Controller/AppPasswordController.php
index ee8ad99fd2fb2..9b015a1dd5d1a 100644
--- a/core/Controller/AppPasswordController.php
+++ b/core/Controller/AppPasswordController.php
@@ -201,11 +201,11 @@ public function confirmUserPassword(string $password): DataResponse {
 	 *
 	 * @return DataResponse<Http::STATUS_OK, array{apppassword: string}, array{}>
 	 * @throws OCSForbiddenException Creating app password is not allowed
+	 * @NoTwoFactorRequired
 	 *
 	 * 200: App password returned
 	 */
 	#[NoAdminRequired]
-	#[NoTwoFactorRequired]
 	#[ApiRoute(verb: 'GET', url: '/getapppassword-onetime', root: '/core')]
 	public function getAppPasswordWithOneTimePassword(): DataResponse {
 		// Only allow with one-time app passwords