[Bug][NC34] "Update all" button asks for password for every single app instead of once

[PeopleInside]

Bug description

Description:

Since upgrading to Nextcloud 34, the "Update all" function in the Apps management section requires password confirmation for each individual application rather than a single confirmation for the entire batch process.

Environment:

Nextcloud Server version: Nextcloud Hub 26 Spring (34.0.2)
Operating System: Ubuntu 24 LTS
Web server: Apache 2.4
PHP version: 8.5
Browser: Brave v1.93.134

Additional context:

This behavior appears to be a regression introduced in Nextcloud 34. Previously, the session authentication was sufficient for the duration of the bulk update, or a single re-confirmation was requested for the whole list. This change significantly impacts user experience when managing multiple applications.

Steps to reproduce

• Log in as an administrator.
• Navigate to Apps (Applications).
• Ensure there are multiple apps with available updates (e.g., 10 apps).
• Click the "Update all" button.
• Observe the password prompt.
• Enter the password for the first app.
• Observe that a new password prompt immediately appears for the second app, and so on, until all apps are updated.

Expected behavior

Expected behavior

The system should request the administrator's password only once to authorize the bulk update operation, as it did in versions prior to Nextcloud 34. The "Update all" button should function as a single atomic action.

Actual behavior:

The system interrupts the workflow by requesting password confirmation separately for every single app being updated (e.g., 10 prompts for 10 apps), making the bulk update feature practically unusable.

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.5

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

[q-wertz]

Not sure if related, but if one wants to abort the update and presses the "x", the popup just reoccurs (only one App update is aborted, not the "Update all")

[alkanex-xyz]

#61703

Is already discussed there. But comments there only gets hided so don't even try commenting the issue

[PeopleInside]

Thank you!
I try a search before create the issue but never found the right result.

It's bad and sad read some comment that say this is not a bug but an expected behaviour. It's really bad and if a solution will be not released I need to find how to change that. It's very annoying insert a long password 10 times for update 10 apps that can be updated more then once for week.

[alkanex-xyz]

I guess it will be changed, as the state was changed. But the don't all any comments or clarification there