From 2d0cc3404b3e63aaa7923d990ca42c27d24b7add Mon Sep 17 00:00:00 2001
From: tobiasKaminsky <tobias@kaminsky.me>
Date: Wed, 4 Feb 2026 09:47:28 +0100
Subject: [PATCH 1/2] If enforced server, allow QR scanner, but validate url

Signed-off-by: tobiasKaminsky <tobias@kaminsky.me>
---
 .../authentication/AuthenticatorActivity.java | 38 ++++++++++++++++++-
 app/src/main/res/values/strings.xml           |  1 +
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java b/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java
index 8caff5691b66..972a336c48ee 100644
--- a/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java
+++ b/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java
@@ -105,6 +105,8 @@
 import com.owncloud.android.utils.WebViewUtil;
 import com.owncloud.android.utils.theme.ViewThemeUtils;
 
+import org.jetbrains.annotations.NotNull;
+
 import java.io.InputStream;
 import java.net.URLDecoder;
 import java.util.ArrayList;
@@ -352,7 +354,6 @@ private void showEnforcedServers() {
         showAuthStatus();
         accountSetupBinding.hostUrlFrame.setVisibility(View.GONE);
         accountSetupBinding.hostUrlInputHelperText.setVisibility(View.GONE);
-        accountSetupBinding.scanQr.setVisibility(View.GONE);
         accountSetupBinding.serversSpinner.setVisibility(View.VISIBLE);
 
         ArrayAdapter<String> adapter = new ArrayAdapter<>(this, R.layout.enforced_servers_spinner);
@@ -650,6 +651,13 @@ public void parseAndLoginFromWebView(String dataString) {
             String prefix = getString(R.string.login_data_own_scheme) + PROTOCOL_SUFFIX + "login/";
             LoginUrlInfo loginUrlInfo = parseLoginDataUrl(prefix, dataString);
 
+            if (!checkAllowedServers(loginUrlInfo.getServer())) {
+                mServerStatusIcon = R.drawable.ic_alert;
+                mServerStatusText = getString(R.string.server_not_allowed);
+                showServerStatus();
+                return;
+            }
+
             if (accountSetupBinding != null) {
                 accountSetupBinding.hostUrlInput.setText("");
             }
@@ -660,10 +668,38 @@ public void parseAndLoginFromWebView(String dataString) {
             mServerStatusIcon = R.drawable.ic_alert;
             mServerStatusText = getString(R.string.qr_could_not_be_read);
             showServerStatus();
+            return;
         }
         checkOcServer();
     }
 
+    private boolean checkAllowedServers(@NotNull String server) {
+        String webviewLogin = getString(R.string.webview_login_url);
+
+        if (!webviewLogin.isEmpty()) {
+            if (webviewLogin.startsWith(server)) {
+                return true;
+            }
+        }
+
+        String enforcedServerList = getString(R.string.enforce_servers);
+
+        if (!enforcedServerList.isEmpty()) {
+            ArrayList<EnforcedServer> enforcedServers = new Gson().fromJson(enforcedServerList,
+                                                                            new TypeToken<ArrayList<EnforcedServer>>() {
+                                                                            }
+                                                                                .getType());
+
+            for (EnforcedServer enforcedServer : enforcedServers) {
+                if (enforcedServer.getUrl().startsWith(server)) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
     /**
      * parses a URI string and returns a login data object with the information from the URI string.
      *
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index c1589ad6f91d..fa3557334b9e 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -1638,4 +1638,5 @@
     <string name="player_control_view_play_pause_button_content_description">Play/Pause button</string>
     <string name="player_control_view_next_button_content_description">Next button</string>
     <string name="player_control_view_random_button_content_description">Random button</string>
+    <string name="server_not_allowed">Server not allowed</string>
 </resources>

From ba4d1b6b2e0e0d26c826914f4721e0541b89efa0 Mon Sep 17 00:00:00 2001
From: alperozturk96 <alper_ozturk@proton.me>
Date: Wed, 4 Feb 2026 11:52:08 +0100
Subject: [PATCH 2/2] fix codacy

Signed-off-by: alperozturk96 <alper_ozturk@proton.me>
---
 .../android/authentication/AuthenticatorActivity.java  | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java b/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java
index 972a336c48ee..667cf47e65f7 100644
--- a/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java
+++ b/app/src/main/java/com/owncloud/android/authentication/AuthenticatorActivity.java
@@ -105,8 +105,6 @@
 import com.owncloud.android.utils.WebViewUtil;
 import com.owncloud.android.utils.theme.ViewThemeUtils;
 
-import org.jetbrains.annotations.NotNull;
-
 import java.io.InputStream;
 import java.net.URLDecoder;
 import java.util.ArrayList;
@@ -673,13 +671,11 @@ public void parseAndLoginFromWebView(String dataString) {
         checkOcServer();
     }
 
-    private boolean checkAllowedServers(@NotNull String server) {
+    private boolean checkAllowedServers(@NonNull String server) {
         String webviewLogin = getString(R.string.webview_login_url);
 
-        if (!webviewLogin.isEmpty()) {
-            if (webviewLogin.startsWith(server)) {
-                return true;
-            }
+        if (!webviewLogin.isEmpty() && webviewLogin.startsWith(server)) {
+            return true;
         }
 
         String enforcedServerList = getString(R.string.enforce_servers);