From 9beb520e3c767f07afa5ae75aa83f04ea3844577 Mon Sep 17 00:00:00 2001
From: okxint <cashmein.eth@gmail.com>
Date: Tue, 21 Jul 2026 12:35:48 +0530
Subject: [PATCH] fix(core): prevent double-submit on login flow grant page

Add isSubmitting guard to onSubmit so the button is disabled and shows
a loading spinner as soon as the first submit fires. A second click
while the form is in-flight is dropped via event.preventDefault().

Fixes: #62327

Signed-off-by: okxint <cashmein.eth@gmail.com>
---
 core/src/views/LoginFlowGrant.vue | 33 +++++++++++++++++++++++++------
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/core/src/views/LoginFlowGrant.vue b/core/src/views/LoginFlowGrant.vue
index b2230bf9da69c..9e3518277e373 100644
--- a/core/src/views/LoginFlowGrant.vue
+++ b/core/src/views/LoginFlowGrant.vue
@@ -4,11 +4,13 @@
 -->
 
 <script setup lang="ts">
+import { ref } from 'vue'
 import { getRequestToken } from '@nextcloud/auth'
 import { loadState } from '@nextcloud/initial-state'
 import { t } from '@nextcloud/l10n'
 import { confirmPassword, isPasswordConfirmationRequired, PwdConfirmationMode } from '@nextcloud/password-confirmation'
 import NcButton from '@nextcloud/vue/components/NcButton'
+import NcLoadingIcon from '@nextcloud/vue/components/NcLoadingIcon'
 import NcNoteCard from '@nextcloud/vue/components/NcNoteCard'
 import LoginFlowContainer from '../components/LoginFlow/LoginFlowContainer.vue'
 
@@ -40,19 +42,31 @@ const {
 
 const requestToken = getRequestToken()
 
+const isSubmitting = ref(false)
+
 /**
  * Handle submit event to confirm password if required
  *
  * @param event - The submit event
  */
 async function onSubmit(event: SubmitEvent) {
-	if (isPasswordConfirmationRequired(PwdConfirmationMode.Lax)) {
+	if (isSubmitting.value) {
 		event.preventDefault()
-		event.stopPropagation()
+		return
+	}
+
+	isSubmitting.value = true
+	try {
+		if (isPasswordConfirmationRequired(PwdConfirmationMode.Lax)) {
+			event.preventDefault()
+			event.stopPropagation()
 
-		await confirmPassword()
-		;(event.target as HTMLFormElement).submit()
-		return false
+			await confirmPassword()
+			;(event.target as HTMLFormElement).submit()
+			return
+		}
+	} finally {
+		isSubmitting.value = false
 	}
 }
 </script>
@@ -90,7 +104,14 @@ async function onSubmit(event: SubmitEvent) {
 				name="providedRedirectUri"
 				:value="providedRedirectUri">
 
-			<NcButton :class="$style.loginFlowGrant__button" type="submit" variant="primary">
+			<NcButton
+				:class="$style.loginFlowGrant__button"
+				:disabled="isSubmitting"
+				type="submit"
+				variant="primary">
+				<template v-if="isSubmitting" #icon>
+					<NcLoadingIcon />
+				</template>
 				{{ t('core', 'Grant access') }}
 			</NcButton>
 		</form>