All three are actually correct in English usage, ambiguous as that seems. No matter how you word it, the thing you are providing is the actual, functional direct object, while the person or thing you're providing it to is the indirect, even though the words might not make that obvious.
This would be less ambiguous in a language that had a separate dative case (like Latin or, I believe, Russian), where the thing or person you were giving something to would always be suffixed differently than the thing you were providing (which would be in the accusative case), and the word order wouldn't matter because noun cases would tell you which was which.
You need "of" in standard English.
Consider the following sentence:
The monster (that) I saw in the cave
was hideous.
That is a relative pronoun: it refers back to the monster (the antecedent), and it introduces a subordinate clause of which it is itself the object, that I saw in the cave (the relative clause). We could use what here:
What I saw in the cave was hideous.
As you see, what has swallowed its antecedent: the relative pronoun what always does that, because it always includes an antecedent. If the antecedent must be specified, what is impossible. Apart from that, it functions just like that or which. In your of sentence, if I were to replace your what by a that, it would look like this:
I can't confirm all of [the things]
that she said.
I was forced to supply the antecedent that was hidden within what, because that requires an antecedent. I made something up, these things. This all works fine. However, consider your sentence without of:
*I can't confirm all what he said.
If I replaced what, I'd get:
I can't confirm all [the things] that
he said.
This might look all right, but think about the antecedent: what is it here exactly? The problem is that the antecedent is not just the things, but also all: "what did he say? he said all the things; what can't I confirm? I can't confirm all the things". The adjective all is part of the antecedent, which is why it too should disappear if you use what:
I can't confirm what he said.
That is why your sentence without of doesn't work in standard English. There might be dialects in which this happens regularly, though. Normally it should be one of the following constructions:
I can't confirm all he said. (That is implicit.)
I can't confirm all of what he said.
I can't confirm what he said.
Best Answer
With is correct:
You can also request confirmation:
With this sense, you can also confirm something for someone:
That is, to act on their request for confirmation.