wbrawner/server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #684 from nextcloud/fix_csrf_ocs

Browse source 
Fix OCS CSRF
This commit is contained in:
Lukas Reschke 2016-08-01 11:52:56 +02:00 committed by GitHub
commit 8a7d450fb5
2 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php
View file

@ -153,7 +153,7 @@ class SecurityMiddleware extends Middleware {
*/
if(!$this->request->passesCSRFCheck() && !(
$controller instanceof OCSController &&
$this->request->getHeader('OCS_APIREQUEST') === true)) {
$this->request->getHeader('OCS-APIREQUEST') === 'true')) {
throw new CrossSiteRequestForgeryException();
}
}

3
tests/lib/AppFramework/Middleware/Security/SecurityMiddlewareTest.php
View file

@ -383,7 +383,7 @@ class SecurityMiddlewareTest extends \Test\TestCase {
[$controller, true, true],
[$ocsController, false, true],
[$ocsController, true, true],
[$ocsController, true, false],
];
}
@ -396,6 +396,7 @@ class SecurityMiddlewareTest extends \Test\TestCase {
public function testCsrfOcsController(Controller $controller, $hasOcsApiHeader, $exception) {
$this->request
->method('getHeader')
->with('OCS-APIREQUEST')
->willReturn($hasOcsApiHeader ? 'true' : null);
$this->request->expects($this->once())
->method('passesStrictCookieCheck')