mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add bruteforce protection to the shareinfo endpoint 

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
This commit is contained in:
Roeland Jago Douma 2021-05-11 15:25:31 +02:00 committed by backportbot[bot]
parent b968ebfa87
commit 09affbb162
2 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
apps/files_sharing/lib/Controller/ShareInfoController.php
View File

@ -48,7 +48,7 @@ class ShareInfoController extends ApiController {
* @param IRequest $request
* @param IManager $shareManager
*/
public function __construct($appName,
public function __construct(string $appName,
IRequest $request,
IManager $shareManager) {
parent::__construct($appName, $request);
@ -59,26 +59,32 @@ class ShareInfoController extends ApiController {
/**
* @PublicPage
* @NoCSRFRequired
* @BruteForceProtection(action=shareinfo)
*
* @param string $t
* @param null $password
* @param null $dir
* @return JSONResponse
* @throws ShareNotFound
*/
public function info($t, $password = null, $dir = null) {
try {
$share = $this->shareManager->getShareByToken($t);
} catch (ShareNotFound $e) {
return new JSONResponse([], Http::STATUS_NOT_FOUND);
$response = new JSONResponse([], Http::STATUS_NOT_FOUND);
$response->throttle(['token' => $t]);
return $response;
}
if ($share->getPassword() && !$this->shareManager->checkPassword($share, $password)) {
return new JSONResponse([], Http::STATUS_FORBIDDEN);
$response = new JSONResponse([], Http::STATUS_FORBIDDEN);
$response->throttle(['token' => $t]);
return $response;
}
if (!($share->getPermissions() & Constants::PERMISSION_READ)) {
return new JSONResponse([], Http::STATUS_FORBIDDEN);
$response = new JSONResponse([], Http::STATUS_FORBIDDEN);
$response->throttle(['token' => $t]);
return $response;
}
$permissionMask = $share->getPermissions();

3
apps/files_sharing/tests/Controller/ShareInfoControllerTest.php
View File

@ -66,6 +66,7 @@ class ShareInfoControllerTest extends TestCase {
->willThrowException(new ShareNotFound());
$expected = new JSONResponse([], Http::STATUS_NOT_FOUND);
$expected->throttle(['token' => 'token']);
$this->assertEquals($expected, $this->controller->info('token'));
}
@ -82,6 +83,7 @@ class ShareInfoControllerTest extends TestCase {
->willReturn(false);
$expected = new JSONResponse([], Http::STATUS_FORBIDDEN);
$expected->throttle(['token' => 'token']);
$this->assertEquals($expected, $this->controller->info('token', 'pass'));
}
@ -100,6 +102,7 @@ class ShareInfoControllerTest extends TestCase {
->willReturn(true);
$expected = new JSONResponse([], Http::STATUS_FORBIDDEN);
$expected->throttle(['token' => 'token']);
$this->assertEquals($expected, $this->controller->info('token', 'pass'));
}