mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #27013 from nextcloud/backport/27000/stable19 

[stable19] Harden apptoken check
This commit is contained in:
Roeland Jago Douma 2021-05-19 08:40:54 +02:00 committed by GitHub
parent 472d7686f3 e0d2ef32e8
commit 3249d4df3b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
apps/settings/lib/Controller/AuthSettingsController.php
View File

@ -121,6 +121,10 @@ class AuthSettingsController extends Controller {
* @return JSONResponse * @return JSONResponse
*/ */
public function create($name) { public function create($name) {
if ($this->checkAppToken()) {
return $this->getServiceNotAvailableResponse();
}
try { try {
$sessionId = $this->session->getId(); $sessionId = $this->session->getId();
} catch (SessionNotAvailableException $ex) { } catch (SessionNotAvailableException $ex) {
@ -181,6 +185,10 @@ class AuthSettingsController extends Controller {
return implode('-', $groups); return implode('-', $groups);
} }
private function checkAppToken(): bool {
return $this->session->exists('app_password');
}
/** /**
* @NoAdminRequired * @NoAdminRequired
* @NoSubadminRequired * @NoSubadminRequired
@ -189,6 +197,10 @@ class AuthSettingsController extends Controller {
* @return array|JSONResponse * @return array|JSONResponse
*/ */
public function destroy($id) { public function destroy($id) {
if ($this->checkAppToken()) {
return new JSONResponse([], Http::STATUS_BAD_REQUEST);
}
try { try {
$token = $this->findTokenByIdAndUser($id); $token = $this->findTokenByIdAndUser($id);
} catch (WipeTokenException $e) { } catch (WipeTokenException $e) {
@ -213,6 +225,10 @@ class AuthSettingsController extends Controller {
* @return array|JSONResponse * @return array|JSONResponse
*/ */
public function update($id, array $scope, string $name) { public function update($id, array $scope, string $name) {
if ($this->checkAppToken()) {
return new JSONResponse([], Http::STATUS_BAD_REQUEST);
}
try { try {
$token = $this->findTokenByIdAndUser($id); $token = $this->findTokenByIdAndUser($id);
} catch (InvalidTokenException $e) { } catch (InvalidTokenException $e) {
@ -287,6 +303,10 @@ class AuthSettingsController extends Controller {
* @throws \OC\Authentication\Exceptions\ExpiredTokenException * @throws \OC\Authentication\Exceptions\ExpiredTokenException
*/ */
public function wipe(int $id): JSONResponse { public function wipe(int $id): JSONResponse {
if ($this->checkAppToken()) {
return new JSONResponse([], Http::STATUS_BAD_REQUEST);
}
try { try {
$token = $this->findTokenByIdAndUser($id); $token = $this->findTokenByIdAndUser($id);
} catch (InvalidTokenException $e) { } catch (InvalidTokenException $e) {