mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #20518 from nextcloud/backport/20505/stable16 

[stable16] do not advertise nulled userId for for systemwide credentials
This commit is contained in:
Roeland Jago Douma 2020-04-18 11:24:07 +02:00 committed by GitHub
parent 71090ff59d db32aeb99d
commit 33d472c72a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
lib/private/Security/CredentialsManager.php
View File

@ -53,7 +53,7 @@ class CredentialsManager implements ICredentialsManager {
/**
* Store a set of credentials
*
* @param string|null $userId Null for system-wide credentials
* @param string $userId empty string for system-wide credentials
* @param string $identifier
* @param mixed $credentials
*/
@ -61,7 +61,7 @@ class CredentialsManager implements ICredentialsManager {
$value = $this->crypto->encrypt(json_encode($credentials));
$this->dbConnection->setValues(self::DB_TABLE, [
'user' => $userId,
'user' => (string)$userId,
'identifier' => $identifier,
], [
'credentials' => $value,
@ -71,7 +71,7 @@ class CredentialsManager implements ICredentialsManager {
/**
* Retrieve a set of credentials
*
* @param string|null $userId Null for system-wide credentials
* @param string $userId empty string for system-wide credentials
* @param string $identifier
* @return mixed
*/
@ -79,7 +79,7 @@ class CredentialsManager implements ICredentialsManager {
$qb = $this->dbConnection->getQueryBuilder();
$qb->select('credentials')
->from(self::DB_TABLE)
->where($qb->expr()->eq('user', $qb->createNamedParameter($userId)))
->where($qb->expr()->eq('user', $qb->createNamedParameter((string)$userId)))
->andWhere($qb->expr()->eq('identifier', $qb->createNamedParameter($identifier)))
;
$result = $qb->execute()->fetch();
@ -95,14 +95,14 @@ class CredentialsManager implements ICredentialsManager {
/**
* Delete a set of credentials
*
* @param string|null $userId Null for system-wide credentials
* @param string $userId empty string for system-wide credentials
* @param string $identifier
* @return int rows removed
*/
public function delete($userId, $identifier) {
$qb = $this->dbConnection->getQueryBuilder();
$qb->delete(self::DB_TABLE)
->where($qb->expr()->eq('user', $qb->createNamedParameter($userId)))
->where($qb->expr()->eq('user', $qb->createNamedParameter((string)$userId)))
->andWhere($qb->expr()->eq('identifier', $qb->createNamedParameter($identifier)))
;
return $qb->execute();

6
lib/public/Security/ICredentialsManager.php
View File

@ -33,7 +33,7 @@ interface ICredentialsManager {
/**
* Store a set of credentials
*
* @param string|null $userId Null for system-wide credentials
* @param string $userId empty string for system-wide credentials
* @param string $identifier
* @param mixed $credentials
* @since 8.2.0
@ -43,7 +43,7 @@ interface ICredentialsManager {
/**
* Retrieve a set of credentials
*
* @param string|null $userId Null for system-wide credentials
* @param string $userId empty string for system-wide credentials
* @param string $identifier
* @return mixed
* @since 8.2.0
@ -53,7 +53,7 @@ interface ICredentialsManager {
/**
* Delete a set of credentials
*
* @param string|null $userId Null for system-wide credentials
* @param string $userId empty string for system-wide credentials
* @param string $identifier
* @return int rows removed
* @since 8.2.0

3
tests/lib/Security/CredentialsManagerTest.php
View File

@ -27,6 +27,9 @@ use \OCP\Security\ICrypto;
use \OCP\IDBConnection;
use \OC\Security\CredentialsManager;
/**
* @group DB
*/
class CredentialsManagerTest extends \Test\TestCase {
/** @var ICrypto */