mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #27012 from nextcloud/backport/27000/stable21 

[stable21] Harden apptoken check
This commit is contained in:
Roeland Jago Douma 2021-05-19 08:41:06 +02:00 committed by GitHub
parent f5e5b07d05 e3090136b8
commit 51e279918f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
apps/settings/lib/Controller/AuthSettingsController.php
View File

@ -121,6 +121,10 @@ class AuthSettingsController extends Controller {
* @return JSONResponse
*/
public function create($name) {
if ($this->checkAppToken()) {
return $this->getServiceNotAvailableResponse();
}
try {
$sessionId = $this->session->getId();
} catch (SessionNotAvailableException $ex) {
@ -181,6 +185,10 @@ class AuthSettingsController extends Controller {
return implode('-', $groups);
}
private function checkAppToken(): bool {
return $this->session->exists('app_password');
}
/**
* @NoAdminRequired
* @NoSubAdminRequired
@ -189,6 +197,10 @@ class AuthSettingsController extends Controller {
* @return array|JSONResponse
*/
public function destroy($id) {
if ($this->checkAppToken()) {
return new JSONResponse([], Http::STATUS_BAD_REQUEST);
}
try {
$token = $this->findTokenByIdAndUser($id);
} catch (WipeTokenException $e) {
@ -213,6 +225,10 @@ class AuthSettingsController extends Controller {
* @return array|JSONResponse
*/
public function update($id, array $scope, string $name) {
if ($this->checkAppToken()) {
return new JSONResponse([], Http::STATUS_BAD_REQUEST);
}
try {
$token = $this->findTokenByIdAndUser($id);
} catch (InvalidTokenException $e) {
@ -287,6 +303,10 @@ class AuthSettingsController extends Controller {
* @throws \OC\Authentication\Exceptions\ExpiredTokenException
*/
public function wipe(int $id): JSONResponse {
if ($this->checkAppToken()) {
return new JSONResponse([], Http::STATUS_BAD_REQUEST);
}
try {
$token = $this->findTokenByIdAndUser($id);
} catch (InvalidTokenException $e) {