mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

We should properly check for 'true' instaed of the bool

This commit is contained in:
Roeland Jago Douma 2016-08-01 08:52:50 +02:00
parent 50c8367041
commit 5c718b13b8
No known key found for this signature in database
GPG Key ID: 1E152838F164D13B
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php
View File

@ -153,7 +153,7 @@ class SecurityMiddleware extends Middleware {
*/
if(!$this->request->passesCSRFCheck() && !(
$controller instanceof OCSController &&
$this->request->getHeader('OCS_APIREQUEST') === true)) {
$this->request->getHeader('OCS-APIREQUEST') === 'true')) {
throw new CrossSiteRequestForgeryException();
}
}

3
tests/lib/AppFramework/Middleware/Security/SecurityMiddlewareTest.php
View File

@ -383,7 +383,7 @@ class SecurityMiddlewareTest extends \Test\TestCase {
[$controller, true, true],
[$ocsController, false, true],
[$ocsController, true, true],
[$ocsController, true, false],
];
}
@ -396,6 +396,7 @@ class SecurityMiddlewareTest extends \Test\TestCase {
public function testCsrfOcsController(Controller $controller, $hasOcsApiHeader, $exception) {
$this->request
->method('getHeader')
->with('OCS-APIREQUEST')
->willReturn($hasOcsApiHeader ? 'true' : null);
$this->request->expects($this->once())
->method('passesStrictCookieCheck')