mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix login flow form actions 

So fun fact. Chrome considers a redirect after submitting a form part of
the form actions. Since we redirect to a new protocol (nc://login/).
Causing the form submission to work but the redirect failing hard.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
This commit is contained in:
Roeland Jago Douma 2019-08-10 19:27:01 +02:00
parent 11cf253f52
commit 6dc179ee12
No known key found for this signature in database
GPG Key ID: F941078878347C0C
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
core/Controller/ClientFlowLoginController.php
View File

@ -195,7 +195,10 @@ class ClientFlowLoginController extends Controller {
);
$this->session->set(self::stateName, $stateToken);
return new StandaloneTemplateResponse(
$csp = new Http\ContentSecurityPolicy();
$csp->addAllowedFormActionDomain('nc://*');
$response = new StandaloneTemplateResponse(
$this->appName,
'loginflow/authpicker',
[
@ -209,6 +212,9 @@ class ClientFlowLoginController extends Controller {
],
'guest'
);
$response->setContentSecurityPolicy($csp);
return $response;
}
/**
@ -234,7 +240,10 @@ class ClientFlowLoginController extends Controller {
$clientName = $client->getName();
}
return new StandaloneTemplateResponse(
$csp = new Http\ContentSecurityPolicy();
$csp->addAllowedFormActionDomain('nc://*');
$response = new StandaloneTemplateResponse(
$this->appName,
'loginflow/grant',
[
@ -248,6 +257,9 @@ class ClientFlowLoginController extends Controller {
],
'guest'
);
$response->setContentSecurityPolicy($csp);
return $response;
}
/**

6
tests/Core/Controller/ClientFlowLoginControllerTest.php
View File

@ -186,6 +186,9 @@ class ClientFlowLoginControllerTest extends TestCase {
],
'guest'
);
$csp = new Http\ContentSecurityPolicy();
$csp->addAllowedFormActionDomain('nc://*');
$expected->setContentSecurityPolicy($csp);
$this->assertEquals($expected, $this->clientFlowLoginController->showAuthPickerPage());
}
@ -245,6 +248,9 @@ class ClientFlowLoginControllerTest extends TestCase {
],
'guest'
);
$csp = new Http\ContentSecurityPolicy();
$csp->addAllowedFormActionDomain('nc://*');
$expected->setContentSecurityPolicy($csp);
$this->assertEquals($expected, $this->clientFlowLoginController->showAuthPickerPage('MyClientIdentifier'));
}