mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #25628 from nextcloud/revert-25608-trusted-proxy-check-correct-header 

Revert "use the configured forwarded headers for the setup check"
This commit is contained in:
Roeland Jago Douma 2021-02-13 18:03:49 +01:00 committed by GitHub
parent 24d4c3eeab 7d8e9baa77
commit 9d987c0069
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 40 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
apps/settings/lib/Controller/CheckSetupController.php
View File

@ -309,14 +309,7 @@ class CheckSetupController extends Controller {
$trustedProxies = $this->config->getSystemValue('trusted_proxies', []); $trustedProxies = $this->config->getSystemValue('trusted_proxies', []);
$remoteAddress = $this->request->getHeader('REMOTE_ADDR'); $remoteAddress = $this->request->getHeader('REMOTE_ADDR');
$forwardedForHeaders = $this->config->getSystemValue('forwarded_for_headers', [ if (empty($trustedProxies) && $this->request->getHeader('X-Forwarded-Host') !== '') {
'HTTP_X_FORWARDED_FOR'
]);
$hasForwardedHeaderSet = array_reduce($forwardedForHeaders, function($set, $header) {
return $set || ($this->request->getHeader($header) !== '');
}, false);
if (empty($trustedProxies) && $hasForwardedHeaderSet) {
return false; return false;
} }

70
apps/settings/tests/Controller/CheckSetupControllerTest.php
View File

@ -329,37 +329,26 @@ class CheckSetupControllerTest extends TestCase {
} }
/** /**
* @dataProvider dataForwardedForHeaders * @dataProvider dataForwardedForHeadersWorking
* *
* @param string[] $trustedProxies * @param array $trustedProxies
* @param string $remoteAddrNotForwarded * @param string $remoteAddrNotForwarded
* @param string $remoteAddr * @param string $remoteAddr
* @param string[] $forwardedForHeaders
* @param array $requestHeaders
* @param bool $result * @param bool $result
*/ */
public function testForwardedForHeaders(array $trustedProxies, string $remoteAddrNotForwarded, string $remoteAddr, array $forwardedForHeaders, array $requestHeaders, bool $result) { public function testForwardedForHeadersWorking(array $trustedProxies, string $remoteAddrNotForwarded, string $remoteAddr, bool $result) {
$this->config->method('getSystemValue') $this->config->expects($this->once())
->willReturnCallback(function($key, $default) use ($forwardedForHeaders, $trustedProxies) { ->method('getSystemValue')
switch ($key) { ->with('trusted_proxies', [])
case 'forwarded_for_headers': ->willReturn($trustedProxies);
return $forwardedForHeaders;
case 'trusted_proxies':
return $trustedProxies;
default:
return $default;
}
});
$headers = array_merge(
['REMOTE_ADDR' => $remoteAddrNotForwarded],
$requestHeaders
);
$this->request->expects($this->atLeastOnce()) $this->request->expects($this->atLeastOnce())
->method('getHeader') ->method('getHeader')
->willReturnCallback(function($header) use ($headers) { ->willReturnMap([
return isset($headers[$header]) ? $headers[$header] : ''; ['REMOTE_ADDR', $remoteAddrNotForwarded],
}); ['X-Forwarded-Host', '']
$this->request->method('getRemoteAddress') ]);
$this->request->expects($this->any())
->method('getRemoteAddress')
->willReturn($remoteAddr); ->willReturn($remoteAddr);
$this->assertEquals( $this->assertEquals(
@ -368,18 +357,37 @@ class CheckSetupControllerTest extends TestCase {
); );
} }
public function dataForwardedForHeaders() { public function dataForwardedForHeadersWorking() {
return [ return [
// description => trusted proxies, getHeader('REMOTE_ADDR'), getRemoteAddr, expected result // description => trusted proxies, getHeader('REMOTE_ADDR'), getRemoteAddr, expected result
'no trusted proxies' => [[], '2.2.2.2', '2.2.2.2', ['HTTP_X_FORWARDED_FOR'], [], true], 'no trusted proxies' => [[], '2.2.2.2', '2.2.2.2', true],
'trusted proxy, remote addr not trusted proxy' => [['1.1.1.1'], '2.2.2.2', '2.2.2.2', ['HTTP_X_FORWARDED_FOR'], [], true], 'trusted proxy, remote addr not trusted proxy' => [['1.1.1.1'], '2.2.2.2', '2.2.2.2', true],
'trusted proxy, remote addr is trusted proxy, forwarded header working' => [['1.1.1.1'], '1.1.1.1', '2.2.2.2', ['HTTP_X_FORWARDED_FOR'], [], true], 'trusted proxy, remote addr is trusted proxy, x-forwarded-for working' => [['1.1.1.1'], '1.1.1.1', '2.2.2.2', true],
'trusted proxy, remote addr is trusted proxy, forwarded header not set' => [['1.1.1.1'], '1.1.1.1', '1.1.1.1', ['HTTP_X_FORWARDED_FOR'], [], false], 'trusted proxy, remote addr is trusted proxy, x-forwarded-for not set' => [['1.1.1.1'], '1.1.1.1', '1.1.1.1', false],
'no trusted proxies, but header present' => [[], '2.2.2.2', '2.2.2.2', ['HTTP_X_FORWARDED_FOR'], ['HTTP_X_FORWARDED_FOR' => '1.1.1.1'], false],
'no trusted proxies, different header present' => [[], '2.2.2.2', '2.2.2.2', ['HTTP_X_FORWARDED_FOR'], ['FORWARDED' => '1.1.1.1'], true],
]; ];
} }
public function testForwardedHostPresentButTrustedProxiesEmpty() {
$this->config->expects($this->once())
->method('getSystemValue')
->with('trusted_proxies', [])
->willReturn([]);
$this->request->expects($this->atLeastOnce())
->method('getHeader')
->willReturnMap([
['REMOTE_ADDR', '1.1.1.1'],
['X-Forwarded-Host', 'nextcloud.test']
]);
$this->request->expects($this->any())
->method('getRemoteAddress')
->willReturn('1.1.1.1');
$this->assertEquals(
false,
self::invokePrivate($this->checkSetupController, 'forwardedForHeadersWorking')
);
}
public function testCheck() { public function testCheck() {
$this->config->expects($this->at(0)) $this->config->expects($this->at(0))
->method('getAppValue') ->method('getAppValue')