mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add workaround for older instances 

To be removed with oCAdd workaround for older instances

To be removed with oC99
This commit is contained in:
Lukas Reschke 2014-12-03 21:13:27 +01:00
parent 69f5f6649e
commit b3515a98e9
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
lib/private/request.php
View File

@ -86,13 +86,13 @@ class OC_Request {
* of trusted domains. If no trusted domains have been configured, returns
* true.
* This is used to prevent Host Header Poisoning.
* @param string $domain
* @param string $domainWithPort
* @return bool true if the given domain is trusted or if no trusted domains
* have been configured
*/
public static function isTrustedDomain($domain) {
public static function isTrustedDomain($domainWithPort) {
// Extract port from domain if needed
$domain = self::getDomainWithoutPort($domain);
$domain = self::getDomainWithoutPort($domainWithPort);
// FIXME: Empty config array defaults to true for now. - Deprecate this behaviour with ownCloud 8.
$trustedList = \OC::$server->getConfig()->getSystemValue('trusted_domains', array());
@ -100,6 +100,11 @@ class OC_Request {
return true;
}
// FIXME: Workaround for older instances still with port applied. Remove for ownCloud 9.
if(in_array($domainWithPort, $trustedList)) {
return true;
}
// Always allow access from localhost
if (preg_match(self::REGEX_LOCALHOST, $domain) === 1) {
return true;