mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #16711 from nextcloud/fix/csp/form_actions/loginflow 

Fix login flow form actions
This commit is contained in:
Roeland Jago Douma 2019-08-12 08:24:53 +02:00 committed by GitHub
parent ec03059bfc 6dc179ee12
commit fced73aa37
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
core/Controller/ClientFlowLoginController.php
View File

@ -195,7 +195,10 @@ class ClientFlowLoginController extends Controller {
);
$this->session->set(self::stateName, $stateToken);
return new StandaloneTemplateResponse(
$csp = new Http\ContentSecurityPolicy();
$csp->addAllowedFormActionDomain('nc://*');
$response = new StandaloneTemplateResponse(
$this->appName,
'loginflow/authpicker',
[
@ -209,6 +212,9 @@ class ClientFlowLoginController extends Controller {
],
'guest'
);
$response->setContentSecurityPolicy($csp);
return $response;
}
/**
@ -234,7 +240,10 @@ class ClientFlowLoginController extends Controller {
$clientName = $client->getName();
}
return new StandaloneTemplateResponse(
$csp = new Http\ContentSecurityPolicy();
$csp->addAllowedFormActionDomain('nc://*');
$response = new StandaloneTemplateResponse(
$this->appName,
'loginflow/grant',
[
@ -248,6 +257,9 @@ class ClientFlowLoginController extends Controller {
],
'guest'
);
$response->setContentSecurityPolicy($csp);
return $response;
}
/**

6
tests/Core/Controller/ClientFlowLoginControllerTest.php
View File

@ -186,6 +186,9 @@ class ClientFlowLoginControllerTest extends TestCase {
],
'guest'
);
$csp = new Http\ContentSecurityPolicy();
$csp->addAllowedFormActionDomain('nc://*');
$expected->setContentSecurityPolicy($csp);
$this->assertEquals($expected, $this->clientFlowLoginController->showAuthPickerPage());
}
@ -245,6 +248,9 @@ class ClientFlowLoginControllerTest extends TestCase {
],
'guest'
);
$csp = new Http\ContentSecurityPolicy();
$csp->addAllowedFormActionDomain('nc://*');
$expected->setContentSecurityPolicy($csp);
$this->assertEquals($expected, $this->clientFlowLoginController->showAuthPickerPage('MyClientIdentifier'));
}