Properly check for empty basic auth when trying to log in a user on CORS annotated endpoints

Signed-off-by: Julius Härtl <jus@bitgrid.net>

lib/private/AppFramework/Middleware/Security/CORSMiddleware.php

@@ -88,9 +88,13 @@ class CORSMiddleware extends Middleware {
 			$user = $this->request->server['PHP_AUTH_USER'];
 			$pass = $this->request->server['PHP_AUTH_PW'];
 
+			// Allow to use the current session if a CSRF token is provided
+			if ($this->request->passesCSRFCheck()) {
+				return;
+			}
 			$this->session->logout();
 			try {
-				if (!$this->session->logClientIn($user, $pass, $this->request, $this->throttler)) {
+				if (!empty($user) && !empty($pass) && !$this->session->logClientIn($user, $pass, $this->request, $this->throttler)) {
 					throw new SecurityException('CORS requires basic auth', Http::STATUS_UNAUTHORIZED);
 				}
 			} catch (PasswordLoginForbiddenException $ex) {

lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php

@@ -46,6 +46,7 @@ use OC\AppFramework\Middleware\Security\Exceptions\StrictCookieMissingException;
 use OC\AppFramework\Utility\ControllerMethodReflector;
 use OCP\App\AppPathNotFoundException;
 use OCP\App\IAppManager;
+use OCP\AppFramework\ApiController;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http\JSONResponse;
 use OCP\AppFramework\Http\RedirectResponse;
@@ -170,13 +171,16 @@ class SecurityMiddleware extends Middleware {
 			 *
 			 * Additionally we allow Bearer authenticated requests to pass on OCS routes.
 			 * This allows oauth apps (e.g. moodle) to use the OCS endpoints
+			 * CORS routes are also allowed to pass since the authentication and possible required
+			 * CSRF token check is handled in the CORSMiddleware
 			 */
-			if(!$this->request->passesCSRFCheck() && !(
-					$controller instanceof OCSController && (
+			if (!$this->request->passesCSRFCheck()
+				&& !($controller instanceof ApiController && $this->reflector->hasAnnotation('CORS'))
+				&& !($controller instanceof OCSController && (
 					$this->request->getHeader('OCS-APIREQUEST') === 'true' ||
-						strpos($this->request->getHeader('Authorization'), 'Bearer ') === 0
+					strpos($this->request->getHeader('Authorization'), 'Bearer ') === 0)
 				)
-				)) {
+			) {
 				throw new CrossSiteRequestForgeryException();
 			}
 		}