nextcloud/tests/lib/appframework
Lukas Reschke 202530f4f3
Soften the cookie check if no cookies are sent
When no cookies are sent it is not required to perform any check for the strict or lax cookie, it does not provide any significant security advantage.

It does however interfer with the Android client which requests thumbnails from the unofficial API at `/index.php/apps/files/api/v1/thumbnail/256/256/{filename}`. This endpoint expects the strict cookie to be existent to not leak the existence of files. The Android client authenticates against this endpoint using Basic Auth and without cookies in some cases at least. This will make these endpoints work again with such cases.

To test this issue the following cURL command once without the patch and once with:

> curl http://localhost/index.php/apps/files/api/v1/thumbnail/256/256/welcome.txt  -u admin -v

Without the patch the request is redirected (which the client does not obey) and with the patch the preview is returned.
2016-06-15 11:50:26 +02:00
..
controller Remove dependency on ICrypto + use XOR 2015-10-21 17:33:41 +02:00
db Use IQueryBuilder::PARAM_* instead of \PDO::PARAM_* 2016-02-29 09:44:40 +01:00
dependencyinjection Mock DIContainer to not hit the database 2015-11-30 10:55:05 +01:00
http Soften the cookie check if no cookies are sent 2016-06-15 11:50:26 +02:00
middleware Add Same Site Cookie protection 2016-06-10 17:15:43 +02:00
routing fix tests 2015-11-27 17:05:58 +01:00
utility Fix unit test 2015-12-24 09:20:26 +01:00
AppTest.php Make sure tests don't leave a stray directory behind 2016-02-03 12:57:22 +01:00