Allow only cookie auth to webdav

diff --git a/apps/dav/lib/connector/sabre/auth.php b/apps/dav/lib/connector/sabre/auth.php
index 7f4f4a531b139ee0d0d6c2f602304b15ab32251e..02b88390bada38053ede6c3a1389ed499913cfc5 100644 (file)
--- a/apps/dav/lib/connector/sabre/auth.php
+++ b/apps/dav/lib/connector/sabre/auth.php
@@ -151,7 +151,10 @@ class Auth extends AbstractBasic {
         */
        private function auth(RequestInterface $request, ResponseInterface $response) {
                if (\OC_User::handleApacheAuth() ||
-                       ($this->userSession->isLoggedIn() && is_null($this->session->get(self::DAV_AUTHENTICATED)))
+                       //Fix for broken webdav clients
+                       ($this->userSession->isLoggedIn() && is_null($this->session->get(self::DAV_AUTHENTICATED))) ||
+                       //Well behaved clients that only send the cookie are allowed
+                       ($this->userSession->isLoggedIn() && $this->session->get(self::DAV_AUTHENTICATED) === $this->userSession->getUser()->getUID() && $request->getHeader('Authorization') === null)
                ) {
                        $user = $this->userSession->getUser()->getUID();
                        \OC_Util::setupFS($user);

diff --git a/apps/dav/tests/unit/connector/sabre/auth.php b/apps/dav/tests/unit/connector/sabre/auth.php
index 217ff5fc3faf2cb95da1de5ddfcf36eed4ac72b2..5e1cdfb03d823a66d80a0a1644487a69fdae086c 100644 (file)
--- a/apps/dav/tests/unit/connector/sabre/auth.php
+++ b/apps/dav/tests/unit/connector/sabre/auth.php
@@ -21,6 +21,7 @@
 
 namespace OCA\DAV\Tests\Unit\Connector\Sabre;
 
+use OCP\IUser;
 use Test\TestCase;
 use OCP\ISession;
 use OCP\IUserSession;
@@ -29,6 +30,7 @@ use OCP\IUserSession;
  * Class Auth
  *
  * @package OCA\DAV\Connector\Sabre
+ * @group DB
  */
 class Auth extends TestCase {
        /** @var ISession */
@@ -330,21 +332,31 @@ class Auth extends TestCase {
                $httpResponse = $this->getMockBuilder('\Sabre\HTTP\ResponseInterface')
                        ->disableOriginalConstructor()
                        ->getMock();
+               /** @var IUser */
+               $user = $this->getMock('OCP\IUser');
+               $user->method('getUID')->willReturn('MyTestUser');
                $this->userSession
                        ->expects($this->any())
                        ->method('isLoggedIn')
                        ->will($this->returnValue(true));
+               $this->userSession
+                       ->expects($this->any())
+                       ->method('getUser')
+                       ->willReturn($user);
                $this->session
-                       ->expects($this->once())
+                       ->expects($this->atLeastOnce())
                        ->method('get')
                        ->with('AUTHENTICATED_TO_DAV_BACKEND')
                        ->will($this->returnValue('MyTestUser'));
                $httpRequest
-                       ->expects($this->once())
+                       ->expects($this->atLeastOnce())
                        ->method('getHeader')
                        ->with('Authorization')
                        ->will($this->returnValue(null));
-               $this->auth->check($httpRequest, $httpResponse);
+               $this->assertEquals(
+                       [true, 'principals/users/MyTestUser'],
+                       $this->auth->check($httpRequest, $httpResponse)
+               );
        }
 
        public function testAuthenticateValidCredentials() {