fix(AppFramework): Allow requests with OCS-APIRequest header to pass CSRF checks

Signed-off-by: provokateurin <kate@provokateurin.de>

diff --git a/lib/private/AppFramework/Http/Request.php b/lib/private/AppFramework/Http/Request.php
index 0bd430545d42e55fbae0f4ccef95771640bfe6a7..f790dae226cb4108806fa0f67d6ab8d1a012484f 100644 (file)
--- a/lib/private/AppFramework/Http/Request.php
+++ b/lib/private/AppFramework/Http/Request.php
@@ -426,6 +426,10 @@ class Request implements \ArrayAccess, \Countable, IRequest {
                        return false;
                }
 
+               if ($this->getHeader('OCS-APIRequest') !== '') {
+                       return true;
+               }
+
                if (isset($this->items['get']['requesttoken'])) {
                        $token = $this->items['get']['requesttoken'];
                } elseif (isset($this->items['post']['requesttoken'])) {

diff --git a/tests/lib/AppFramework/Http/RequestTest.php b/tests/lib/AppFramework/Http/RequestTest.php
index f0e1f45902858aef4ce1f1c118124464884ec7f7..f97341cb265ef786a9fdbff497f7d2f4686b92cd 100644 (file)
--- a/tests/lib/AppFramework/Http/RequestTest.php
+++ b/tests/lib/AppFramework/Http/RequestTest.php
@@ -2256,4 +2256,24 @@ class RequestTest extends \Test\TestCase {
 
                $this->assertFalse($request->passesCSRFCheck());
        }
+
+       public function testPassesCSRFCheckWithOCSAPIRequestHeader() {
+               /** @var Request $request */
+               $request = $this->getMockBuilder('\OC\AppFramework\Http\Request')
+                       ->setMethods(['getScriptName'])
+                       ->setConstructorArgs([
+                               [
+                                       'server' => [
+                                               'HTTP_OCS_APIREQUEST' => 'true',
+                                       ],
+                               ],
+                               $this->requestId,
+                               $this->config,
+                               $this->csrfTokenManager,
+                               $this->stream
+                       ])
+                       ->getMock();
+
+               $this->assertTrue($request->passesCSRFCheck());
+       }
 }