diff options
| author | Roeland Jago Douma <roeland@famdouma.nl> | 2016-08-01 08:52:50 +0200 |
|---|---|---|
| committer | Roeland Jago Douma <roeland@famdouma.nl> | 2016-08-01 08:52:50 +0200 |
| commit | 5c718b13b8c68fc89661edbdbd40822bb55f544a (patch) | |
| tree | 045d16ab15a1fbfd76f54d2c1e2ede69b91e24b8 | |
| parent | 50c8367041152ddd574ea283f0a9f08c192a646a (diff) | |
| download | nextcloud-server-5c718b13b8c68fc89661edbdbd40822bb55f544a.tar.gz nextcloud-server-5c718b13b8c68fc89661edbdbd40822bb55f544a.zip | |
We should properly check for 'true' instaed of the bool
| -rw-r--r-- | lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php | 2 | ||||
| -rw-r--r-- | tests/lib/AppFramework/Middleware/Security/SecurityMiddlewareTest.php | 3 |
2 files changed, 3 insertions, 2 deletions
diff --git a/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php b/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php index 08af42b5216..3bfef2df025 100644 --- a/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php +++ b/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php @@ -153,7 +153,7 @@ class SecurityMiddleware extends Middleware { */ if(!$this->request->passesCSRFCheck() && !( $controller instanceof OCSController && - $this->request->getHeader('OCS_APIREQUEST') === true)) { + $this->request->getHeader('OCS-APIREQUEST') === 'true')) { throw new CrossSiteRequestForgeryException(); } } diff --git a/tests/lib/AppFramework/Middleware/Security/SecurityMiddlewareTest.php b/tests/lib/AppFramework/Middleware/Security/SecurityMiddlewareTest.php index 6f675932135..bfd810bc6b9 100644 --- a/tests/lib/AppFramework/Middleware/Security/SecurityMiddlewareTest.php +++ b/tests/lib/AppFramework/Middleware/Security/SecurityMiddlewareTest.php @@ -383,7 +383,7 @@ class SecurityMiddlewareTest extends \Test\TestCase { [$controller, true, true], [$ocsController, false, true], - [$ocsController, true, true], + [$ocsController, true, false], ]; } @@ -396,6 +396,7 @@ class SecurityMiddlewareTest extends \Test\TestCase { public function testCsrfOcsController(Controller $controller, $hasOcsApiHeader, $exception) { $this->request ->method('getHeader') + ->with('OCS-APIREQUEST') ->willReturn($hasOcsApiHeader ? 'true' : null); $this->request->expects($this->once()) ->method('passesStrictCookieCheck') |