diff options
| author | Vincent Petry <pvince81@owncloud.com> | 2015-12-11 11:22:38 +0100 |
|---|---|---|
| committer | Vincent Petry <pvince81@owncloud.com> | 2015-12-11 11:22:38 +0100 |
| commit | 13ec2bda2d1eb826951e9e5336ecac6ff6d1d199 (patch) | |
| tree | 6238e57d039e07d75945524df0a9c2c68c8aec63 | |
| parent | df15d54db65a692f2ecf9307ae2a9b43c8fe0697 (diff) | |
| download | nextcloud-server-13ec2bda2d1eb826951e9e5336ecac6ff6d1d199.tar.gz nextcloud-server-13ec2bda2d1eb826951e9e5336ecac6ff6d1d199.zip | |
Properly check X-Requested-With header in case of multiple values
Saw this happening in IE8...
| -rw-r--r-- | apps/dav/lib/connector/sabre/auth.php | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/apps/dav/lib/connector/sabre/auth.php b/apps/dav/lib/connector/sabre/auth.php index 4f319770234..7f4f4a531b1 100644 --- a/apps/dav/lib/connector/sabre/auth.php +++ b/apps/dav/lib/connector/sabre/auth.php @@ -160,7 +160,7 @@ class Auth extends AbstractBasic { return [true, $this->principalPrefix . $user]; } - if (!$this->userSession->isLoggedIn() && $request->getHeader('X-Requested-With') === 'XMLHttpRequest') { + if (!$this->userSession->isLoggedIn() && in_array('XMLHttpRequest', explode(',', $request->getHeader('X-Requested-With')))) { // do not re-authenticate over ajax, use dummy auth name to prevent browser popup $response->addHeader('WWW-Authenticate','DummyBasic realm="' . $this->realm . '"'); $response->setStatus(401); |