diff options
| author | Lukas Reschke <lukas@statuscode.ch> | 2017-03-10 18:14:38 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-03-10 18:14:38 +0100 |
| commit | f74911b6385991a69864dbae78091f2cb502d39e (patch) | |
| tree | 68a33d39d78daaf5b6feac982b42262f178dcb38 | |
| parent | 1045bf4a2bd6777cfc6ee818f562db7145eae70a (diff) | |
| parent | 9a8cef965f607fb8b73234fabcc5f47252e893cc (diff) | |
| download | nextcloud-server-f74911b6385991a69864dbae78091f2cb502d39e.tar.gz nextcloud-server-f74911b6385991a69864dbae78091f2cb502d39e.zip | |
Merge pull request #3787 from nextcloud/ocs-cookie
dont require strict same site cookies for ocs requests
| -rw-r--r-- | lib/private/AppFramework/Http/Request.php | 3 | ||||
| -rw-r--r-- | tests/lib/AppFramework/Http/RequestTest.php | 25 |
2 files changed, 28 insertions, 0 deletions
diff --git a/lib/private/AppFramework/Http/Request.php b/lib/private/AppFramework/Http/Request.php index be35f4d172f..fd43d468568 100644 --- a/lib/private/AppFramework/Http/Request.php +++ b/lib/private/AppFramework/Http/Request.php @@ -490,6 +490,9 @@ class Request implements \ArrayAccess, \Countable, IRequest { * @return bool */ private function cookieCheckRequired() { + if ($this->getHeader('OCS-APIREQUEST')) { + return false; + } if($this->getCookie(session_name()) === null && $this->getCookie('nc_token') === null) { return false; } diff --git a/tests/lib/AppFramework/Http/RequestTest.php b/tests/lib/AppFramework/Http/RequestTest.php index 6c6504b4de8..cc4bbee2d8d 100644 --- a/tests/lib/AppFramework/Http/RequestTest.php +++ b/tests/lib/AppFramework/Http/RequestTest.php @@ -1787,6 +1787,31 @@ class RequestTest extends \Test\TestCase { $this->assertFalse($request->passesLaxCookieCheck()); } + public function testSkipCookieCheckForOCSRequests() { + /** @var Request $request */ + $request = $this->getMockBuilder('\OC\AppFramework\Http\Request') + ->setMethods(['getScriptName']) + ->setConstructorArgs([ + [ + 'server' => [ + 'HTTP_REQUESTTOKEN' => 'AAAHGxsTCTc3BgMQESAcNR0OAR0=:MyTotalSecretShareds', + 'HTTP_OCS_APIREQUEST' => 'true', + ], + 'cookies' => [ + session_name() => 'asdf', + 'nc_sameSiteCookiestrict' => 'false', + ], + ], + $this->secureRandom, + $this->config, + $this->csrfTokenManager, + $this->stream + ]) + ->getMock(); + + $this->assertTrue($request->passesStrictCookieCheck()); + } + /** * @return array */ |