diff options
| author | Côme Chilliet <come.chilliet@nextcloud.com> | 2024-03-07 18:39:38 +0100 |
|---|---|---|
| committer | Ferdinand Thiessen <opensource@fthiessen.de> | 2024-03-13 12:49:52 +0100 |
| commit | 310377e496ef049340e10b318bd9498b0fa85f0e (patch) | |
| tree | e299084ebabda7885e0a8a604ad595f0f3ec68c8 /apps/settings/lib | |
| parent | 1fffdf4763c04a04ba5defb53d6df451fe2a75f9 (diff) | |
| download | nextcloud-server-310377e496ef049340e10b318bd9498b0fa85f0e.tar.gz nextcloud-server-310377e496ef049340e10b318bd9498b0fa85f0e.zip | |
fix: Fix Security headers setup check behavior
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
Diffstat (limited to 'apps/settings/lib')
| -rw-r--r-- | apps/settings/lib/SetupChecks/SecurityHeaders.php | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/apps/settings/lib/SetupChecks/SecurityHeaders.php b/apps/settings/lib/SetupChecks/SecurityHeaders.php index d5239d5a1b1..9079df7e39b 100644 --- a/apps/settings/lib/SetupChecks/SecurityHeaders.php +++ b/apps/settings/lib/SetupChecks/SecurityHeaders.php @@ -70,7 +70,7 @@ class SecurityHeaders implements ISetupCheck { foreach ($urls as [$verb,$url,$validStatuses]) { $works = null; - foreach ($this->runRequest($url, $verb) as $response) { + foreach ($this->runRequest($url, $verb, ['httpErrors' => false]) as $response) { // Check that the response status matches if (!in_array($response->getStatusCode(), $validStatuses)) { $works = false; @@ -95,7 +95,7 @@ class SecurityHeaders implements ISetupCheck { } $referrerPolicy = $response->getHeader('Referrer-Policy'); - if ($referrerPolicy === null || !preg_match('/(no-referrer(-when-downgrade)?|strict-origin(-when-cross-origin)?|same-origin)(,|$)/', $referrerPolicy)) { + if (!preg_match('/(no-referrer(-when-downgrade)?|strict-origin(-when-cross-origin)?|same-origin)(,|$)/', $referrerPolicy)) { $msg .= $this->l10n->t( '- The `%1` HTTP header is not set to `%2`, `%3`, `%4`, `%5` or `%6`. This can leak referer information. See the {w3c-recommendation}.', [ @@ -118,6 +118,7 @@ class SecurityHeaders implements ISetupCheck { return SetupResult::warning($this->l10n->t('Some headers are not set correctly on your instance')."\n".$msg, descriptionParameters:$msgParameters); } // Skip the other requests if one works + $works = true; break; } // If 'works' is null then we could not connect to the server |