diff options
| author | Lukas Reschke <lukas@statuscode.ch> | 2016-12-09 17:46:05 +0100 |
|---|---|---|
| committer | Lukas Reschke <lukas@statuscode.ch> | 2016-12-09 18:01:45 +0100 |
| commit | 32bf8ec826dadbfd342627884fbdf83081db9b29 (patch) | |
| tree | cdaa5a962fc20203a8a3143f5e30674b8b5d77fb /lib/private/Installer.php | |
| parent | 0de83a3a0189a96338abd0345b70c89bc543bf49 (diff) | |
| download | nextcloud-server-32bf8ec826dadbfd342627884fbdf83081db9b29.tar.gz nextcloud-server-32bf8ec826dadbfd342627884fbdf83081db9b29.zip | |
Don't use cached informations for app version
When installing an app from the appstore the `\OC_App::getAppVersion` code is triggered twice:
- First when the downloader tries to compare the current version to the new version on the appstore to check if there is a newer version. This protects against downgrade attacks and is implemented in `\OC\Installer::downloadApp`.
- Second, when the app is actually installed the current version is written to the database. (`\OC\Installer::installApp`)
This fails however when the version is actually cached. Because in step 1 the cached version will be set to "0" and then be reused in the second step.
While this is probably not the cleanest version I assume this is an approach that is least invasive. Feedback and suggestions welcome :)
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
Diffstat (limited to 'lib/private/Installer.php')
| -rw-r--r-- | lib/private/Installer.php | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/private/Installer.php b/lib/private/Installer.php index db71f7b1432..38d0ce13684 100644 --- a/lib/private/Installer.php +++ b/lib/private/Installer.php @@ -121,7 +121,7 @@ class Installer { OC_App::executeRepairSteps($appId, $appData['repair-steps']['install']); //set the installed version - \OC::$server->getConfig()->setAppValue($info['id'], 'installed_version', OC_App::getAppVersion($info['id'])); + \OC::$server->getConfig()->setAppValue($info['id'], 'installed_version', OC_App::getAppVersion($info['id'], false)); \OC::$server->getConfig()->setAppValue($info['id'], 'enabled', 'no'); //set remote/public handlers |