diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2016-01-25 17:15:54 +0100 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2016-01-25 20:03:40 +0100 |
| commit | a977465af5834a76b1e98854a2c9bfbe413c218c (patch) | |
| tree | 7a47d606f7935ac7de09fe8169188691cc9e4373 /lib/public | |
| parent | 37f5f5077a59d69723965d1345536d46605589f5 (diff) | |
| download | nextcloud-server-a977465af5834a76b1e98854a2c9bfbe413c218c.tar.gz nextcloud-server-a977465af5834a76b1e98854a2c9bfbe413c218c.zip | |
Add new CSRF manager for unit testing purposes
This adds a new CSRF manager for unit testing purposes, it's interface is based upon https://github.com/symfony/security-csrf. Due to some of our required custom changes it is however not possible to use the Symfony component directly.
Diffstat (limited to 'lib/public')
| -rw-r--r-- | lib/public/util.php | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/lib/public/util.php b/lib/public/util.php index 4762f595c2d..45df62ac735 100644 --- a/lib/public/util.php +++ b/lib/public/util.php @@ -480,18 +480,28 @@ class Util { } /** + * Cached encrypted CSRF token. Some static unit-tests of ownCloud compare + * multiple OC_Template elements which invoke `callRegister`. If the value + * would not be cached these unit-tests would fail. + * @var string + */ + private static $token = ''; + + /** * Register an get/post call. This is important to prevent CSRF attacks - * TODO: write example * @since 4.5.0 */ public static function callRegister() { - return(\OC_Util::callRegister()); + if(self::$token === '') { + self::$token = \OC::$server->getCsrfTokenManager()->getToken()->getEncryptedValue(); + } + return self::$token; } /** * Check an ajax get/post call if the request token is valid. exit if not. - * Todo: Write howto * @since 4.5.0 + * @deprecated 9.0.0 Use annotations based on the app framework. */ public static function callCheck() { if (!(\OC::$server->getRequest()->passesCSRFCheck())) { |