diff options
| -rw-r--r-- | core/Controller/ClientFlowLoginController.php | 16 | ||||
| -rw-r--r-- | tests/Core/Controller/ClientFlowLoginControllerTest.php | 6 |
2 files changed, 20 insertions, 2 deletions
diff --git a/core/Controller/ClientFlowLoginController.php b/core/Controller/ClientFlowLoginController.php index 748139fe832..f049f282ce8 100644 --- a/core/Controller/ClientFlowLoginController.php +++ b/core/Controller/ClientFlowLoginController.php @@ -195,7 +195,10 @@ class ClientFlowLoginController extends Controller { ); $this->session->set(self::stateName, $stateToken); - return new StandaloneTemplateResponse( + $csp = new Http\ContentSecurityPolicy(); + $csp->addAllowedFormActionDomain('nc://*'); + + $response = new StandaloneTemplateResponse( $this->appName, 'loginflow/authpicker', [ @@ -209,6 +212,9 @@ class ClientFlowLoginController extends Controller { ], 'guest' ); + + $response->setContentSecurityPolicy($csp); + return $response; } /** @@ -234,7 +240,10 @@ class ClientFlowLoginController extends Controller { $clientName = $client->getName(); } - return new StandaloneTemplateResponse( + $csp = new Http\ContentSecurityPolicy(); + $csp->addAllowedFormActionDomain('nc://*'); + + $response = new StandaloneTemplateResponse( $this->appName, 'loginflow/grant', [ @@ -248,6 +257,9 @@ class ClientFlowLoginController extends Controller { ], 'guest' ); + + $response->setContentSecurityPolicy($csp); + return $response; } /** diff --git a/tests/Core/Controller/ClientFlowLoginControllerTest.php b/tests/Core/Controller/ClientFlowLoginControllerTest.php index 73b8118a876..f35b616a68e 100644 --- a/tests/Core/Controller/ClientFlowLoginControllerTest.php +++ b/tests/Core/Controller/ClientFlowLoginControllerTest.php @@ -186,6 +186,9 @@ class ClientFlowLoginControllerTest extends TestCase { ], 'guest' ); + $csp = new Http\ContentSecurityPolicy(); + $csp->addAllowedFormActionDomain('nc://*'); + $expected->setContentSecurityPolicy($csp); $this->assertEquals($expected, $this->clientFlowLoginController->showAuthPickerPage()); } @@ -245,6 +248,9 @@ class ClientFlowLoginControllerTest extends TestCase { ], 'guest' ); + $csp = new Http\ContentSecurityPolicy(); + $csp->addAllowedFormActionDomain('nc://*'); + $expected->setContentSecurityPolicy($csp); $this->assertEquals($expected, $this->clientFlowLoginController->showAuthPickerPage('MyClientIdentifier')); } |