From 26832ec5da999068ef838f570c7a3ba912c47cdf Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Tue, 22 Aug 2023 16:00:39 +0200 Subject: fix(middleware): Fix header injection for bruteforce middleware Calling setHeaders(getHeaders()) breaks the CSP nonce for unknown reasons So shifting back to old standard practise for now Signed-off-by: Joas Schilling --- .../AppFramework/Middleware/Security/BruteForceMiddleware.php | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'lib/private/AppFramework') diff --git a/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php b/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php index 6a943af2a1f..a0b915588ad 100644 --- a/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php +++ b/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php @@ -130,11 +130,7 @@ class BruteForceMiddleware extends Middleware { } if ($this->delaySlept) { - $headers = $response->getHeaders(); - if (!isset($headers['X-Nextcloud-Bruteforce-Throttled'])) { - $headers['X-Nextcloud-Bruteforce-Throttled'] = $this->delaySlept . 'ms'; - $response->setHeaders($headers); - } + $response->addHeader('X-Nextcloud-Bruteforce-Throttled', $this->delaySlept . 'ms'); } return parent::afterController($controller, $methodName, $response); -- cgit v1.2.3