Merge pull request #46760 from nextcloud/fix/appframework/csrf-custom-header

2024-07-27 16:27:52 +07:00 · 2024-07-27 16:27:52 +07:00 · 0ae83d6183
parent 0f953c5cbd 9d1705259c
commit 0ae83d6183
2 changed files with 24 additions and 0 deletions
--- a/lib/private/AppFramework/Http/Request.php
+++ b/lib/private/AppFramework/Http/Request.php
@ -426,6 +426,10 @@ class Request implements \ArrayAccess, \Countable, IRequest {
 			return false;
 		}

+		if ($this->getHeader('OCS-APIRequest') !== '') {
+			return true;
+		}
+
 		if (isset($this->items['get']['requesttoken'])) {
 			$token = $this->items['get']['requesttoken'];
 		} elseif (isset($this->items['post']['requesttoken'])) {
--- a/tests/lib/AppFramework/Http/RequestTest.php
+++ b/tests/lib/AppFramework/Http/RequestTest.php
@ -2256,4 +2256,24 @@ class RequestTest extends \Test\TestCase {

 		$this->assertFalse($request->passesCSRFCheck());
 	}
+
+	public function testPassesCSRFCheckWithOCSAPIRequestHeader() {
+		/** @var Request $request */
+		$request = $this->getMockBuilder('\OC\AppFramework\Http\Request')
+			->setMethods(['getScriptName'])
+			->setConstructorArgs([
+				[
+					'server' => [
+						'HTTP_OCS_APIREQUEST' => 'true',
+					],
+				],
+				$this->requestId,
+				$this->config,
+				$this->csrfTokenManager,
+				$this->stream
+			])
+			->getMock();
+
+		$this->assertTrue($request->passesCSRFCheck());
+	}
 }