Merge pull request #8648 from nextcloud/feature/csrf-token-controller
Use session heartbeat to update CSRF tokenpull/8741/head
Roeland Jago Douma
GitHub
commit
1329061d31
@ -0,0 +1,63 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
/**
|
||||
* @copyright 2017 Christoph Wurst <christoph@winzerhof-wurst.at>
|
||||
*
|
||||
* @author 2017 Christoph Wurst <christoph@winzerhof-wurst.at>
|
||||
*
|
||||
* @license GNU AGPL version 3 or any later version
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License as
|
||||
* published by the Free Software Foundation, either version 3 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OC\Core\Controller;
|
||||
|
||||
use OC\Security\CSRF\CsrfTokenManager;
|
||||
use OCP\AppFramework\Controller;
|
||||
use OCP\AppFramework\Http\JSONResponse;
|
||||
use OCP\IRequest;
|
||||
|
||||
class CSRFTokenController extends Controller {
|
||||
|
||||
/** @var CsrfTokenManager */
|
||||
private $tokenManager;
|
||||
|
||||
/**
|
||||
* @param string $appName
|
||||
* @param IRequest $request
|
||||
* @param CsrfTokenManager $tokenManager
|
||||
*/
|
||||
public function __construct(string $appName, IRequest $request,
|
||||
CsrfTokenManager $tokenManager) {
|
||||
parent::__construct($appName, $request);
|
||||
$this->tokenManager = $tokenManager;
|
||||
}
|
||||
|
||||
/**
|
||||
* @NoAdminRequired
|
||||
* @NoCSRFRequired
|
||||
* @PublicPage
|
||||
* @return JSONResponse
|
||||
*/
|
||||
public function index(): JSONResponse {
|
||||
$requestToken = $this->tokenManager->getToken();
|
||||
|
||||
return new JSONResponse([
|
||||
'token' => $requestToken->getEncryptedValue(),
|
||||
]);
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,71 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* @copyright 2017 Christoph Wurst <christoph@winzerhof-wurst.at>
|
||||
*
|
||||
* @author 2017 Christoph Wurst <christoph@winzerhof-wurst.at>
|
||||
*
|
||||
* @license GNU AGPL version 3 or any later version
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License as
|
||||
* published by the Free Software Foundation, either version 3 of the
|
||||
* License, or (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace Tests\Core\Controller;
|
||||
|
||||
use OC\Core\Controller\CSRFTokenController;
|
||||
use OC\Security\CSRF\CsrfToken;
|
||||
use OC\Security\CSRF\CsrfTokenManager;
|
||||
use OCP\AppFramework\Http;
|
||||
use OCP\AppFramework\Http\JSONResponse;
|
||||
use OCP\IRequest;
|
||||
use PHPUnit_Framework_MockObject_MockObject;
|
||||
use Test\TestCase;
|
||||
|
||||
class CSRFTokenControllerTest extends TestCase {
|
||||
|
||||
/** @var CSRFTokenController */
|
||||
private $controller;
|
||||
|
||||
/** @var IRequest|PHPUnit_Framework_MockObject_MockObject */
|
||||
private $request;
|
||||
|
||||
/** @var CsrfTokenManager|PHPUnit_Framework_MockObject_MockObject */
|
||||
private $tokenManager;
|
||||
|
||||
protected function setUp() {
|
||||
parent::setUp();
|
||||
|
||||
$this->request = $this->createMock(IRequest::class);
|
||||
$this->tokenManager = $this->createMock(CsrfTokenManager::class);
|
||||
|
||||
$this->controller = new CSRFTokenController('core', $this->request,
|
||||
$this->tokenManager);
|
||||
}
|
||||
|
||||
public function testGetToken() {
|
||||
$token = $this->createMock(CsrfToken::class);
|
||||
$this->tokenManager->method('getToken')->willReturn($token);
|
||||
$token->method('getEncryptedValue')->willReturn('toktok123');
|
||||
|
||||
$response = $this->controller->index();
|
||||
|
||||
$this->assertInstanceOf(JSONResponse::class, $response);
|
||||
$this->assertSame(Http::STATUS_OK, $response->getStatus());
|
||||
$this->assertEquals([
|
||||
'token' => 'toktok123'
|
||||
], $response->getData());
|
||||
}
|
||||
|
||||
}
|
||||
Loading…
Reference in New Issue