From f16c9f42c65d784f5c394de4d19a6f58b525aaa3 Mon Sep 17 00:00:00 2001 From: Alexander Piskun Date: Mon, 2 Oct 2023 11:08:21 +0300 Subject: [PATCH 1/2] added CORS skip if session was created by AppAPI Signed-off-by: Alexander Piskun --- .../AppFramework/Middleware/Security/CORSMiddleware.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/private/AppFramework/Middleware/Security/CORSMiddleware.php b/lib/private/AppFramework/Middleware/Security/CORSMiddleware.php index 8bdacf550b6..145b412104c 100644 --- a/lib/private/AppFramework/Middleware/Security/CORSMiddleware.php +++ b/lib/private/AppFramework/Middleware/Security/CORSMiddleware.php @@ -91,6 +91,10 @@ class CORSMiddleware extends Middleware { if ($this->request->passesCSRFCheck()) { return; } + // Skip CORS check for requests with AppAPI auth. + if ($this->session->getSession()->get('app_api') === true) { + return; + } $this->session->logout(); try { if ($user === null || $pass === null || !$this->session->logClientIn($user, $pass, $this->request, $this->throttler)) { From 0b8a3b578d9be62da1d002f10e190855bb21998e Mon Sep 17 00:00:00 2001 From: Alexander Piskun Date: Fri, 6 Oct 2023 13:46:37 +0300 Subject: [PATCH 2/2] fixed Drone test Signed-off-by: Alexander Piskun --- .../AppFramework/Middleware/Security/CORSMiddleware.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/private/AppFramework/Middleware/Security/CORSMiddleware.php b/lib/private/AppFramework/Middleware/Security/CORSMiddleware.php index 145b412104c..f0d6ece8a93 100644 --- a/lib/private/AppFramework/Middleware/Security/CORSMiddleware.php +++ b/lib/private/AppFramework/Middleware/Security/CORSMiddleware.php @@ -38,6 +38,7 @@ use OCP\AppFramework\Http\JSONResponse; use OCP\AppFramework\Http\Response; use OCP\AppFramework\Middleware; use OCP\IRequest; +use OCP\ISession; use OCP\Security\Bruteforce\IThrottler; use ReflectionMethod; @@ -92,7 +93,7 @@ class CORSMiddleware extends Middleware { return; } // Skip CORS check for requests with AppAPI auth. - if ($this->session->getSession()->get('app_api') === true) { + if ($this->session->getSession() instanceof ISession && $this->session->getSession()->get('app_api') === true) { return; } $this->session->logout();