upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-02-03 20:41:22 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 33

Merge pull request #58013 from nextcloud/backport/58009/stable32

Browse source 
[stable32] fix(federation): Don't ask the database for an empty url
This commit is contained in:
Joas Schilling 2026-02-03 11:11:54 +01:00 committed by GitHub
commit 40a4e6f7bd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 18 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
apps/federation/lib/Controller/OCSAuthAPIController.php
View file

@ -163,7 +163,10 @@ class OCSAuthAPIController extends OCSController {
}
protected function isValidToken(string $url, string $token): bool {
if ($url === '' || $token === '') {
return false;
}
$storedToken = $this->dbHandler->getToken($url);
return hash_equals($storedToken, $token);
return $storedToken !== '' && hash_equals($storedToken, $token);
}
}

32
apps/federation/tests/Controller/OCSAuthAPIControllerTest.php
View file

@ -110,28 +110,24 @@ class OCSAuthAPIControllerTest extends TestCase {
$token = 'token';
/** @var OCSAuthAPIController&MockObject $ocsAuthApi */
$ocsAuthApi = $this->getMockBuilder(OCSAuthAPIController::class)
->setConstructorArgs(
[
'federation',
$this->request,
$this->secureRandom,
$this->jobList,
$this->trustedServers,
$this->dbHandler,
$this->logger,
$this->timeFactory,
$this->throttler
]
)
->onlyMethods(['isValidToken'])
->getMock();
$ocsAuthApi = new OCSAuthAPIController(
'federation',
$this->request,
$this->secureRandom,
$this->jobList,
$this->trustedServers,
$this->dbHandler,
$this->logger,
$this->timeFactory,
$this->throttler,
);
$this->trustedServers
->expects($this->any())
->method('isTrustedServer')->with($url)->willReturn($isTrustedServer);
$ocsAuthApi->expects($this->any())
->method('isValidToken')->with($url, $token)->willReturn($isValidToken);
$this->dbHandler->method('getToken')
->with($url)
->willReturn($isValidToken ? $token : 'not $token');
if ($ok) {
$this->secureRandom->expects($this->once())->method('generate')->with(32)