upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-08 16:26:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 12

Merge pull request #6660 from nextcloud/remove_saml_hack

Browse source 
Remove SAML hack from base.php
This commit is contained in:
Morris Jobke 2017-09-27 10:13:36 +02:00 committed by GitHub
commit b30b4cddd9
1 changed files with 1 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
lib/base.php
View file

@ -543,22 +543,7 @@ class OC {
$requestUri = $request->getScriptName();
$processingScript = explode('/', $requestUri);
$processingScript = $processingScript[count($processingScript)-1];
// FIXME: In a SAML scenario we don't get any strict or lax cookie
// send for the ACS endpoint. Since we have some legacy code in Nextcloud
// (direct PHP files) the enforcement of lax cookies is performed here
// instead of the middleware.
//
// This means we cannot exclude some routes from the cookie validation,
// which normally is not a problem but is a little bit cumbersome for
// this use-case.
// Once the old legacy PHP endpoints have been removed we can move
// the verification into a middleware and also adds some exemptions.
//
// Questions about this code? Ask Lukas ;-)
$currentUrl = substr(explode('?',$request->getRequestUri(), 2)[0], strlen(\OC::$WEBROOT));
if($currentUrl === '/index.php/apps/user_saml/saml/acs' || $currentUrl === '/apps/user_saml/saml/acs') {
return;
}
// index.php routes are handled in the middleware
if($processingScript === 'index.php') {
return;