From f1cd334281a4ae70b7ca77b48e9263b80ee03e85 Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Mon, 15 Jan 2018 22:05:06 +0100 Subject: [PATCH] Don't perform CSRF check on OCS routes with Bearer auth Fixes #5694 Signed-off-by: Roeland Jago Douma --- .../Middleware/Security/SecurityMiddleware.php | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php b/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php index c147b5b2475..c19834b462b 100644 --- a/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php +++ b/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php @@ -170,10 +170,16 @@ class SecurityMiddleware extends Middleware { * Only allow the CSRF check to fail on OCS Requests. This kind of * hacks around that we have no full token auth in place yet and we * do want to offer CSRF checks for web requests. + * + * Additionally we allow Bearer authenticated requests to pass on OCS routes. + * This allows oauth apps (e.g. moodle) to use the OCS endpoints */ if(!$this->request->passesCSRFCheck() && !( - $controller instanceof OCSController && - $this->request->getHeader('OCS-APIREQUEST') === 'true')) { + $controller instanceof OCSController && ( + $this->request->getHeader('OCS-APIREQUEST') === 'true' || + strpos($this->request->getHeader('Authorization'), 'Bearer ') === 0 + ) + )) { throw new CrossSiteRequestForgeryException(); } }