upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-12 10:10:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 20

Add exemption for ACS endpoint

Browse source 
In a SAML scenario we don't get any strict or lax cookie send for
the ACS endpoint. Since we have some legacy code in Nextcloud
(direct PHP files) the enforcement of lax cookies is performed here
instead of the middleware.

This means we cannot exclude some routes from the cookie validation,
which normally is not a problem but is a little bit cumbersome for
this use-case.

Once the old legacy PHP endpoints have been removed we can move
the verification into a middleware and also adds some exemptions.

Not super awesome code to have but the best that I could come up
with that doesn't add another ton of technical debt.
This commit is contained in:
Lukas Reschke 2016-06-29 19:51:27 +02:00
parent 95f6dd909b
commit f56ea98993
No known key found for this signature in database
GPG key ID: 9AB0ADB949B6898C
1 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
lib/base.php
View file

@ -519,6 +519,23 @@ class OC {
$processingScript = explode('/', $requestUri);
$processingScript = $processingScript[count($processingScript)-1];
// FIXME: In a SAML scenario we don't get any strict or lax cookie
// send for the ACS endpoint. Since we have some legacy code in Nextcloud
// (direct PHP files) the enforcement of lax cookies is performed here
// instead of the middleware.
//
// This means we cannot exclude some routes from the cookie validation,
// which normally is not a problem but is a little bit cumbersome for
// this use-case.
// Once the old legacy PHP endpoints have been removed we can move
// the verification into a middleware and also adds some exemptions.
//
// Questions about this code? Ask Lukas ;-)
$currentUrl = substr(explode('?',$request->getRequestUri(), 2)[0], strlen(\OC::$WEBROOT));
if($currentUrl === '/index.php/apps/user_saml/saml/acs') {
return;
}
// For the "index.php" endpoint only a lax cookie is required.
if($processingScript === 'index.php') {
if(!$request->passesLaxCookieCheck()) {