YunoHost/SSOwat
1
0
Fork 0
mirror of https://github.com/YunoHost/SSOwat.git synced 2024-09-03 20:06:27 +02:00
Code Issues Projects Releases Packages Wiki Activity

Iterate on previous security fixes: ignore Auth header on PROPFIND routes, and don't drop Auth header which are not Basic auth

Browse source
This commit is contained in:
Alexandre Aubin 2023-01-09 19:46:51 +01:00
parent 1f56a08621
commit ca7cf2c2cc
1 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
helpers.lua
View file

@ -265,7 +265,9 @@ function refresh_logged_in()
local auth_header = ngx.req.get_headers()["Authorization"] or ngx.req.get_headers()["Proxy-Authorization"] local auth_header = ngx.req.get_headers()["Authorization"] or ngx.req.get_headers()["Proxy-Authorization"]
if auth_header then -- Ignore this for PROPFIND routes used by Nextcloud (et al.?) which also rely on basic auth with totally yunohost-unrelated credentials ...
if auth_header and ngx.var.request_method ~= "PROPFIND" then
logger.debug(auth_header)
_, _, b64_cred = string.find(auth_header, "^Basic%s+(.+)$") _, _, b64_cred = string.find(auth_header, "^Basic%s+(.+)$")
if b64_cred == nil then if b64_cred == nil then
return is_logged_in return is_logged_in
@ -417,7 +419,14 @@ end
-- - app requests that no authentication headers be sent -- - app requests that no authentication headers be sent
-- Prevents user from pretending to be someone else on public apps -- Prevents user from pretending to be someone else on public apps
function clear_headers() function clear_headers()
ngx.req.clear_header("Authorization") -- Clear auth header only if it's a 'Basic' auth stuff, not 'Bearer' stuff
-- Also ignore PROPFIND routes used by Nextcloud (et al.?)
if ngx.var.request_method ~= "PROPFIND" and ngx.req.get_headers()["Authorization"] then
_, _, b64_cred = string.find(auth_header, "^Basic%s+(.+)$")
if b64_cred ~= nil then
ngx.req.clear_header("Authorization")
end
end
for k, v in pairs(conf["additional_headers"]) do for k, v in pairs(conf["additional_headers"]) do
ngx.req.clear_header(k) ngx.req.clear_header(k)
end end