YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

apps/ssowat: fix default value for auth_header and protect_against_basic_auth_spoofing

Browse source
This commit is contained in:
Alexandre Aubin 2024-07-26 20:55:27 +02:00
parent d0ce8cce53
commit 9a6ad19c0e
1 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/app.py
View file

@ -1682,17 +1682,12 @@ def app_ssowatconf():
app_id = perm_name.split(".")[0]
app_settings = _get_app_settings(app_id)
# Stupid hard-coded hack until we properly propagate this to apps ...
apps_that_need_password_in_auth_header = ["nextcloud"]
if perm_info["auth_header"]:
if app_id in apps_that_need_password_in_auth_header:
auth_header = "basic-with-password"
elif app_settings.get("auth_header"):
if app_settings.get("auth_header"):
auth_header = app_settings.get("auth_header")
assert auth_header in ["basic-with-password", "basic-without-password"]
else:
auth_header = "basic-without-password"
auth_header = "basic-with-password"
else:
auth_header = False
@ -1705,7 +1700,12 @@ def app_ssowatconf():
# Apps can opt out of the auth spoofing protection using this if they really need to,
# but that's a huge security hole and ultimately should never happen...
if app_settings.get("protect_against_basic_auth_spoofing", True) in [False, "False", "false", "0", 0]:
# ... But some apps live caldav/webdav need this to not break external clients x_x
apps_that_need_external_auth_maybe = ["agendav", "baikal", "keeweb", "monica", "nextcloud", "paheko", "radicale", "tracim", "vikunja", "z-push"]
protect_against_basic_auth_spoofing = app_settings.get("protect_against_basic_auth_spoofing")
if protect_against_basic_auth_spoofing is not None:
permissions[perm_name]["protect_against_basic_auth_spoofing"] = protect_against_basic_auth_spoofing not in [False, "False", "false", "0", 0]
elif app_id in apps_that_need_external_auth_maybe:
permissions[perm_name]["protect_against_basic_auth_spoofing"] = False
# Next: portal related