fix: fail uploads when uri does not match session/share token - #63878
Conversation
75044c9 to
0f76eab
Compare
This is a cosmetic change that can cause false security reports: the current implementation of the upload root collection returns UploadHome in every case, based on the current session, either the one of the logged in user, or for the share. The former allows uploading files in what looks like the upload folder of another user, but is in reality the one of the logged in user. Those requests will now fail with a 403 instead. Signed-off-by: Salvatore Martire <4652631+salmart-dev@users.noreply.github.com>
Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Salvatore Martire <4652631+salmart-dev@users.noreply.github.com>
Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Salvatore Martire <4652631+salmart-dev@users.noreply.github.com>
0f76eab to
e405683
Compare
|
/backport to stable35 |
|
/backport to stable34 |
|
/backport to stable33 |
|
The backport to # Switch to the target branch and update it
git checkout stable33
git pull origin stable33
# Create the new backport branch
git checkout -b backport/63878/stable33
# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 015d83d9 974ccf41 e4056836
# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/63878/stable33Error: Failed to clone repository: Failed to create working tree: error: RPC failed; HTTP 401 curl 22 The requested URL returned error: 401 Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports. |
|
The backport to # Switch to the target branch and update it
git checkout stable34
git pull origin stable34
# Create the new backport branch
git checkout -b backport/63878/stable34
# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 015d83d9 974ccf41 e4056836
# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/63878/stable34Error: Failed to clone repository: Failed to create working tree: error: RPC failed; HTTP 401 curl 22 The requested URL returned error: 401 Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports. |
|
The backport to # Switch to the target branch and update it
git checkout stable35
git pull origin stable35
# Create the new backport branch
git checkout -b backport/63878/stable35
# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 015d83d9 974ccf41 e4056836
# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/63878/stable35Error: Failed to clone repository: Failed to create working tree: error: RPC failed; HTTP 401 curl 22 The requested URL returned error: 401 Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports. |
|
/backport to stable35 |
|
The backport to # Switch to the target branch and update it
git checkout stable35
git pull origin stable35
# Create the new backport branch
git checkout -b backport/63878/stable35
# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 015d83d9 974ccf41 e4056836
# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/63878/stable35Error: Failed to clone repository: Failed to create working tree: error: RPC failed; HTTP 401 curl 22 The requested URL returned error: 401 Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports. |
|
/backport to stable35 |
|
The backport to # Switch to the target branch and update it
git checkout stable35
git pull origin stable35
# Create the new backport branch
git checkout -b backport/63878/stable35
# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick 015d83d9 974ccf41 e4056836
# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/63878/stable35Error: Failed to clone repository: Failed to create working tree: error: RPC failed; HTTP 401 curl 22 The requested URL returned error: 401 Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports. |
|
/backport to stable35 |
|
/backport to stable34 |
|
/backport to stable33 |
|
/backport to stable32 |
4 participants
Summary
This is a cosmetic change that can cause false security reports: the current implementation of the upload root collection returns
UploadHomein every case, based on the current session, either the one of the logged in user, or for the share. The former allows uploading files in what looks like the upload folder of another user, but is in reality the one of the logged in user. Those requests will now fail with a 403 instead.Checklist
3. to review, feature component)stable32)AI (if applicable)