diff --git a/CHANGELOG.md b/CHANGELOG.md
index fa0fb05f..833a7aae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,12 +5,17 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](http://keepachangelog.com/)
and this project adheres to [Semantic Versioning](http://semver.org/).
-## [2.3.1 - 2024-03-2x]
+## [2.3.1 - 2024-03-18]
## Added
- `TEXT_PROCESSING` and `MACHINE_TRANSLATION` API scopes. #249
+## Fixed
+
+- Added missing check for the presence of a header for AppAPI authentication, which could lead to increased load on the server. #251
+- Bump follow-redirects package from `1.15.5` to `1.15.6` #250
+
## [2.3.0 - 2024-03-13]
### Added
diff --git a/appinfo/info.xml b/appinfo/info.xml
index 83a86d51..7b86cd09 100644
--- a/appinfo/info.xml
+++ b/appinfo/info.xml
@@ -43,7 +43,7 @@ to join us in shaping a more versatile, stable, and secure app landscape.
*Your insights, suggestions, and contributions are invaluable to us.*
]]>
- 2.3.0
+ 2.3.1
agpl
Andrey Borysenko
Alexander Piskun
diff --git a/lib/Middleware/AppAPIAuthMiddleware.php b/lib/Middleware/AppAPIAuthMiddleware.php
index c70cb730..44fcb964 100644
--- a/lib/Middleware/AppAPIAuthMiddleware.php
+++ b/lib/Middleware/AppAPIAuthMiddleware.php
@@ -38,6 +38,9 @@ public function beforeController($controller, $methodName) {
$isAppAPIAuth = !empty($reflectionMethod->getAttributes(AppAPIAuth::class));
if ($isAppAPIAuth) {
+ if (!$this->request->getHeader('AUTHORIZATION-APP-API')) {
+ throw new AppAPIAuthNotValidException($this->l->t('AppAPI authentication failed'), Http::STATUS_UNAUTHORIZED);
+ }
if (!$this->service->validateExAppRequestToNC($this->request)) {
throw new AppAPIAuthNotValidException($this->l->t('AppAPI authentication failed'), Http::STATUS_UNAUTHORIZED);
}
diff --git a/lib/Service/AppAPIService.php b/lib/Service/AppAPIService.php
index bcc8db76..81b1ed74 100644
--- a/lib/Service/AppAPIService.php
+++ b/lib/Service/AppAPIService.php
@@ -168,7 +168,11 @@ private function getUriEncodedParams(array $params): string {
public function validateExAppRequestToNC(IRequest $request, bool $isDav = false): bool {
$this->throttler->sleepDelayOrThrowOnMax($request->getRemoteAddress(), Application::APP_ID);
- $exApp = $this->exAppService->getExApp($request->getHeader('EX-APP-ID'));
+ $exAppId = $request->getHeader('EX-APP-ID');
+ if (!$exAppId) {
+ return false;
+ }
+ $exApp = $this->exAppService->getExApp($exAppId);
if ($exApp === null) {
$this->logger->error(sprintf('ExApp with appId %s not found.', $request->getHeader('EX-APP-ID')));
// Protection for guessing installed ExApps list
diff --git a/lib/Service/ExAppService.php b/lib/Service/ExAppService.php
index c5a20c51..fe294602 100644
--- a/lib/Service/ExAppService.php
+++ b/lib/Service/ExAppService.php
@@ -68,10 +68,7 @@ public function getExApp(string $appId): ?ExApp {
$exApp = $this->exAppMapper->findByAppId($appId);
$this->cache->set($cacheKey, $exApp, self::CACHE_TTL);
return $exApp;
- } catch (Exception | MultipleObjectsReturnedException | DoesNotExistException $e) {
- $this->logger->debug(
- sprintf('Failed to get ExApp %s. Error: %s', $appId, $e->getMessage()), ['exception' => $e]
- );
+ } catch (Exception | MultipleObjectsReturnedException | DoesNotExistException) {
}
return null;
}