diff --git a/CHANGELOG.md b/CHANGELOG.md index fa0fb05f..833a7aae 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,12 +5,17 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). -## [2.3.1 - 2024-03-2x] +## [2.3.1 - 2024-03-18] ## Added - `TEXT_PROCESSING` and `MACHINE_TRANSLATION` API scopes. #249 +## Fixed + +- Added missing check for the presence of a header for AppAPI authentication, which could lead to increased load on the server. #251 +- Bump follow-redirects package from `1.15.5` to `1.15.6` #250 + ## [2.3.0 - 2024-03-13] ### Added diff --git a/appinfo/info.xml b/appinfo/info.xml index 83a86d51..7b86cd09 100644 --- a/appinfo/info.xml +++ b/appinfo/info.xml @@ -43,7 +43,7 @@ to join us in shaping a more versatile, stable, and secure app landscape. *Your insights, suggestions, and contributions are invaluable to us.* ]]> - 2.3.0 + 2.3.1 agpl Andrey Borysenko Alexander Piskun diff --git a/lib/Middleware/AppAPIAuthMiddleware.php b/lib/Middleware/AppAPIAuthMiddleware.php index c70cb730..44fcb964 100644 --- a/lib/Middleware/AppAPIAuthMiddleware.php +++ b/lib/Middleware/AppAPIAuthMiddleware.php @@ -38,6 +38,9 @@ public function beforeController($controller, $methodName) { $isAppAPIAuth = !empty($reflectionMethod->getAttributes(AppAPIAuth::class)); if ($isAppAPIAuth) { + if (!$this->request->getHeader('AUTHORIZATION-APP-API')) { + throw new AppAPIAuthNotValidException($this->l->t('AppAPI authentication failed'), Http::STATUS_UNAUTHORIZED); + } if (!$this->service->validateExAppRequestToNC($this->request)) { throw new AppAPIAuthNotValidException($this->l->t('AppAPI authentication failed'), Http::STATUS_UNAUTHORIZED); } diff --git a/lib/Service/AppAPIService.php b/lib/Service/AppAPIService.php index bcc8db76..81b1ed74 100644 --- a/lib/Service/AppAPIService.php +++ b/lib/Service/AppAPIService.php @@ -168,7 +168,11 @@ private function getUriEncodedParams(array $params): string { public function validateExAppRequestToNC(IRequest $request, bool $isDav = false): bool { $this->throttler->sleepDelayOrThrowOnMax($request->getRemoteAddress(), Application::APP_ID); - $exApp = $this->exAppService->getExApp($request->getHeader('EX-APP-ID')); + $exAppId = $request->getHeader('EX-APP-ID'); + if (!$exAppId) { + return false; + } + $exApp = $this->exAppService->getExApp($exAppId); if ($exApp === null) { $this->logger->error(sprintf('ExApp with appId %s not found.', $request->getHeader('EX-APP-ID'))); // Protection for guessing installed ExApps list diff --git a/lib/Service/ExAppService.php b/lib/Service/ExAppService.php index c5a20c51..fe294602 100644 --- a/lib/Service/ExAppService.php +++ b/lib/Service/ExAppService.php @@ -68,10 +68,7 @@ public function getExApp(string $appId): ?ExApp { $exApp = $this->exAppMapper->findByAppId($appId); $this->cache->set($cacheKey, $exApp, self::CACHE_TTL); return $exApp; - } catch (Exception | MultipleObjectsReturnedException | DoesNotExistException $e) { - $this->logger->debug( - sprintf('Failed to get ExApp %s. Error: %s', $appId, $e->getMessage()), ['exception' => $e] - ); + } catch (Exception | MultipleObjectsReturnedException | DoesNotExistException) { } return null; }