From af726412865f818c76c7014645e3bd9bb5417ecd Mon Sep 17 00:00:00 2001 From: Luka Trovic Date: Wed, 20 Mar 2024 21:08:54 +0100 Subject: [PATCH 1/3] fix: csrf check failed on public share with password Signed-off-by: Luka Trovic --- core/js/publicshareauth.js | 15 +++++++++++++++ core/src/OC/index.js | 2 ++ core/src/OC/requesttoken.js | 16 ++++++++++++++++ core/templates/publicshareauth.php | 10 +++++----- 4 files changed, 38 insertions(+), 5 deletions(-) diff --git a/core/js/publicshareauth.js b/core/js/publicshareauth.js index 3d694c7bfd6aa..c0df3de3d9227 100644 --- a/core/js/publicshareauth.js +++ b/core/js/publicshareauth.js @@ -52,3 +52,18 @@ document.addEventListener('DOMContentLoaded', function() { } }); + +// Fix error "CSRF check failed" +document.addEventListener('DOMContentLoaded', function() { + var form = document.getElementById('password-input-form'); + if (form) { + form.addEventListener('submit', async function(event) { + event.preventDefault(); + var requestToken = document.getElementById('requesttoken'); + if (requestToken) { + requestToken.value = await OC.fetchRequestToken(); + } + form.submit(); + }); + } +}); diff --git a/core/src/OC/index.js b/core/src/OC/index.js index 05a1bf0162e47..0d2d0b6247047 100644 --- a/core/src/OC/index.js +++ b/core/src/OC/index.js @@ -73,6 +73,7 @@ import { } from './host.js' import { getToken as getRequestToken, + fetchToken as fetchRequestToken, } from './requesttoken.js' import { hideMenus, @@ -278,6 +279,7 @@ export default { redirect, reload, requestToken: getRequestToken(), + fetchRequestToken, /** * @deprecated 19.0.0 use `linkTo` from https://www.npmjs.com/package/@nextcloud/router */ diff --git a/core/src/OC/requesttoken.js b/core/src/OC/requesttoken.js index eba15e88e081a..229f8ff0370ed 100644 --- a/core/src/OC/requesttoken.js +++ b/core/src/OC/requesttoken.js @@ -22,6 +22,8 @@ */ import { emit } from '@nextcloud/event-bus' +import { generateUrl } from '@nextcloud/router' +import $ from 'jquery' /** * @private @@ -41,6 +43,15 @@ export const manageToken = (global, emit) => { token, }) }, + fetchToken: async () => { + const url = generateUrl('/csrftoken') + const resp = await $.get(url) + token = resp.token + emit('csrf-token-update', { + token, + }) + return token + }, } } @@ -55,3 +66,8 @@ export const getToken = manageFromDocument.getToken * @param {string} newToken new token */ export const setToken = manageFromDocument.setToken + +/** + * @return {Promise} + */ +export const fetchToken = manageFromDocument.fetchToken diff --git a/core/templates/publicshareauth.php b/core/templates/publicshareauth.php index 516795852b29f..e54018b5a90b5 100644 --- a/core/templates/publicshareauth.php +++ b/core/templates/publicshareauth.php @@ -22,7 +22,7 @@

- +

- +
@@ -46,7 +46,7 @@ class="svg icon-confirm input-button-inline" value="" disabled="disabled" />

- +

@@ -59,12 +59,12 @@ class="svg icon-confirm input-button-inline" value="" disabled="disabled" />
- + getShareType() === $_['share']::TYPE_EMAIL && !$_['share']->getSendPasswordByTalk()): ?> t('Forgot password?')); ?> - +
From f3a40d04dc56a5ae8ba8711d36c1cb779cf3c466 Mon Sep 17 00:00:00 2001 From: Luka Trovic Date: Mon, 25 Mar 2024 21:33:30 +0100 Subject: [PATCH 2/3] fix: csrf check failed on public share with password Signed-off-by: Luka Trovic --- core/js/publicshareauth.js | 15 --------------- core/src/OC/index.js | 2 -- core/src/OC/requesttoken.js | 16 ---------------- core/src/main.js | 19 +++++++++++++++++++ 4 files changed, 19 insertions(+), 33 deletions(-) diff --git a/core/js/publicshareauth.js b/core/js/publicshareauth.js index c0df3de3d9227..3d694c7bfd6aa 100644 --- a/core/js/publicshareauth.js +++ b/core/js/publicshareauth.js @@ -52,18 +52,3 @@ document.addEventListener('DOMContentLoaded', function() { } }); - -// Fix error "CSRF check failed" -document.addEventListener('DOMContentLoaded', function() { - var form = document.getElementById('password-input-form'); - if (form) { - form.addEventListener('submit', async function(event) { - event.preventDefault(); - var requestToken = document.getElementById('requesttoken'); - if (requestToken) { - requestToken.value = await OC.fetchRequestToken(); - } - form.submit(); - }); - } -}); diff --git a/core/src/OC/index.js b/core/src/OC/index.js index 0d2d0b6247047..05a1bf0162e47 100644 --- a/core/src/OC/index.js +++ b/core/src/OC/index.js @@ -73,7 +73,6 @@ import { } from './host.js' import { getToken as getRequestToken, - fetchToken as fetchRequestToken, } from './requesttoken.js' import { hideMenus, @@ -279,7 +278,6 @@ export default { redirect, reload, requestToken: getRequestToken(), - fetchRequestToken, /** * @deprecated 19.0.0 use `linkTo` from https://www.npmjs.com/package/@nextcloud/router */ diff --git a/core/src/OC/requesttoken.js b/core/src/OC/requesttoken.js index 229f8ff0370ed..eba15e88e081a 100644 --- a/core/src/OC/requesttoken.js +++ b/core/src/OC/requesttoken.js @@ -22,8 +22,6 @@ */ import { emit } from '@nextcloud/event-bus' -import { generateUrl } from '@nextcloud/router' -import $ from 'jquery' /** * @private @@ -43,15 +41,6 @@ export const manageToken = (global, emit) => { token, }) }, - fetchToken: async () => { - const url = generateUrl('/csrftoken') - const resp = await $.get(url) - token = resp.token - emit('csrf-token-update', { - token, - }) - return token - }, } } @@ -66,8 +55,3 @@ export const getToken = manageFromDocument.getToken * @param {string} newToken new token */ export const setToken = manageFromDocument.setToken - -/** - * @return {Promise} - */ -export const fetchToken = manageFromDocument.fetchToken diff --git a/core/src/main.js b/core/src/main.js index 1e481bf877df7..ea49eb7ac69bd 100644 --- a/core/src/main.js +++ b/core/src/main.js @@ -37,6 +37,8 @@ import './globals.js' import './jquery/index.js' import { initCore } from './init.js' import { getRequestToken } from '@nextcloud/auth' +import { generateUrl } from '@nextcloud/router' +import Axios from '@nextcloud/axios' // eslint-disable-next-line camelcase __webpack_nonce__ = btoa(getRequestToken()) @@ -52,3 +54,20 @@ window.addEventListener('DOMContentLoaded', function() { $(window).on('hashchange', _.bind(OC.Util.History._onPopState, OC.Util.History)) } }) + +// Fix error "CSRF check failed" +document.addEventListener('DOMContentLoaded', function() { + const form = document.getElementById('password-input-form') + if (form) { + form.addEventListener('submit', async function(event) { + event.preventDefault() + const requestToken = document.getElementById('requesttoken') + if (requestToken) { + const url = generateUrl('/csrftoken') + const resp = await Axios.get(url) + requestToken.value = resp.data.token + } + form.submit() + }) + } +}) From bbb998dde9265a88eb33fdb44b85516d7d19975b Mon Sep 17 00:00:00 2001 From: Arthur Schiwon Date: Fri, 23 Aug 2024 11:04:22 +0200 Subject: [PATCH 3/3] build: js assets Signed-off-by: Arthur Schiwon --- dist/core-main.js | 4 ++-- dist/core-main.js.map | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dist/core-main.js b/dist/core-main.js index cf91317afbfec..75deaeb5a79db 100644 --- a/dist/core-main.js +++ b/dist/core-main.js @@ -1,3 +1,3 @@ /*! For license information please see core-main.js.LICENSE.txt */ -(()=>{var e,o,i,a={30508:(e,o,i)=>{"use strict";var a={};i.r(a),i.d(a,{deleteKey:()=>P,getApps:()=>x,getKeys:()=>k,getValue:()=>E,setValue:()=>B});var r={};i.r(r),i.d(r,{formatLinksPlain:()=>Xe,formatLinksRich:()=>Ve,plainToRich:()=>Ze,richToPlain:()=>Je});var s={};i.r(s),i.d(s,{dismiss:()=>en,query:()=>tn});var l=i(19755),c=i.n(l);let u=!1;const d={enableDynamicSlideToggle(){u=!0},showAppSidebar:function(t){(t||c()("#app-sidebar")).removeClass("disappear").show(),c()("#app-content").trigger(new(c().Event)("appresized"))},hideAppSidebar:function(t){(t||c()("#app-sidebar")).hide().addClass("disappear"),c()("#app-content").trigger(new(c().Event)("appresized"))}};i(92676),i(35666),i(35202);var A=i(69183),p=i(79753),h=i(25108);const m={},f=[];var g=i(18181),v=i(64024),C=i(25108);const b={updatableNotification:null,getDefaultNotificationFunction:null,setDefault(t){this.getDefaultNotificationFunction=t},hide(t,e){g.default.isFunction(t)&&(e=t,t=void 0),t?(t.each((function(){c()(this)[0].toastify?c()(this)[0].toastify.hideToast():C.error("cannot hide toast because object is not set"),this===this.updatableNotification&&(this.updatableNotification=null)})),e&&e.call(),this.getDefaultNotificationFunction&&this.getDefaultNotificationFunction()):C.error("Missing argument $row in OC.Notification.hide() call, caller needs to be adjusted to only dismiss its own notification")},showHtml(t,e){(e=e||{}).isHTML=!0,e.timeout=e.timeout?e.timeout:v.Rl;const n=(0,v.PV)(t,e);return n.toastElement.toastify=n,c()(n.toastElement)},show(t,e){(e=e||{}).timeout=e.timeout?e.timeout:v.Rl;const n=(0,v.PV)(function(t){return t.toString().split("&").join("&").split("<").join("<").split(">").join(">").split('"').join(""").split("'").join("'")}(t),e);return n.toastElement.toastify=n,c()(n.toastElement)},showUpdate(t){return this.updatableNotification&&this.updatableNotification.hideToast(),this.updatableNotification=(0,v.PV)(t,{timeout:v.Rl}),this.updatableNotification.toastElement.toastify=this.updatableNotification,c()(this.updatableNotification.toastElement)},showTemporary(t,e){(e=e||{}).timeout=e.timeout||v.TN;const n=(0,v.PV)(t,e);return n.toastElement.toastify=n,c()(n.toastElement)},isHidden:()=>!c()("#content").find(".toastify").length},w=g.default.throttle((()=>{b.showTemporary(t("core","Connection to server lost"))}),7e3,{trailing:!1});function y(t,e,n){"post"!==t&&"delete"!==t||!Ft.PasswordConfirmation.requiresPasswordConfirmation()?(n=n||{},c().ajax({type:t.toUpperCase(),url:(0,p.generateOcsUrl)("apps/provisioning_api/api/v1/config/apps")+e,data:n.data||{},success:n.success,error:n.error})):Ft.PasswordConfirmation.requirePasswordConfirmation(_.bind(y,this,t,e,n))}function x(t){y("get","",t)}function k(t,e){y("get","/"+t,e)}function E(t,e,n,o){(o=o||{}).data={defaultValue:n},y("get","/"+t+"/"+e,o)}function B(t,e,n,o){(o=o||{}).data={value:n},y("post","/"+t+"/"+e,o)}function P(t,e,n){y("delete","/"+t+"/"+e,n)}const O=window.oc_appconfig||{},T={getValue:function(t,e,n,o){E(t,e,n,{success:o})},setValue:function(t,e,n){B(t,e,n)},getApps:function(t){x({success:t})},getKeys:function(t,e){k(t,{success:e})},deleteKey:function(t,e){P(t,e)}};var D=i(25108);const I=void 0!==window._oc_appswebroots&&window._oc_appswebroots;var j=i(72316),z=i.n(j),N=i(76591),S=i(25108);const U={create:"POST",update:"PROPPATCH",patch:"PROPPATCH",delete:"DELETE",read:"PROPFIND"};function M(t,e){if(g.default.isArray(t))return g.default.map(t,(function(t){return M(t,e)}));var n={href:t.href};return g.default.each(t.propStat,(function(t){if("HTTP/1.1 200 OK"===t.status)for(var o in t.properties){var i=o;o in e&&(i=e[o]),n[i]=t.properties[o]}})),n.id||(n.id=L(n.href)),n}function L(t){var e=t.indexOf("?");e>0&&(t=t.substr(0,e));var n,o=t.split("/");do{n=o[o.length-1],o.pop()}while(!n&&o.length>0);return n}function F(t){return t>=200&&t<=299}function R(t,e,n,o){return t.propPatch(e.url,function(t,e){var n,o={};for(n in t){var i=e[n],a=t[n];i||(S.warn('No matching DAV property for property "'+n),i=n),(g.default.isBoolean(a)||g.default.isNumber(a))&&(a=""+a),o[i]=a}return o}(n.changed,e.davProperties),o).then((function(t){F(t.status)?g.default.isFunction(e.success)&&e.success(n.toJSON()):g.default.isFunction(e.error)&&e.error(t)}))}const Q=z().noConflict();Object.assign(Q,{davCall:(t,e)=>{var n=new N.dav.Client({baseUrl:t.url,xmlNamespaces:g.default.extend({"DAV:":"d","http://owncloud.org/ns":"oc"},t.xmlNamespaces||{})});n.resolveUrl=function(){return t.url};var o=g.default.extend({"X-Requested-With":"XMLHttpRequest",requesttoken:OC.requestToken},t.headers);return"PROPFIND"===t.type?function(t,e,n,o){return t.propFind(e.url,g.default.values(e.davProperties)||[],e.depth,o).then((function(t){if(F(t.status)){if(g.default.isFunction(e.success)){var n=g.default.invert(e.davProperties),o=M(t.body,n);e.depth>0&&o.shift(),e.success(o)}}else g.default.isFunction(e.error)&&e.error(t)}))}(n,t,0,o):"PROPPATCH"===t.type?R(n,t,e,o):"MKCOL"===t.type?function(t,e,n,o){return t.request(e.type,e.url,o,null).then((function(i){F(i.status)?R(t,e,n,o):g.default.isFunction(e.error)&&e.error(i)}))}(n,t,e,o):function(t,e,n,o){return o["Content-Type"]="application/json",t.request(e.type,e.url,o,e.data).then((function(t){if(F(t.status)){if(g.default.isFunction(e.success)){if("PUT"===e.type||"POST"===e.type||"MKCOL"===e.type){var o=t.body||n.toJSON(),i=t.xhr.getResponseHeader("Content-Location");return"POST"===e.type&&i&&(o.id=L(i)),void e.success(o)}if(207===t.status){var a=g.default.invert(e.davProperties);e.success(M(t.body,a))}else e.success(t.body)}}else g.default.isFunction(e.error)&&e.error(t)}))}(n,t,e,o)},davSync:(t=>(e,n,o)=>{var i={type:U[e]||e},a=n instanceof t.Collection;if("update"===e&&(n.hasInnerCollection?i.type="MKCOL":(n.usePUT||n.collection&&n.collection.usePUT)&&(i.type="PUT")),o.url||(i.url=g.default.result(n,"url")||function(){throw new Error('A "url" property or function must be specified')}()),null!=o.data||!n||"create"!==e&&"update"!==e&&"patch"!==e||(i.data=JSON.stringify(o.attrs||n.toJSON(o))),"PROPFIND"!==i.type&&(i.processData=!1),"PROPFIND"===i.type||"PROPPATCH"===i.type){var r=n.davProperties;!r&&n.model&&(r=n.model.prototype.davProperties),r&&(g.default.isFunction(r)?i.davProperties=r.call(n):i.davProperties=r),i.davProperties=g.default.extend(i.davProperties||{},o.davProperties),g.default.isUndefined(o.depth)&&(o.depth=a?1:0)}var s=o.error;o.error=function(t,e,n){o.textStatus=e,o.errorThrown=n,s&&s.call(o.context,t,e,n)};var l=o.xhr=t.davCall(g.default.extend(i,o),n);return n.trigger("request",n,l,o),l})(Q)});const G=Q;var H=i(65358);const K=window._oc_config||{};var Y=i(25108);const q=j.Model.extend({defaults:{fullName:"",lastMessage:"",actions:[],hasOneAction:!1,hasTwoActions:!1,hasManyActions:!1},initialize:function(){0===this.get("actions").length?this.set("hasOneAction",!0):1===this.get("actions").length?(this.set("hasTwoActions",!0),this.set("secondAction",this.get("actions")[0])):this.set("hasManyActions",!0);const e=this.get("fullName");this.get("avatar")&&e&&this.set("avatarLabel",t("core","Avatar of {fullName}",{fullName:e}))}}),W=j.Collection.extend({model:q}),Z=j.View.extend({_collection:void 0,_subViews:[],tagName:"ul",initialize:function(t){this._collection=t.collection},render:function(){var t=this;return t.$el.html(""),t._subViews=[],t._collection.forEach((function(e){var n=new J({model:e});n.render(),t.$el.append(n.$el),n.on("toggle:actionmenu",t._onChildActionMenuToggle,t),t._subViews.push(n)})),t},_onChildActionMenuToggle:function(t){this._subViews.forEach((function(e){e.trigger("parent:toggle:actionmenu",t)}))}}),J=j.View.extend({className:"contact",tagName:"li",_template:void 0,_model:void 0,_actionMenuShown:!1,events:{"click .icon-more":"_onToggleActionsMenu"},contactTemplate:i(10944),template:function(t){return this.contactTemplate(t)},initialize:function(t){this._model=t.model,this.on("parent:toggle:actionmenu",this._onOtherActionMenuOpened,this)},render:function(){return this.$el.html(this.template({contact:this._model.toJSON()})),this.delegateEvents(),this.$("div.avatar").imageplaceholder(this._model.get("fullName")),this},_onToggleActionsMenu:function(){this._actionMenuShown=!this._actionMenuShown,this._actionMenuShown?this.$(".menu").show():this.$(".menu").hide(),this.trigger("toggle:actionmenu",this.$el)},_onOtherActionMenuOpened:function(t){this.$el.is(t)||(this._actionMenuShown=!1,this.$(".menu").hide())}}),V=j.View.extend({_loadingTemplate:void 0,_errorTemplate:void 0,_contentTemplate:void 0,_contactsTemplate:void 0,_contacts:void 0,_searchTerm:"",events:{"input #contactsmenu-search":"_onSearch"},templates:{loading:i(95386),error:i(20421),menu:i(66115),list:i(34083)},_onSearch:g.default.debounce((function(t){var e=this.$("#contactsmenu-search").val();e!==this._searchTerm&&(this.trigger("search",this.$("#contactsmenu-search").val()),this._searchTerm=e)}),700),loadingTemplate:function(t){return this.templates.loading(t)},errorTemplate:function(e){return this.templates.error(g.default.extend({couldNotLoadText:t("core","Could not load your contacts")},e))},contentTemplate:function(e){return this.templates.menu(g.default.extend({searchContactsText:t("core","Search contacts …")},e))},contactsTemplate:function(e){return this.templates.list(g.default.extend({noContactsFoundText:t("core","No contacts found"),showAllContactsText:t("core","Show all contacts …"),contactsAppMgmtText:t("core","Install the Contacts app")},e))},initialize:function(t){this.options=t},showLoading:function(t){this.render(),this._contacts=void 0,this.$(".content").html(this.loadingTemplate({loadingText:t}))},showError:function(){this.render(),this._contacts=void 0,this.$(".content").html(this.errorTemplate())},showContacts:function(t,e){this._contacts=t.contacts,this.render({contacts:t.contacts});var n=new Z({collection:t.contacts});n.render(),this.$(".content").html(this.contactsTemplate({contacts:t.contacts,searchTerm:e,contactsAppEnabled:t.contactsAppEnabled,contactsAppURL:Ft.generateUrl("/apps/contacts"),canInstallApp:Ft.isUserAdmin(),contactsAppMgmtURL:Ft.generateUrl("/settings/apps/social/contacts")})),this.$("#contactsmenu-contacts").html(n.$el)},render:function(t){var e=this.$("#contactsmenu-search").val();return this.$el.html(this.contentTemplate(t)),this.$("#contactsmenu-search").val(e),this.$("#contactsmenu-search").focus(),this}}),X=function(t){this.initialize(t)};X.prototype={$el:void 0,_view:void 0,_contactsPromise:void 0,initialize:function(t){this.$el=c()(t.el),this._view=new V({el:this.$el}),this._view.on("search",(function(t){this.loadContacts(t)}),this)},_getContacts:function(t){var e=Ft.generateUrl("/contactsmenu/contacts");return Promise.resolve(c().ajax(e,{method:"POST",data:{filter:t}}))},loadContacts:function(e){var n=this;return n._contactsPromise||(n._contactsPromise=n._getContacts(e)),g.default.isUndefined(e)||""===e?n._view.showLoading(t("core","Loading your contacts …")):n._view.showLoading(t("core","Looking for {term} …",{term:e})),n._contactsPromise.then((function(t){t.contacts=new W(t.contacts),n._view.showContacts(t,e)}),(function(t){n._view.showError(),Y.error("There was an error loading your contacts",t)})).then((function(){delete n._contactsPromise})).catch(Y.error.bind(this))}};const $=X,tt=document.getElementsByTagName("head")[0].getAttribute("data-user"),et=document.getElementsByTagName("head")[0].getAttribute("data-user-displayname"),nt=void 0!==tt&&tt;var ot=i(25108);const it={Search:class{constructor(){OC.debug&&ot.warn("OCA.Search is deprecated. Please use the unified search API instead")}}},at=t=>"click"===t.type||"keydown"===t.type&&"Enter"===t.key;var rt=i(51819),st=i(25108);const lt={YES_NO_BUTTONS:70,OK_BUTTONS:71,FILEPICKER_TYPE_CHOOSE:1,FILEPICKER_TYPE_MOVE:2,FILEPICKER_TYPE_COPY:3,FILEPICKER_TYPE_COPY_MOVE:4,FILEPICKER_TYPE_CUSTOM:5,dialogsCounter:0,alert:function(t,e,n,o){this.message(t,e,"alert",lt.OK_BUTTON,n,o)},info:function(t,e,n,o){this.message(t,e,"info",lt.OK_BUTTON,n,o)},confirm:function(t,e,n,o){return this.message(t,e,"notice",lt.YES_NO_BUTTONS,n,o)},confirmDestructive:function(t,e,n,o,i){return this.message(t,e,"none",n,o,void 0===i||i)},confirmHtml:function(t,e,n,o){return this.message(t,e,"notice",lt.YES_NO_BUTTONS,n,o,!0)},prompt:function(e,n,o,i,a,r){return c().when(this._getMessageTemplate()).then((function(s){var l="oc-dialog-"+lt.dialogsCounter+"-content",u="#"+l,d=s.octemplate({dialog_name:l,title:n,message:e,type:"notice"}),A=c()("");A.attr("type",r?"password":"text").attr("id",l+"-input").attr("placeholder",a);var p=c()("