daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-07-22 14:13:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(Mastercontainer): remove CSRF-unprotected GET /api/docker/getwatchtower endpoint

Browse Source 
The GET /api/docker/getwatchtower route triggered a state-changing action
(starting the watchtower container) without CSRF protection. This endpoint
is removed since the POST /api/docker/watchtower route already exists and
is properly protected by the CSRF Guard middleware.

Assisted-by: GitHub Copilot:claude-sonnet-4-6
This commit is contained in:
copilot-swe-agent[bot]
2026-06-19 08:05:17 +00:00
committed by GitHub
parent 474197cae6
commit 1fc928eed0
3 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
php/public/index.php
-1
View File
@@ -94,7 +94,6 @@ $app->add(new \AIO\Middleware\AuthMiddleware($container->get(\AIO\Auth\AuthManag
// API
$app->post('/api/docker/watchtower', AIO\Controller\DockerController::class . ':StartWatchtowerContainer');
$app->get('/api/docker/getwatchtower', AIO\Controller\DockerController::class . ':StartWatchtowerContainer');
$app->post('/api/docker/start', AIO\Controller\DockerController::class . ':StartContainer');
$app->post('/api/docker/backup', AIO\Controller\DockerController::class . ':StartBackupContainerBackup');
$app->post('/api/docker/backup-check', AIO\Controller\DockerController::class . ':StartBackupContainerCheck');
php/src/Docker/DockerHubManager.php
+1 -1
View File
@@ -31,7 +31,7 @@ readonly class DockerHubManager {
return $cachedVersion;
}
// If one of the links below should ever become outdated, we can still upgrade the mastercontainer via the webinterface manually by opening '/api/docker/getwatchtower'
// If one of the links below should ever become outdated, we can still upgrade the mastercontainer via the webinterface manually by posting to '/api/docker/watchtower'
$name = $this->normalizeImageName($name);
try {
php/src/Docker/GitHubContainerRegistryManager.php
+1 -1
View File
@@ -23,7 +23,7 @@ readonly class GitHubContainerRegistryManager
return $cachedVersion;
}
// If one of the links below should ever become outdated, we can still upgrade the mastercontainer via the webinterface manually by opening '/api/docker/getwatchtower'
// If one of the links below should ever become outdated, we can still upgrade the mastercontainer via the webinterface manually by posting to '/api/docker/watchtower'
try {
$authTokenRequest = $this->guzzleClient->request(