daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-05-30 07:20:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

revert: address PR review comments - remove borgRestorePassword clearing and GetTryLogin HTML redirect

Browse Source 
Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/55bc79a5-dea6-4bcf-9d13-030209b54382

Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-05-12 09:55:20 +00:00
committed by GitHub
parent a415c76ad2
commit 68bb93a2c8
3 changed files with 1 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
php/src/Controller/LoginController.php
View File

@@ -107,19 +107,7 @@ readonly class LoginController {
$token = $request->getQueryParams()['token'] ?? '';
if($this->authManager->CheckToken($token)) {
$this->authManager->SetAuthState(true);
// Return a minimal HTML page that uses JavaScript to replace the browser's
// current history entry (removing the token from it) before navigating to
// the main AIO page. This prevents the token from remaining in browser history.
// The script is served from 'self'; same-origin scripts are already trusted under
// the 'script-src-elem self' CSP directive, so no SRI hash is needed here.
$response->getBody()->write(
'<!DOCTYPE html>' .
'<html lang="en">' .
'<head><script src="../../clean-history.js" data-target="../../"></script></head>' .
'<body></body>' .
'</html>'
);
return $response->withHeader('Content-Type', 'text/html; charset=utf-8')->withStatus(200);
return $response->withHeader('Location', '../..')->withStatus(302);
}
// Punish failed auth attempts with a delay, as a very simple means against bots.