daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-05-29 15:00:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "revert: address PR review comments - remove borgRestorePassword clearing and GetTryLogin HTML redirect"

Browse Source 
This reverts commit 68bb93a2c8.
This commit is contained in:
Simon L.
2026-05-12 11:58:34 +02:00
parent 68bb93a2c8
commit adcc41f401
3 changed files with 46 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
php/src/Controller/DockerController.php
View File

@@ -165,6 +165,13 @@ readonly class DockerController {
$id = 'nextcloud-aio-borgbackup';
$this->PerformRecursiveContainerStart($id, true, $addToStreamingResponseBody);
// The password has been passed to the borgbackup container's environment.
// Clear it from the persistent config so it is not kept at rest longer than needed.
// The borgRestorePassword property setter calls ConfigurationManager::set() under
// the hood (via PHP 8.4+ property hooks), which immediately overwrites the stored
// value and writes the updated config to disk.
$this->configurationManager->borgRestorePassword = '';
// End streaming response
$this->finalizeStreamingResponse($nonbufResp);
return $nonbufResp;

14
php/src/Controller/LoginController.php
View File

@@ -107,7 +107,19 @@ readonly class LoginController {
$token = $request->getQueryParams()['token'] ?? '';
if($this->authManager->CheckToken($token)) {
$this->authManager->SetAuthState(true);
return $response->withHeader('Location', '../..')->withStatus(302);
// Return a minimal HTML page that uses JavaScript to replace the browser's
// current history entry (removing the token from it) before navigating to
// the main AIO page. This prevents the token from remaining in browser history.
// The script is served from 'self'; same-origin scripts are already trusted under
// the 'script-src-elem self' CSP directive, so no SRI hash is needed here.
$response->getBody()->write(
'<!DOCTYPE html>' .
'<html lang="en">' .
'<head><script src="../../clean-history.js" data-target="../../"></script></head>' .
'<body></body>' .
'</html>'
);
return $response->withHeader('Content-Type', 'text/html; charset=utf-8')->withStatus(200);
}
// Punish failed auth attempts with a delay, as a very simple means against bots.