v8.6.1-d65e3f1
Pre-release
Pre-release
IONOS build of user_oidc 8.6.1 for HiDriveNext (nc-server ionos-dev-v30 … v33).
Vanilla upstream v8.6.1 (b5a67c7) plus a single backported upstream fix:
- 60d1ca1 — only validate the auth if the Authorization header's value starts with 'Bearer' (verbatim cherry-pick of upstream 2aa104a, nextcloud#1386)
Without the guard, Backend::getCurrentUserId() forwards a Basic Authorization header to the IdP as Bearer Basic … on every DAV request, producing ~92.6k rejected /userinfo calls per hour estate-wide.
App version 8.6.1 unchanged; NC compatibility min 29 / max 34 unchanged; no configuration change (userinfo_bearer_validation stays true).
Fork PR: #3
Jira: HDNEXT-2218