Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not generate tokens for editor IDs that do not exist #18478

Merged
merged 2 commits into from
Dec 22, 2019

Conversation

ChristophWurst
Copy link
Member

Fixes #18240

Untested as I have no clue how to use this :D

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
@ChristophWurst ChristophWurst added bug 3. to review Waiting for reviews labels Dec 19, 2019
@ChristophWurst ChristophWurst added this to the Nextcloud 18 milestone Dec 19, 2019
@ChristophWurst ChristophWurst self-assigned this Dec 19, 2019
@rullzer rullzer mentioned this pull request Dec 19, 2019
18 tasks
Signed-off-by: Julius Härtl <jus@bitgrid.net>
@juliusknorr
Copy link
Member

Pushed another small commit to actually show the exception message.

@juliusknorr
Copy link
Member

Steps to test:

  1. Have the text app installed (master branch)
  2. Create a file README.md
  3. Call the api endpoint:
curl -X POST 'https://admin:admin@nextcloud.local/ocs/v2.php/apps/files/api/v1/directEditing/open?path=/README.md&editorId=NOTEXISTING&format=json' -H 'OCS-APIRequest: true'

@kesselb
Copy link
Contributor

kesselb commented Dec 20, 2019

Pushed another small commit to actually show the exception message.

We are not leaking any information with that?

@tobiasKaminsky
Copy link
Member

Pushed another small commit to actually show the exception message.

We are not leaking any information with that?

I doubt so. You can get the list of available editorIds via another endpoint.
Also this endpoint is only reachable when authenticated.

@kesselb
Copy link
Contributor

kesselb commented Dec 20, 2019

I doubt so. You can get the list of available editorIds via another endpoint.
Also this endpoint is only reachable when authenticated.

Thanks 👍 I restarted the build.

@rullzer rullzer merged commit 04031f6 into master Dec 22, 2019
@rullzer rullzer deleted the fix/direct-editing-invalid-editor-id branch December 22, 2019 13:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3. to review Waiting for reviews bug
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Direct editing should return an error if editor is not found
5 participants