From 23773f99168340fe7237868adc54adbd48412a76 Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Mon, 4 May 2026 18:00:52 +0200 Subject: [PATCH 1/2] fix: don't tell the remote their token is lower Signed-off-by: Robin Appelman --- apps/federation/lib/Controller/OCSAuthAPIController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/federation/lib/Controller/OCSAuthAPIController.php b/apps/federation/lib/Controller/OCSAuthAPIController.php index 63a5fbb31559d..4b960460669b2 100644 --- a/apps/federation/lib/Controller/OCSAuthAPIController.php +++ b/apps/federation/lib/Controller/OCSAuthAPIController.php @@ -147,7 +147,7 @@ public function requestSharedSecret(string $url, string $token): DataResponse { 'remote server (' . $url . ') presented lower token. We will initiate the exchange of the shared secret.', ['app' => 'federation'] ); - throw new OCSForbiddenException(); + return new DataResponse(); } $this->jobList->add( From 7d9a9bf87f29b539c6162076c52cb33e6d94acef Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Tue, 19 May 2026 19:39:05 +0200 Subject: [PATCH 2/2] test: adjust tests Signed-off-by: Robin Appelman --- .../federation/tests/Controller/OCSAuthAPIControllerTest.php | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/apps/federation/tests/Controller/OCSAuthAPIControllerTest.php b/apps/federation/tests/Controller/OCSAuthAPIControllerTest.php index 171252460883b..67f9e694d6a0b 100644 --- a/apps/federation/tests/Controller/OCSAuthAPIControllerTest.php +++ b/apps/federation/tests/Controller/OCSAuthAPIControllerTest.php @@ -124,9 +124,9 @@ public function testRequestSharedSecret(string $token, string $localToken, bool try { $this->ocsAuthApi->requestSharedSecret($url, $token); - $this->assertTrue($ok); + $this->assertTrue($isTrustedServer); } catch (OCSForbiddenException $e) { - $this->assertFalse($ok); + $this->assertFalse($isTrustedServer); } } @@ -182,7 +182,6 @@ public function testGetSharedSecret(bool $isTrustedServer, bool $isValidToken, b try { $result = $ocsAuthApi->getSharedSecret($url, $token); - $this->assertTrue($ok); $data = $result->getData(); $this->assertSame('secret', $data['sharedSecret']); } catch (OCSForbiddenException $e) {