Check if required headers are set

Signed-off-by: Louis Chemineau <[email protected]>
nextcloud · Jul 5, 2023 · 1fba40e · 1fba40e
1 parent 91417b7
commit 1fba40e
Show file tree

Hide file tree

Showing 2 changed files with 36 additions and 0 deletions.
diff --git a/lib/Controller/LockingController.php b/lib/Controller/LockingController.php
@@ -96,6 +96,14 @@ public function lockFolder(int $id, ?string $shareToken = null): DataResponse {
 		$e2eToken = $this->request->getParam('e2e-token', '');
 		$e2eCounter = (int)$this->request->getHeader('X-NC-E2EE-COUNTER');
 
+		if ($e2eToken === '') {
+			throw new OCSBadRequestException($this->l10n->t('e2e-token is empty'));
+		}
+
+		if ($e2eCounter === '') {
+			throw new OCSBadRequestException($this->l10n->t('X-NC-E2EE-COUNTER'));
+		}
+
 		$ownerId = $this->getOwnerId($shareToken);
 
 		try {
@@ -140,6 +148,10 @@ public function unlockFolder(int $id, ?string $shareToken = null): DataResponse
 		$abort = $this->request->getParam('abort') === 'true';
 		$token = $this->request->getHeader('e2e-token');
 
+		if ($token === '') {
+			throw new OCSBadRequestException($this->l10n->t('e2e-token is empty'));
+		}
+
 		$ownerId = $this->getOwnerId($shareToken);
 
 		try {

diff --git a/lib/Controller/MetaDataController.php b/lib/Controller/MetaDataController.php
@@ -111,6 +111,14 @@ public function setMetaData(int $id, string $metaData): DataResponse {
 		$e2eToken = $this->request->getHeader('e2e-token');
 		$signature = $this->request->getHeader('X-NC-E2EE-SIGNATURE');
 
+		if ($e2eToken === '') {
+			throw new OCSBadRequestException($this->l10n->t('e2e-token is empty'));
+		}
+
+		if ($signature === '') {
+			throw new OCSBadRequestException($this->l10n->t('X-NC-E2EE-SIGNATURE is empty'));
+		}
+
 		if ($this->lockManager->isLocked($id, $e2eToken)) {
 			throw new OCSForbiddenException($this->l10n->t('You are not allowed to edit the file, make sure to first lock it, and then send the right token'));
 		}
@@ -142,6 +150,14 @@ public function updateMetaData(int $id, string $metaData): DataResponse {
 		$e2eToken = $this->request->getHeader('e2e-token');
 		$signature = $this->request->getHeader('X-NC-E2EE-SIGNATURE');
 
+		if ($e2eToken === '') {
+			throw new OCSBadRequestException($this->l10n->t('e2e-token is empty'));
+		}
+
+		if ($signature === '') {
+			throw new OCSBadRequestException($this->l10n->t('X-NC-E2EE-SIGNATURE is empty'));
+		}
+
 		if ($this->lockManager->isLocked($id, $e2eToken)) {
 			throw new OCSForbiddenException($this->l10n->t('You are not allowed to edit the file, make sure to first lock it, and then send the right token'));
 		}
@@ -175,6 +191,10 @@ public function updateMetaData(int $id, string $metaData): DataResponse {
 	public function deleteMetaData(int $id): DataResponse {
 		$e2eToken = $this->request->getHeader('e2e-token');
 
+		if ($e2eToken === '') {
+			throw new OCSBadRequestException($this->l10n->t('e2e-token is empty'));
+		}
+
 		if ($this->lockManager->isLocked($id, $e2eToken)) {
 			throw new OCSForbiddenException($this->l10n->t('You are not allowed to edit the file, make sure to first lock it, and then send the right token'));
 		}
@@ -207,6 +227,10 @@ public function addMetadataFileDrop(int $id, string $fileDrop, ?string $shareTok
 		$e2eToken = $this->request->getHeader('e2e-token');
 		$ownerId = $this->getOwnerId($shareToken);
 
+		if ($e2eToken === '') {
+			throw new OCSBadRequestException($this->l10n->t('e2e-token is empty'));
+		}
+
 		if ($this->lockManager->isLocked($id, $e2eToken, $ownerId)) {
 			throw new OCSForbiddenException($this->l10n->t('You are not allowed to edit the file, make sure to first lock it, and then send the right token'));
 		}