Harden update restrictions

Signed-off-by: Jonas Rittershofer <jotoeri@users.noreply.github.com>
nextcloud · Feb 11, 2021 · a9b1d7e · a9b1d7e
1 parent a75262e
commit a9b1d7e
Showing 1 changed file with 40 additions and 2 deletions.
diff --git a/lib/Controller/ApiController.php b/lib/Controller/ApiController.php
@@ -252,7 +252,20 @@ public function updateForm(int $id, array $keyValuePairs): DataResponse {
 			throw new OCSForbiddenException();
 		}
 
-		// Make sure we only store id
+		// Don't allow empty array
+		if (sizeof($keyValuePairs) === 0) {
+			$this->logger->info('Empty keyValuePairs, will not update.');
+			throw new OCSForbiddenException();
+		}
+
+		// Don't allow to change params id, hash, ownerId, created
+		if (key_exists('id', $keyValuePairs) || key_exists('hash', $keyValuePairs) ||
+			key_exists('ownerId', $keyValuePairs) || key_exists('created', $keyValuePairs)) {
+			$this->logger->info('Not allowed to update id, hash, ownerId or created');
+			throw new OCSForbiddenException();
+		}
+
+		// Make sure we only store id of shares
 		try {
 			if (array_key_exists('access', $keyValuePairs)) {
 				$keyValuePairs['access']['users'] = array_map(function (array $user): string {
@@ -496,7 +509,20 @@ public function updateQuestion(int $id, array $keyValuePairs): DataResponse {
 			throw new OCSForbiddenException();
 		}
 
-		if (array_key_exists('order', $keyValuePairs)) {
+		// Don't allow empty array
+		if (sizeof($keyValuePairs) === 0) {
+			$this->logger->info('Empty keyValuePairs, will not update.');
+			throw new OCSForbiddenException();
+		}
+
+		//Don't allow to change id or formId
+		if (key_exists('id', $keyValuePairs) || key_exists('formId', $keyValuePairs)) {
+			$this->logger->debug('Not allowed to update id or formId');
+			throw new OCSForbiddenException();
+		}
+
+		// Don't allow to reorder here
+		if (key_exists('order', $keyValuePairs)) {
 			$this->logger->debug('Key \'order\' is not allowed on updateQuestion. Please use reorderQuestions() to change order.');
 			throw new OCSForbiddenException('Please use reorderQuestions() to change order');
 		}
@@ -632,6 +658,18 @@ public function updateOption(int $id, array $keyValuePairs): DataResponse {
 			throw new OCSForbiddenException();
 		}
 
+		// Don't allow empty array
+		if (sizeof($keyValuePairs) === 0) {
+			$this->logger->info('Empty keyValuePairs, will not update.');
+			throw new OCSForbiddenException();
+		}
+
+		//Don't allow to change id or questionId
+		if (key_exists('id', $keyValuePairs) || key_exists('questionId', $keyValuePairs)) {
+			$this->logger->debug('Not allowed to update id or questionId');
+			throw new OCSForbiddenException();
+		}
+
 		// Create OptionEntity with given Params & Id.
 		$option = Option::fromParams($keyValuePairs);
 		$option->setId($id);