From 381c35080db623f41a32d77db91bad48b2bf659a Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Tue, 22 Aug 2023 16:00:39 +0200 Subject: [PATCH] fix(middleware): Fix header injection for bruteforce middleware Calling setHeaders(getHeaders()) breaks the CSP nonce for unknown reasons So shifting back to old standard practise for now Signed-off-by: Joas Schilling --- .../Middleware/Security/BruteForceMiddleware.php | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php b/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php index 6a943af2a1f0a..a0b915588ad16 100644 --- a/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php +++ b/lib/private/AppFramework/Middleware/Security/BruteForceMiddleware.php @@ -130,11 +130,7 @@ public function afterController($controller, $methodName, Response $response) { } if ($this->delaySlept) { - $headers = $response->getHeaders(); - if (!isset($headers['X-Nextcloud-Bruteforce-Throttled'])) { - $headers['X-Nextcloud-Bruteforce-Throttled'] = $this->delaySlept . 'ms'; - $response->setHeaders($headers); - } + $response->addHeader('X-Nextcloud-Bruteforce-Throttled', $this->delaySlept . 'ms'); } return parent::afterController($controller, $methodName, $response);