Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"Access through untrusted domain" #7732

Closed
tobiasKaminsky opened this issue Jan 8, 2018 · 11 comments · Fixed by #7991
Closed

"Access through untrusted domain" #7732

tobiasKaminsky opened this issue Jan 8, 2018 · 11 comments · Fixed by #7991

Comments

@tobiasKaminsky
Copy link
Member

When having not properly setup "trusted_domains" we get on nextcloud android app only "unknown error occured".
We are calling "server/status.php" and get 400 back.
Is 400 only returned in this case, so it is safe to check for this? Or is there a more decent way to get this?

Ratio: from time to time home users approach to us and have it misconfigured. So I want to improve this a bit

@MorrisJobke
Copy link
Member

@nickvergessen @blizzz @rullzer @ChristophWurst Do you have an idea for an API?

@blizzz
Copy link
Member

blizzz commented Jan 15, 2018

We are calling "server/status.php" and get 400 back.

Cannot say or promise for sure. 400 is pretty broad.

Would it already suffice to provide a different message to this code? "400 Untrusted Domain"?

@blizzz
Copy link
Member

blizzz commented Jan 15, 2018

if we go for an API it'll be a bit more invasive since the domain is tested early in base.php

@tobiasKaminsky
Copy link
Member Author

tobiasKaminsky commented Jan 15, 2018

If possible I do not want to check for the message. But maybe an arbitrary status code is possible?

Edit: Maybe it will even work to pass the message directly to the user. I'll have to check.

@rullzer
Copy link
Member

rullzer commented Jan 16, 2018

Well we check early in base php and normally we return a page. We could of cource check for the Accept header and if that is json return some static json.

Of course this only works if you properly check status.php first?

@tobiasKaminsky
Copy link
Member Author

Would it already suffice to provide a different message to this code? "400 Untrusted Domain"?

Currently when accessing /status.php we get the complete html website back.
We are parsing the status code, and return our own string, so changing the message on server side would not be sufficient.

If 400 is only used there, I can simply add a "translation" for 400.
But as 400 is so generic, maybe it is better to return a new one, e.g. 455 is not in use (according to https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_Client_errors)

@MorrisJobke
Copy link
Member

Or just return a proper status.php XML/JSON with the correct error message: 😉 (using HTTP codes for this is not really good)

@tobiasKaminsky
Copy link
Member Author

Well, this can still be accessible via web browser (of course if misconfigured), so a proper NC error web page is still nice for regular web browser user.

@MorrisJobke
Copy link
Member

Well, this can still be accessible via web browser (of course if misconfigured), so a proper NC error web page is still nice for regular web browser user.

But not on the /status.php URL ;)

@tobiasKaminsky
Copy link
Member Author

Indeed 👍

MorrisJobke added a commit that referenced this issue Jan 22, 2018
* fixes #7732

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
@MorrisJobke
Copy link
Member

Fix is in #7991

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants