From ad0ce047e58b8615d3c22edd56952db77a6d7ee0 Mon Sep 17 00:00:00 2001 From: Dillard Blom Date: Sat, 26 Sep 2026 00:36:16 +0200 Subject: [PATCH] Remove unjustified @NoCSRFRequired from DbController::query(), bump max-version to 36 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit query() runs arbitrary admin SQL (including DELETE/UPDATE) and was exempted from CSRF protection — a leftover from the original upstream code, which had this alongside @PublicPage (no auth at all) before our admin-check hardening. The client already goes through the standard $.ajax() flow that auto-attaches Nextcloud's CSRF token, exactly like OccController::cmd() does without any such exemption, so removing it has no functional cost. Also bump nextcloud max-version to 36 to match nc01's current core version, now that AIO auto-updates the core nightly. Version bump to 0.3.4. --- appinfo/info.xml | 4 ++-- lib/Controller/DbController.php | 3 --- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/appinfo/info.xml b/appinfo/info.xml index 1b1599a..7457db3 100644 --- a/appinfo/info.xml +++ b/appinfo/info.xml @@ -5,7 +5,7 @@ Extended OCC Web OCC Commands in a web terminal - 0.3.3 + 0.3.4 agpl Egor OCCWeb @@ -15,7 +15,7 @@ https://github.com/fanategorius/occweb https://github.com/fanategorius/occweb/raw/main/appinfo/screenshot.png - + diff --git a/lib/Controller/DbController.php b/lib/Controller/DbController.php index 29c32e6..31afa38 100644 --- a/lib/Controller/DbController.php +++ b/lib/Controller/DbController.php @@ -160,9 +160,6 @@ class DbController extends Controller return null; } - /** - * @NoCSRFRequired - */ public function query() { // Check admin privileges