Remove unjustified @NoCSRFRequired from DbController::query(), bump max-version to 36

query() runs arbitrary admin SQL (including DELETE/UPDATE) and was
exempted from CSRF protection — a leftover from the original upstream
code, which had this alongside @PublicPage (no auth at all) before our
admin-check hardening. The client already goes through the standard
$.ajax() flow that auto-attaches Nextcloud's CSRF token, exactly like
OccController::cmd() does without any such exemption, so removing it
has no functional cost.

Also bump nextcloud max-version to 36 to match nc01's current core
version, now that AIO auto-updates the core nightly.

Version bump to 0.3.4.

This commit is contained in:

Dillard Blom

2026-09-26 00:36:16 +02:00

parent 7d05643ee6

commit ad0ce047e5

2 changed files with 2 additions and 5 deletions

									
										lib/Controller/DbController.php
									
		-3
	
												View File
												
				@@ -160,9 +160,6 @@ class DbController extends Controller

				        return null;

				    }

				    /**

				     * @NoCSRFRequired

				     */

				    public function query()

				    {

				        // Check admin privileges