Skip to content

Commit 410bddd

Browse files
pulsejetpulsejet
committed
fix(dav): multiple fixes in usage of webdav library
1. Refresh token on update 2. Fix some very weird imports 3. Patch fetch instead of request to prevent accessing impl details Signed-off-by: Varun Patil <[email protected]>
1 parent 4aa8433 commit 410bddd

37 files changed

+158
-108
lines changed

‎apps/comments/src/services/DavClient.js‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,23 @@
2222

2323
import { createClient } from 'webdav'
2424
import { getRootPath } from '../utils/davUtils.js'
25-
import { getRequestToken } from '@nextcloud/auth'
25+
import { getRequestToken, onRequestTokenUpdate } from '@nextcloud/auth'
2626

2727
// init webdav client
28-
const client = createClient(getRootPath(), {
29-
headers: {
30-
// Add this so the server knows it is an request from the browser
31-
'X-Requested-With': 'XMLHttpRequest',
32-
// Inject user auth
33-
requesttoken: getRequestToken() ?? '',
34-
},
35-
})
28+
const client = createClient(getRootPath())
29+
30+
// set CSRF token header
31+
const setHeaders = (token) => {
32+
client.setHeaders({
33+
// Add this so the server knows it is an request from the browser
34+
'X-Requested-With': 'XMLHttpRequest',
35+
// Inject user auth
36+
requesttoken: token ?? '',
37+
})
38+
}
39+
40+
// refresh headers when request token changes
41+
onRequestTokenUpdate(setHeaders)
42+
setHeaders(getRequestToken())
3643

3744
export default client

‎apps/comments/src/services/GetComments.ts‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@
2323
import { parseXML, type DAVResult, type FileStat, type ResponseDataDetailed } from 'webdav'
2424

2525
// https://github.com/perry-mitchell/webdav-client/issues/339
26-
import { processResponsePayload } from '../../../../node_modules/webdav/dist/node/response.js'
27-
import { prepareFileFromProps } from '../../../../node_modules/webdav/dist/node/tools/dav.js'
26+
import { processResponsePayload } from 'webdav/dist/node/response.js'
27+
import { prepareFileFromProps } from 'webdav/dist/node/tools/dav.js'
2828
import client from './DavClient.js'
2929

3030
export const DEFAULT_LIMIT = 20
@@ -77,10 +77,8 @@ const getDirectoryFiles = function(
7777
// Map all items to a consistent output structure (results)
7878
return responseItems.map(item => {
7979
// Each item should contain a stat object
80-
const {
81-
propstat: { prop: props },
82-
} = item
80+
const props = item.propstat!.prop!;
8381

84-
return prepareFileFromProps(props, props.id.toString(), isDetailed)
82+
return prepareFileFromProps(props, props.id!.toString(), isDetailed)
8583
})
8684
}

‎apps/dav/src/dav/client.js‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -19,21 +19,29 @@
1919
* along with this program. If not, see <http://www.gnu.org/licenses/>.
2020
*/
2121

22-
import * as webdav from 'webdav'
23-
import axios from '@nextcloud/axios'
22+
import { createClient } from 'webdav'
2423
import memoize from 'lodash/fp/memoize.js'
2524
import { generateRemoteUrl } from '@nextcloud/router'
26-
import { getCurrentUser } from '@nextcloud/auth'
25+
import { getCurrentUser, getRequestToken, onRequestTokenUpdate } from '@nextcloud/auth'
2726

2827
export const getClient = memoize((service) => {
29-
// Add this so the server knows it is an request from the browser
30-
axios.defaults.headers['X-Requested-With'] = 'XMLHttpRequest'
28+
// init webdav client
29+
const remote = generateRemoteUrl(`dav/${service}/${getCurrentUser().uid}`)
30+
const client = createClient(remote)
3131

32-
// force our axios
33-
const patcher = webdav.getPatcher()
34-
patcher.patch('request', axios)
32+
// set CSRF token header
33+
const setHeaders = (token) => {
34+
client.setHeaders({
35+
// Add this so the server knows it is an request from the browser
36+
'X-Requested-With': 'XMLHttpRequest',
37+
// Inject user auth
38+
requesttoken: token ?? '',
39+
})
40+
}
3541

36-
return webdav.createClient(
37-
generateRemoteUrl(`dav/${service}/${getCurrentUser().uid}`)
38-
)
42+
// refresh headers when request token changes
43+
onRequestTokenUpdate(setHeaders)
44+
setHeaders(getRequestToken())
45+
46+
return client;
3947
})

‎apps/files/src/services/WebdavClient.ts‎

Lines changed: 24 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -19,22 +19,30 @@
1919
* along with this program. If not, see <http://www.gnu.org/licenses/>.
2020
*
2121
*/
22-
import type { RequestOptions, Response } from 'webdav'
2322

2423
import { createClient, getPatcher } from 'webdav'
2524
import { generateRemoteUrl } from '@nextcloud/router'
26-
import { getCurrentUser, getRequestToken } from '@nextcloud/auth'
27-
import { request } from 'webdav/dist/node/request.js'
25+
import { getCurrentUser, getRequestToken, onRequestTokenUpdate } from '@nextcloud/auth'
2826

2927
export const rootPath = `/files/${getCurrentUser()?.uid}`
3028
export const defaultRootUrl = generateRemoteUrl('dav' + rootPath)
3129

3230
export const getClient = (rootUrl = defaultRootUrl) => {
33-
const client = createClient(rootUrl, {
34-
headers: {
35-
requesttoken: getRequestToken() || '',
36-
},
37-
})
31+
const client = createClient(rootUrl)
32+
33+
// set CSRF token header
34+
const setHeaders = (token: string | null) => {
35+
client?.setHeaders({
36+
// Add this so the server knows it is an request from the browser
37+
'X-Requested-With': 'XMLHttpRequest',
38+
// Inject user auth
39+
requesttoken: token ?? '',
40+
});
41+
}
42+
43+
// refresh headers when request token changes
44+
onRequestTokenUpdate(setHeaders)
45+
setHeaders(getRequestToken())
3846

3947
/**
4048
* Allow to override the METHOD to support dav REPORT
@@ -45,12 +53,14 @@ export const getClient = (rootUrl = defaultRootUrl) => {
4553
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
4654
// @ts-ignore
4755
// https://github.com/perry-mitchell/hot-patcher/issues/6
48-
patcher.patch('request', (options: RequestOptions): Promise<Response> => {
49-
if (options.headers?.method) {
50-
options.method = options.headers.method
51-
delete options.headers.method
56+
patcher.patch('fetch', (url: string, options: RequestInit): Promise<Response> => {
57+
const headers = options.headers as Record<string, string>
58+
if (headers?.method) {
59+
options.method = headers.method
60+
delete headers.method
5261
}
53-
return request(options)
62+
return fetch(url, options)
5463
})
55-
return client
64+
65+
return client;
5666
}

‎apps/files_trashbin/src/services/client.ts‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,28 @@
1919
* along with this program. If not, see <http://www.gnu.org/licenses/>.
2020
*
2121
*/
22+
2223
import { createClient } from 'webdav'
2324
import { generateRemoteUrl } from '@nextcloud/router'
24-
import { getCurrentUser, getRequestToken } from '@nextcloud/auth'
25+
import { getCurrentUser, getRequestToken, onRequestTokenUpdate } from '@nextcloud/auth'
2526

27+
// init webdav client
2628
export const rootPath = `/trashbin/${getCurrentUser()?.uid}/trash`
2729
export const rootUrl = generateRemoteUrl('dav' + rootPath)
28-
const client = createClient(rootUrl, {
29-
headers: {
30-
requesttoken: getRequestToken(),
31-
},
32-
})
30+
const client = createClient(rootUrl)
31+
32+
// set CSRF token header
33+
const setHeaders = (token: string | null) => {
34+
client.setHeaders({
35+
// Add this so the server knows it is an request from the browser
36+
'X-Requested-With': 'XMLHttpRequest',
37+
// Inject user auth
38+
requesttoken: token ?? '',
39+
})
40+
}
41+
42+
// refresh headers when request token changes
43+
onRequestTokenUpdate(setHeaders)
44+
setHeaders(getRequestToken())
45+
3346
export default client

‎apps/files_versions/src/utils/davClient.js‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -21,17 +21,25 @@
2121

2222
import { createClient } from 'webdav'
2323
import { generateRemoteUrl } from '@nextcloud/router'
24-
import { getRequestToken } from '@nextcloud/auth'
24+
import { getRequestToken, onRequestTokenUpdate } from '@nextcloud/auth'
2525

26+
// init webdav client
2627
const rootPath = 'dav'
27-
28-
// init webdav client on default dav endpoint
2928
const remote = generateRemoteUrl(rootPath)
30-
export default createClient(remote, {
31-
headers: {
32-
// Add this so the server knows it is an request from the browser
33-
'X-Requested-With': 'XMLHttpRequest',
34-
// Inject user auth
35-
requesttoken: getRequestToken() ?? '',
36-
},
37-
})
29+
const client = createClient(remote)
30+
31+
// set CSRF token header
32+
const setHeaders = (token) => {
33+
client.setHeaders({
34+
// Add this so the server knows it is an request from the browser
35+
'X-Requested-With': 'XMLHttpRequest',
36+
// Inject user auth
37+
requesttoken: token ?? '',
38+
})
39+
}
40+
41+
// refresh headers when request token changes
42+
onRequestTokenUpdate(setHeaders)
43+
setHeaders(getRequestToken())
44+
45+
export default client

‎apps/systemtags/src/services/davClient.ts‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,22 @@
2222

2323
import { createClient } from 'webdav'
2424
import { generateRemoteUrl } from '@nextcloud/router'
25-
import { getRequestToken } from '@nextcloud/auth'
25+
import { getRequestToken, onRequestTokenUpdate } from '@nextcloud/auth'
2626

27+
// init webdav client
2728
const rootUrl = generateRemoteUrl('dav')
29+
export const davClient = createClient(rootUrl)
2830

29-
export const davClient = createClient(rootUrl, {
30-
headers: {
31-
requesttoken: getRequestToken() ?? '',
32-
},
33-
})
31+
// set CSRF token header
32+
const setHeaders = (token: string | null) => {
33+
davClient.setHeaders({
34+
// Add this so the server knows it is an request from the browser
35+
'X-Requested-With': 'XMLHttpRequest',
36+
// Inject user auth
37+
requesttoken: token ?? '',
38+
})
39+
}
40+
41+
// refresh headers when request token changes
42+
onRequestTokenUpdate(setHeaders)
43+
setHeaders(getRequestToken())

‎dist/614-614.js‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/614-614.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/comments-comments-app.js‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)