Repository: owncloud/ocis
Pull request #4731 (2022-10-04 09:27:51)

[full-ci][tests-only] Merge master into experimental
Keep experimental up-to-master


Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 67df8b27741..131495fa989 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@ The following sections list the changes for unreleased.
 * Bugfix - Mail notifications for group shares: [#4714](https://github.com/owncloud/ocis/pull/4714)
 * Bugfix - Fix unfindable entities from shares/publicshares: [#4651](https://github.com/owncloud/ocis/pull/4651)
 * Bugfix - Graph service now forwards trace context: [#4582](https://github.com/owncloud/ocis/pull/4582)
+* Bugfix - Make tokeninfo endpoint unprotected: [#4715](https://github.com/owncloud/ocis/pull/4715)
 * Bugfix - Fix wopi access to public shares: [#4631](https://github.com/owncloud/ocis/pull/4631)
 * Enhancement - Add Email templating: [#4564](https://github.com/owncloud/ocis/pull/4564)
 * Enhancement - Add webURL to space root: [#4588](https://github.com/owncloud/ocis/pull/4588)
@@ -102,6 +103,12 @@ The following sections list the changes for unreleased.
 
    https://github.com/owncloud/ocis/pull/4582
 
+* Bugfix - Make tokeninfo endpoint unprotected: [#4715](https://github.com/owncloud/ocis/pull/4715)
+
+   Make the tokeninfo endpoint unprotected as it is supposed to be available to the public.
+
+   https://github.com/owncloud/ocis/pull/4715
+
 * Bugfix - Fix wopi access to public shares: [#4631](https://github.com/owncloud/ocis/pull/4631)
 
    I've added a request check to the public share authenticator middleware to allow wopi to access
diff --git a/changelog/unreleased/tokeninfo-endpoint-auth.md b/changelog/unreleased/tokeninfo-endpoint-auth.md
new file mode 100644
index 00000000000..856dfcb5817
--- /dev/null
+++ b/changelog/unreleased/tokeninfo-endpoint-auth.md
@@ -0,0 +1,5 @@
+Bugfix: Make tokeninfo endpoint unprotected
+
+Make the tokeninfo endpoint unprotected as it is supposed to be available to the public.
+
+https://github.com/owncloud/ocis/pull/4715
diff --git a/go.mod b/go.mod
index 8ffe692fd90..778b7175e10 100644
--- a/go.mod
+++ b/go.mod
@@ -11,8 +11,8 @@ require (
 	github.com/bbalet/stopwords v1.0.0
 	github.com/blevesearch/bleve/v2 v2.3.4
 	github.com/coreos/go-oidc/v3 v3.4.0
-	github.com/cs3org/go-cs3apis v0.0.0-20220818202316-e92afdddac6d
-	github.com/cs3org/reva/v2 v2.10.1-0.20220929111800-a79d5b3430ec
+	github.com/cs3org/go-cs3apis v0.0.0-20220929083235-bb0b1a236d6c
+	github.com/cs3org/reva/v2 v2.10.1-0.20221004072729-ae801d2d7074
 	github.com/disintegration/imaging v1.6.2
 	github.com/ggwhite/go-masker v1.0.9
 	github.com/go-chi/chi/v5 v5.0.7
diff --git a/go.sum b/go.sum
index 965bff25ec5..0dfd660bbd9 100644
--- a/go.sum
+++ b/go.sum
@@ -297,12 +297,10 @@ github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo
 github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4=
 github.com/crewjam/saml v0.4.6 h1:XCUFPkQSJLvzyl4cW9OvpWUbRf0gE7VUpU8ZnilbeM4=
 github.com/crewjam/saml v0.4.6/go.mod h1:ZBOXnNPFzB3CgOkRm7Nd6IVdkG+l/wF+0ZXLqD96t1A=
-github.com/cs3org/go-cs3apis v0.0.0-20220818202316-e92afdddac6d h1:toyZ7IsXlUdEPZ/IG8fg7hbM8HcLPY0bkX4FKBmgLVI=
-github.com/cs3org/go-cs3apis v0.0.0-20220818202316-e92afdddac6d/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
-github.com/cs3org/reva/v2 v2.10.1-0.20220928094556-1ed01295a37f h1:OxQs1Hx+34jeJ/5IO90jh7pQBYXtIwfHfo2eOE3YkHQ=
-github.com/cs3org/reva/v2 v2.10.1-0.20220928094556-1ed01295a37f/go.mod h1:JOZwTIVUp3T/NyAWFtKI8njZIxWdTrjw7MAwSnGrLp8=
-github.com/cs3org/reva/v2 v2.10.1-0.20220929111800-a79d5b3430ec h1:hCBTZdZ6aTt+xMY73HCfTMRKK2YIcIAOeHpstfHjPi4=
-github.com/cs3org/reva/v2 v2.10.1-0.20220929111800-a79d5b3430ec/go.mod h1:JOZwTIVUp3T/NyAWFtKI8njZIxWdTrjw7MAwSnGrLp8=
+github.com/cs3org/go-cs3apis v0.0.0-20220929083235-bb0b1a236d6c h1:b+YTmOGlf43mnF8MzO0fsy8/Ho8JLu44Iq5Y0fKLJMM=
+github.com/cs3org/go-cs3apis v0.0.0-20220929083235-bb0b1a236d6c/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
+github.com/cs3org/reva/v2 v2.10.1-0.20221004072729-ae801d2d7074 h1:EmPAhaKPwXGOTFpmFAoYrfw/E0BBJggJAhnQT05SLOg=
+github.com/cs3org/reva/v2 v2.10.1-0.20221004072729-ae801d2d7074/go.mod h1:ry7tbWaS1gLGJZ5ir++badl4Cli+UBXlLx91bxYM76A=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
diff --git a/services/proxy/pkg/middleware/authentication.go b/services/proxy/pkg/middleware/authentication.go
index 90ad1e6fba8..d32decfe59a 100644
--- a/services/proxy/pkg/middleware/authentication.go
+++ b/services/proxy/pkg/middleware/authentication.go
@@ -24,7 +24,8 @@ var (
 	_publicPaths = [...]string{
 		"/dav/public-files/",
 		"/remote.php/dav/public-files/",
-		"/remote.php/ocs/apps/files_sharing/api/v1/tokeninfo/unprotected",
+		"/ocs/v1.php/apps/files_sharing/api/v1/tokeninfo/unprotected",
+		"/ocs/v2.php/apps/files_sharing/api/v1/tokeninfo/unprotected",
 		"/ocs/v1.php/cloud/capabilities",
 	}
 )


Test patch:
diff --git a/services/proxy/pkg/middleware/authentication_test.go b/services/proxy/pkg/middleware/authentication_test.go
index 1188fefa343..17c151aebac 100644
--- a/services/proxy/pkg/middleware/authentication_test.go
+++ b/services/proxy/pkg/middleware/authentication_test.go
@@ -13,7 +13,8 @@ var _ = Describe("authentication helpers", func() {
 		},
 		Entry("public files path", "/remote.php/dav/public-files/", true),
 		Entry("public files path without remote.php", "/remote.php/dav/public-files/", true),
-		Entry("token info path", "/remote.php/ocs/apps/files_sharing/api/v1/tokeninfo/unprotected", true),
+		Entry("token info path", "/ocs/v1.php/apps/files_sharing/api/v1/tokeninfo/unprotected", true),
+		Entry("token info path", "/ocs/v2.php/apps/files_sharing/api/v1/tokeninfo/unprotected", true),
 		Entry("capabilities", "/ocs/v1.php/cloud/capabilities", true),
 	)
 })