Text preview not available when outgoing s2s shares disabled

[PVince81]

The new text preview from @oparoz is using public.php/webdav to load the text file.

This is not a problem with previews, but rather with the way the endpoint was designed to work.
Also at some point we'd like to make the files app use WebDAV endpoints too #12353 so I think it is valid to expect the public WebDAV endpoint to always work too.

The workaround here would be to provide a separate endpoint for text previews, which would at the same time solve the encoding issues: #16229

See #16439 for the discussion about public.php/webdav

[oparoz]

I didn't think public.php/webdav could be disabled...

[PVince81]

I might be the one who recommended it to you... sorry... back then I forgot that it could be disabled.

[oparoz]

I still think it's the right approach, but that means finding a way to disable s2s another way and that doesn't seem trivial.

[PVince81]

Yeah, that's what I think too. Public WebDAV should always be enabled.

[PVince81]

Well, there might be ways to disable s2s for "friendly" server like telling them gently to stop connecting, but it's not a "safe" solution as there will always be ways to connect.

[oparoz]

Yep and that's a problem.
Wouldn't it be possible to fix this via policies? Only local calls allowed when s2s is disabled.

[PVince81]

What kind of policies ?
If we think about detecting the origin of the public.php/webdav call, it will always be remote, either from a browser or from a remote ownCloud (or any other cloud server that supports it).

[oparoz]

I was thinking "domain of the requester should match domain of the endpoint"

[PVince81]

So basically checking the "Referer" header ? That could work as a simple fix, as the field could be spoofed if a (hacked?) remote server absolutely does want to connect.

[oparoz]

Yes, referer header of via CSP or using the CSRF?

[oparoz]

@LukasReschke - Tell us what to use! :)

[PVince81]

@LukasReschke some magic keywords mentioned above 🌟 blingblingbling ⭐

[PVince81]

I think we're not talking "watertight" security here, just a way to gently prevent remote servers to mount local shares.

[PVince81]

@oparoz instead of referer header I just used "X-Requested-With" with the value "XMLHttpRequest" here #17601

Then we need to make sure the code that loads the preview also sends that header, might happen automatically if done with jQuery.

[PVince81]

Already works on 8.2/master, it seems the headers is already being sent.