Owncloud Account doesn't work with Nextcloud 11

Bug #1651938 reported by slash on 2016-12-22
32
This bug affects 8 people
Affects Status Importance Assigned to Milestone
account-plugins (Ubuntu)
Medium
Alberto Mardegan

Bug Description

Dear,

Since my nextcloud server update i cannot connect anymore to my calendar.
My contacts with syncevolution no problem.

I think i found why, nextcloud reduce the CRSF vulnerability

phablet@ubuntu-phablet:~$ export OAU_LOGGING_LEVEL=2
phablet@ubuntu-phablet:~$ export OAU_DAEMON_TIMEOUT=9999
phablet@ubuntu-phablet:~$ online-accounts-service
service.cpp 42 requestAccess Got request: QMap(("application", QVariant(QString, "system-settings") ) ( "pid" , QVariant(uint, 26947) ) ( "provider" , QVariant(QString, "owncloud") ) ( "windowId" , QVariant(uint, 26947) ) )
App ID: "unconfined"
request-manager.cpp 113 runQueue Head: OnlineAccountsUi::Request(0x1d829d8)
mir-helper.cpp 151 session_event_callback Prompt Session state updated to 1
Loading module: 'libubuntu_application_api_touch_mirclient.so.3.0.0'
ui-server.cpp 103 onDataReady QMap(("code", QVariant(QString, "process") ) ( "data" , QVariant(QVariantMap, QMap(("application", QVariant(QString, "system-settings") ) ( "pid" , QVariant(uint, 26947) ) ( "provider" , QVariant(QString, "owncloud") ) ( "windowId" , QVariant(uint, 26947) ) ) ) ) ( "id" , QVariant(int, 0) ) ( "interface" , QVariant(QString, "com.ubuntu.OnlineAccountsUi") ) ( "profile" , QVariant(QString, "unconfined") ) )
qml: Page_QMLTYPE_24(0x1973a38)"ownCloud": In Ubuntu.Components 1.3, the use of Page.title, Page.flickable and Page.head is deprecated. Use Page.header and the PageHeader component instead.
file:///home/phablet/.local/share/accounts/qml-plugins/owncloud/Main.qml: File not found
virtual void OnlineAccountsPlugin::Plugin::registerTypes(const char*) Ubuntu.OnlineAccounts.Plugin
request.cpp 115 setWindow Requesting window reparenting
QWindow::fromWinId(): platform plugin does not support foreign windows.
APP_ID isn't set, the handler ignored
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
qml: Trying host https://server as login:password
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
file:///usr/share/accounts/qml-plugins/owncloud/Main.qml:4:1: QML Main: Binding loop detected for property "contentHeight"
qml: response: {"message":"CSRF check failed"}
qml: callback called: false

For more info on Nexcloud update : https://nextcloud.com/blog/nextcloud-11-delivers-verified-security-improvements/

Regards

Related branches

Alberto Mardegan (mardy) wrote :

Hi Slash, thanks for reporting this bug. As I understand from your logs, it's not even possible to create a nextcloud account; can you please confirm this?

Anyway, this looks like a bug in the Nextcloud server implementation: CSRF is not something that normally affects REST APIs, which are stateless by definition. When registering the account, we are passing username and password with every function call.

Please file a bug against Nextcloud, and write here the link to the report, so that I can comment in case they ask for more information.

For the record, the API we are using when verifying whether the account is valid is /ocs/v1.php/person/check, which is documented here:
https://www.freedesktop.org/wiki/Specifications/open-collaboration-services/#index4h4

I think they forced the CSRF check on all API, including the public REST APIs, by mistake.

Changed in account-plugins (Ubuntu):
status: New → Incomplete
slash (slash-tux) wrote :

Yes, I cannot even create a nextcloud account on the phone.

As suggested i've open the discussion on their side : https://github.com/nextcloud/server/issues/2853

Thanks

Alberto Mardegan (mardy) wrote :

Mmm... I just found this:

    https://github.com/nextcloud/server/issues/2753

We could try to add that header, and see if things work.

Alberto Mardegan (mardy) on 2017-03-14
Changed in account-plugins (Ubuntu):
status: Incomplete → Confirmed
importance: Undecided → Medium
assignee: nobody → Alberto Mardegan (mardy)
Alberto Mardegan (mardy) wrote :
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package account-plugins - 0.13+17.04.20170314-0ubuntu1

---------------
account-plugins (0.13+17.04.20170314-0ubuntu1) zesty; urgency=medium

  * NextCloud/OwnCloud: fix account creation on newer releases (LP:
    #1651938)

 -- Alberto Mardegan <email address hidden> Tue, 14 Mar 2017 10:30:56 +0000

Changed in account-plugins (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Bug watches keep track of this bug in other bug trackers.