Merge pull request #46184 from nextcloud/fix/dav-auth-check

fix: Authorization header can be an empty string
nextcloud · Jul 1, 2024 · 3b75c5b · 3b75c5b
2 parents 7525edd + 4d6b4b7
commit 3b75c5b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/apps/dav/lib/Connector/Sabre/Auth.php b/apps/dav/lib/Connector/Sabre/Auth.php
@@ -185,7 +185,7 @@ private function auth(RequestInterface $request, ResponseInterface $response): a
 				//Fix for broken webdav clients
 				($this->userSession->isLoggedIn() && is_null($this->session->get(self::DAV_AUTHENTICATED))) ||
 				//Well behaved clients that only send the cookie are allowed
-				($this->userSession->isLoggedIn() && $this->session->get(self::DAV_AUTHENTICATED) === $this->userSession->getUser()->getUID() && $request->getHeader('Authorization') === null) ||
+				($this->userSession->isLoggedIn() && $this->session->get(self::DAV_AUTHENTICATED) === $this->userSession->getUser()->getUID() && empty($request->getHeader('Authorization'))) ||
 				\OC_User::handleApacheAuth()
 			) {
 				$user = $this->userSession->getUser()->getUID();