Merge pull request #60547 from nextcloud/fed-share-secret-lower-dont-tell

fix: don't tell the remote their token is lower

Author: kesselb

apps/federation/lib/Controller/OCSAuthAPIController.php

@@ -109,7 +109,7 @@ public function requestSharedSecret(string $url, string $token): DataResponse {
 			$this->logger->info(
 				'remote server (' . $url . ') presented lower token. We will initiate the exchange of the shared secret.'
 			);
-			throw new OCSForbiddenException();
+			return new DataResponse();
 		}
 
 		$this->jobList->add(

apps/federation/tests/Controller/OCSAuthAPIControllerTest.php

@@ -90,9 +90,9 @@ public function testRequestSharedSecret(string $token, string $localToken, bool
 
 		try {
 			$this->ocsAuthApi->requestSharedSecret($url, $token);
-			$this->assertTrue($ok);
+			$this->assertTrue($isTrustedServer);
 		} catch (OCSForbiddenException $e) {
-			$this->assertFalse($ok);
+			$this->assertFalse($isTrustedServer);
 		}
 	}
 
@@ -144,7 +144,6 @@ public function testGetSharedSecret(bool $isTrustedServer, bool $isValidToken, b
 
 		try {
 			$result = $ocsAuthApi->getSharedSecret($url, $token);
-			$this->assertTrue($ok);
 			$data = $result->getData();
 			$this->assertSame('secret', $data['sharedSecret']);
 		} catch (OCSForbiddenException $e) {