diff --git a/lib/Checker.php b/lib/Checker.php index 3390662d..be83cb99 100644 --- a/lib/Checker.php +++ b/lib/Checker.php @@ -92,8 +92,8 @@ public function currentUserHasSigned(): bool { protected function isAllowedRequest(): bool { return $this->isRequestAllowedInConfig() - || $this->isValidWOPIRequest('richdocuments') - || $this->isValidWOPIRequest('officeonline'); + || $this->isValidWOPIOrSettingsRequest('richdocuments') + || $this->isValidWOPIOrSettingsRequest('officeonline'); } protected function isRequestAllowedInConfig(): bool { @@ -104,11 +104,12 @@ protected function isRequestAllowedInConfig(): bool { && $this->isAllowedScriptName(); } - protected function isValidWOPIRequest(string $app): bool { - $allowedPath = '/apps/' . $app . '/wopi/'; + protected function isValidWOPIOrSettingsRequest(string $app): bool { + $allowedPathWOPI = '/apps/' . $app . '/wopi/'; + $allowedPathSettings = '/apps/' . $app . '/settings/'; $allowedRanges = $this->allowedRangeForApp($app, 'wopi_allowlist'); return $this->isRemoteAddressInRanges($allowedRanges) - && $this->isPathInfoStartingWith($allowedPath) + && ($this->isPathInfoStartingWith($allowedPathWOPI) || $this->isPathInfoStartingWith($allowedPathSettings)) && $this->isAllowedScriptName(); }