Added check for mtime to be integer

[virajparimi]

Description

Added check in File.php of dav app in order to ensure that $request->server['HTTP_X_OC_MTIME'] is an integer. If it is not then throws a BadRequest exception.

Related Issue

#27437

Motivation and Context

How Has This Been Tested?

Have not tested it thoroughly.
Chrome and Ubuntu 14.04

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[PVince81]

=> "X-OC-MTime header must be an integer" would be a bit clearer

[PVince81]

Code looks good otherwise, thanks !

[virajparimi]

@PVince81 done

[PVince81]

Please test with the desktop client, apparently the value is not recognized as int by is_int, you might need to use another approach to detect this.

``'
// => eval: $request->server['HTTP_X_OC_MTIME']
$evalResult = (string[10]) '1491982450';

// => eval: is_int($request->server['HTTP_X_OC_MTIME'])
$evalResult = (bool) '0';

[virajparimi]

Ahh, so the $request->server['HTTP_X_OC_MTIME'] is a string and not an integer. Okay, one possible solution is to use strpos to get the position of . if any, otherwise it would return false and then everything else remains same. What do you think?

[PVince81]

strpos is not acceptable because it wouldn't catch other cases where someone sends an invalid value (for example if someone is crazy enough to send a ISO formatted date instead of an int)

[individual-it]

the is_int approach has also the problem that negative values would be accepted
I've changed the File.php so that put() should be easier testable and added some tests.
@Viraj96 I've made a PR to your fork virajparimi#1
You can think of more tests

[PVince81]

any update ?

[virajparimi]

@PVince81 Hi, I have been busy with my End Semester Exams. Will work on it once they get over by this weekend. Sorry for the delay caused.

[mrow4a]

Any update here, or can I review?

[individual-it]

here is an alternative approach #28066 don't throw any errors but simply make sure the value is legal

[mrow4a]

This one can be closed since the other approach has been merged right? @PVince81

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.