fixup! fix: Check strict cookies for image proxy

Signed-off-by: Christoph Wurst <[email protected]>

lib/Controller/ProxyController.php

@@ -103,15 +103,15 @@ public function redirect(string $src): TemplateResponse {
 	 * @return ProxyDownloadResponse
 	 */
 	public function proxy(string $src): ProxyDownloadResponse {
+		// close the session to allow parallel downloads
+		$this->session->close();
+
 		// If strict cookies are set it means we come from the same domain so no open redirect
 		if (!$this->request->passesStrictCookieCheck()) {
 			$content = file_get_contents(__DIR__ . '/../../img/blocked-image.png');
 			return new ProxyDownloadResponse($content, $src, 'application/octet-stream');
 		}
 
-		// close the session to allow parallel downloads
-		$this->session->close();
-
 		$client = $this->clientService->newClient();
 		try {
 			$response = $client->get($src);

tests/Unit/Controller/ProxyControllerTest.php

@@ -1,5 +1,7 @@
 <?php
 
+declare(strict_types=1);
+
 /**
  * @author Christoph Wurst <[email protected]>
  *
@@ -156,11 +158,41 @@ public function testRedirectInvalidUrl() {
 		$this->controller->redirect('ftps://example.com');
 	}
 
-	public function testProxy() {
+	public function testProxyWithoutCookies(): void {
 		$src = 'http://example.com';
-		$httpResponse = $this->createMock(IResponse::class);
 		$content = '🐵🐵🐵';
+		$this->session->expects($this->once())
+			->method('close');
+		$client = $this->getMockBuilder(IClient::class)->getMock();
+		$this->clientService->expects(self::never())
+			->method('newClient')
+			->willReturn($client);
+		$unexpected = new ProxyDownloadResponse(
+			$content,
+			$src,
+			'application/octet-stream'
+		);
+		$this->controller = new ProxyController(
+			$this->appName,
+			$this->request,
+			$this->urlGenerator,
+			$this->session,
+			$this->clientService,
+			$this->logger
+		);
+
+		$response = $this->controller->proxy($src);
 
+		$this->assertNotEquals($unexpected, $response);
+	}
+
+	public function testProxy(): void {
+		$src = 'http://example.com';
+		$httpResponse = $this->createMock(IResponse::class);
+		$content = '🐵🐵🐵';
+		$this->request->expects(self::once())
+			->method('passesStrictCookieCheck')
+			->willReturn(true);
 		$this->session->expects($this->once())
 			->method('close');
 		$client = $this->getMockBuilder(IClient::class)->getMock();