tree 04197313b544abdc0bdc967a122f2ac594f3e9c8
parent 50c084579ec4744be7f0ac399f614f35f155aa76
author Rohan Shah <shahrk@google.com> 1455155152 -0800
committer Dirk Vogt <dirk@fairphone.com> 1460988893 +0200

FPII-1822: Patch Exchange Autodiscover Code for Security Issue

Patch Exchange Autodiscover Code for Security Issue

The change removes the unauthenticated GET fallback attempt for the
Autodiscover process. Given that the Autodiscover code is functionally broken
and this fallback attempt wouldn't succeed unless an attacker faked a success
response, a good way to patch the security issue is to disable the attempt.

The change also updates the request content type, disables automatic
redirects, and allows for parsing namespaces to help the first two attempts
succeed. As this is not meant to be a functional patch but a security patch,
there are no further changes to the Autodiscover code.

BUG: 26488455
Change-Id: I0fc93c95e755c8fa60e94da5bec4b3b4c49cdfc1
(cherry picked from commit 0e56d74af392ce548ab7f35b17585af3277257c6)