URLEncode logout attribute

Otherwise logout can fail if the requesttoken contains a +

diff --git a/lib/private/security/securerandom.php b/lib/private/security/securerandom.php
index 2402e863fb0c3b8b02886b9834d6885667ac230d..b1169bff2894a8a436bf91e9fd16ce366df4f233 100644 (file)
--- a/lib/private/security/securerandom.php
+++ b/lib/private/security/securerandom.php
@@ -64,8 +64,7 @@ class SecureRandom implements ISecureRandom {
         * Generate a random string of specified length.
         * @param string $length The length of the generated string
         * @param string $characters An optional list of characters to use if no characterlist is
-        *                                                      specified 0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ./
-        *                                                      is used.
+        *                                                      specified all valid base64 characters are used.
         * @return string
         * @throws \Exception If the generator is not initialized.
         */

diff --git a/lib/private/user.php b/lib/private/user.php
index d1fedffcaaffae9391676e51d1c83c872781131a..10457c224f2bb69f439d2cbb24a2614d95918acd 100644 (file)
--- a/lib/private/user.php
+++ b/lib/private/user.php
@@ -366,7 +366,7 @@ class OC_User {
                        return $backend->getLogoutAttribute();
                }
 
-               return 'href="' . link_to('', 'index.php') . '?logout=true&requesttoken=' . OC_Util::callRegister() . '"';
+               return 'href="' . link_to('', 'index.php') . '?logout=true&requesttoken=' . urlencode(OC_Util::callRegister()) . '"';
        }
 
        /**

diff --git a/lib/public/security/isecurerandom.php b/lib/public/security/isecurerandom.php
index 3de60f8d717c1aeaa27fc10c3cad5aea064e0843..b4c488b7f3706724306e748d421aaf71060d75ea 100644 (file)
--- a/lib/public/security/isecurerandom.php
+++ b/lib/public/security/isecurerandom.php
@@ -53,9 +53,10 @@ interface ISecureRandom {
        /**
         * Generate a random string of specified length.
         * @param string $length The length of the generated string
-        * @param string $characters An optional list of characters to use
+        * @param string $characters An optional list of characters to use if no characterlist is
+        *                                                      specified all valid base64 characters are used.
         * @return string
-        * @throws \Exception
+        * @throws \Exception If the generator is not initialized.
         */
        public function generate($length, $characters = '');
 }