Validate cookie to prevent auth bypasses.

diff --git a/index.php b/index.php
index 3c38ff760f8eb478c2480767a6810adfaa10cb87..89eaec7d21a911eea99e7facfcaf24722e8ec982 100644 (file)
--- a/index.php
+++ b/index.php
@@ -77,7 +77,7 @@ elseif(OC_User::isLoggedIn()) {
                }
                // confirm credentials in cookie
                if(isset($_COOKIE['oc_token']) && OC_User::userExists($_COOKIE['oc_username']) &&
-               OC_Preferences::getValue($_COOKIE['oc_username'], "login", "token") == $_COOKIE['oc_token']) {
+               OC_Preferences::getValue($_COOKIE['oc_username'], "login", "token") === $_COOKIE['oc_token']) {
                        OC_User::setUserId($_COOKIE['oc_username']);
                        OC_Util::redirectToDefaultPage();
                }