fix: Lock session during renewal from cookiefix/lock-session-during-cookie-renew

Signed-off-by: Julius Härtl <jus@bitgrid.net>

1 files changed, 7 insertions, 0 deletions

diff --git a/lib/base.php b/lib/base.php
index 891161ff0c6..eeedea00372 100644
--- a/lib/base.php
+++ b/lib/base.php
@@ -1126,12 +1126,19 @@ class OC {
 		if ($userSession->tryTokenLogin($request)) {
 			return true;
 		}
+		$reopened = $userSession->getSession()->reopen();
 		if (isset($_COOKIE['nc_username'])
 			&& isset($_COOKIE['nc_token'])
 			&& isset($_COOKIE['nc_session_id'])
 			&& $userSession->loginWithCookie($_COOKIE['nc_username'], $_COOKIE['nc_token'], $_COOKIE['nc_session_id'])) {
+			if ($reopened) {
+				$userSession->getSession()->close();
+			}
 			return true;
 		}
+		if ($reopened) {
+			$userSession->getSession()->close();
+		}
 		if ($userSession->tryBasicAuthLogin($request, Server::get(IThrottler::class))) {
 			return true;
 		}