diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2015-10-19 19:54:12 +0200 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2015-10-19 19:54:12 +0200 |
| commit | 5588c5f262b37ebb736c9cada0dc2a0fe2a70f7c (patch) | |
| tree | 4ed46f1700d17ed41f4112c3d4c51d85838628d2 | |
| parent | 3d4e0ba4e7d6e4b3e9aaf943e3d74d1a5ee9acd2 (diff) | |
| download | nextcloud-server-5588c5f262b37ebb736c9cada0dc2a0fe2a70f7c.tar.gz nextcloud-server-5588c5f262b37ebb736c9cada0dc2a0fe2a70f7c.zip | |
Delete cookie instead of emptying value
PHP will handle session cookies with an empty values as an E_WARNING error. ([php/#68063](https://bugs.php.net/bug.php?id=68063))
ownCloud sets the cookie to an empty value in case the session expires, it however after this starts a new session. Due to potential race conditions this can in unlikely cases lead to the fact that the session never gets restarted and the user is left with an empty cookie. PHP tries then to use the empty cookie which makes the instance not usable.
To work around any race condition we now tell PHP to explicitly delete the value which can be done by using `null` as value, PHP will then send a cookie with the value "deleted". Also theepiration has been set to -1.
| -rw-r--r-- | lib/base.php | 3 | ||||
| -rw-r--r-- | lib/private/session/internal.php | 6 |
2 files changed, 7 insertions, 2 deletions
diff --git a/lib/base.php b/lib/base.php index 5deba7866f3..09e1d0aea49 100644 --- a/lib/base.php +++ b/lib/base.php @@ -427,7 +427,8 @@ class OC { // session timeout if ($session->exists('LAST_ACTIVITY') && (time() - $session->get('LAST_ACTIVITY') > $sessionLifeTime)) { if (isset($_COOKIE[session_name()])) { - setcookie(session_name(), '', time() - 42000, $cookie_path); + setcookie(session_name(), null, -1, self::$WEBROOT ? : '/'); + unset($_COOKIE[session_name()]); } session_unset(); session_destroy(); diff --git a/lib/private/session/internal.php b/lib/private/session/internal.php index 01d4569fd81..0b6152acf12 100644 --- a/lib/private/session/internal.php +++ b/lib/private/session/internal.php @@ -41,7 +41,11 @@ class Internal extends Session { public function __construct($name) { session_name($name); set_error_handler(array($this, 'trapError')); - session_start(); + try { + session_start(); + } catch (\Exception $e) { + setcookie(session_name(), null, -1, \OC::$WEBROOT ? : '/'); + } restore_error_handler(); if (!isset($_SESSION)) { throw new \Exception('Failed to start session'); |