Merge pull request #38281 from nextcloud/session-auth-check-username-26

[26] check the username when doing external storage session auth

1 files changed, 5 insertions, 0 deletions

diff --git a/apps/files_external/lib/Lib/Auth/Password/SessionCredentials.php b/apps/files_external/lib/Lib/Auth/Password/SessionCredentials.php
index dbe5a2fdc20..228366db204 100644
--- a/apps/files_external/lib/Lib/Auth/Password/SessionCredentials.php
+++ b/apps/files_external/lib/Lib/Auth/Password/SessionCredentials.php
@@ -30,6 +30,7 @@ use OCA\Files_External\Lib\StorageConfig;
 use OCP\Authentication\Exceptions\CredentialsUnavailableException;
 use OCP\Authentication\LoginCredentials\IStore as CredentialsStore;
 use OCP\Files\Storage;
+use OCP\Files\StorageAuthException;
 use OCP\IL10N;
 use OCP\IUser;
 
@@ -57,6 +58,10 @@ class SessionCredentials extends AuthMechanism {
 			throw new InsufficientDataForMeaningfulAnswerException('No session credentials saved');
 		}
 
+		if ($credentials->getUID() !== $user->getUID()) {
+			throw new StorageAuthException('Session credentials for storage owner not available');
+		}
+
 		$storage->setBackendOption('user', $credentials->getLoginName());
 		$storage->setBackendOption('password', $credentials->getPassword());
 	}