Use `/` if installed in main folder

Otherwise an empty string is used indicating the cookie is only valid for those resources. This can lead to eunexpected behaviour.

Fixes https://github.com/owncloud/core/issues/19196

2 files changed, 14 insertions, 4 deletions

diff --git a/lib/private/appframework/dependencyinjection/dicontainer.php b/lib/private/appframework/dependencyinjection/dicontainer.php
index 4779d6bf0ad..651b268a35e 100644
--- a/lib/private/appframework/dependencyinjection/dicontainer.php
+++ b/lib/private/appframework/dependencyinjection/dicontainer.php
@@ -79,7 +79,7 @@ class DIContainer extends SimpleContainer implements IAppContainer {
 		});
 
 		$this->registerService('OCP\\AppFramework\\Http\\IOutput', function($c){
-			return new Output();
+			return new Output($this->getServer()->getWebRoot());
 		});
 
 		$this->registerService('OCP\\IAvatarManager', function($c) {
diff --git a/lib/private/appframework/http/output.php b/lib/private/appframework/http/output.php
index f04157665f8..01636d397b2 100644
--- a/lib/private/appframework/http/output.php
+++ b/lib/private/appframework/http/output.php
@@ -27,6 +27,15 @@ use OCP\AppFramework\Http\IOutput;
  * Very thin wrapper class to make output testable
  */
 class Output implements IOutput {
+	/** @var string */
+	private $webRoot;
+
+	/**
+	 * @param $webRoot
+	 */
+	public function __construct($webRoot) {
+		$this->webRoot = $webRoot;
+	}
 
 	/**
 	 * @param string $out
@@ -72,10 +81,11 @@ class Output implements IOutput {
 	 * @param string $path
 	 * @param string $domain
 	 * @param bool $secure
-	 * @param bool $httponly
+	 * @param bool $httpOnly
 	 */
-	public function setCookie($name, $value, $expire, $path, $domain, $secure, $httponly) {
-		setcookie($name, $value, $expire, $path, $domain, $secure, $httponly);
+	public function setCookie($name, $value, $expire, $path, $domain, $secure, $httpOnly) {
+		$path = $this->webRoot ? : '/';
+		setcookie($name, $value, $expire, $path, $domain, $secure, $httpOnly);
 	}
 
 }