Merge pull request #15936 from nextcloud/bugfix/15539/wronguser-apptoken-impersonation

Disable app token creation for impersonated people, ref #15539

1 files changed, 23 insertions, 0 deletions

diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php
index 13519d97ef4..ba909c81053 100644
--- a/lib/private/User/Session.php
+++ b/lib/private/User/Session.php
@@ -315,6 +315,29 @@ class Session implements IUserSession, Emitter {
 	}
 
 	/**
+	 * @return mixed
+	 */
+	public function getImpersonatingUserID(): ?string {
+
+		return $this->session->get('oldUserId');
+
+	}
+
+	public function setImpersonatingUserID(bool $useCurrentUser = true): void {
+		if ($useCurrentUser === false) {
+			$this->session->remove('oldUserId');
+			return;
+		}
+
+		$currentUser = $this->getUser();
+
+		if ($currentUser === null) {
+			throw new \OC\User\NoUserException();
+		}
+		$this->session->set('oldUserId', $currentUser->getUID());
+
+	}
+	/**
 	 * set the token id
 	 *
 	 * @param int|null $token that was used to log in