Merge pull request #9823 from nextcloud/bufgix/noid/update_token_on_session_id_regenerate

Update the token on session regeneration

5 files changed, 41 insertions, 6 deletions

diff --git a/lib/private/Session/CryptoSessionData.php b/lib/private/Session/CryptoSessionData.php
index b63b568875e..01cac631870 100644
--- a/lib/private/Session/CryptoSessionData.php
+++ b/lib/private/Session/CryptoSessionData.php
@@ -150,10 +150,11 @@ class CryptoSessionData implements \ArrayAccess, ISession {
 	 * Wrapper around session_regenerate_id
 	 *
 	 * @param bool $deleteOldSession Whether to delete the old associated session file or not.
+	 * @param bool $updateToken Wheater to update the associated auth token
 	 * @return void
 	 */
-	public function regenerateId(bool $deleteOldSession = true) {
-		$this->session->regenerateId($deleteOldSession);
+	public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {
+		$this->session->regenerateId($deleteOldSession, $updateToken);
 	}
 
 	/**
diff --git a/lib/private/Session/Internal.php b/lib/private/Session/Internal.php
index 1d0466ec349..182754f457c 100644
--- a/lib/private/Session/Internal.php
+++ b/lib/private/Session/Internal.php
@@ -30,6 +30,10 @@ declare(strict_types=1);
 
 namespace OC\Session;
 
+use OC\Authentication\Exceptions\InvalidTokenException;
+use OC\Authentication\Token\IProvider;
+use OC\SystemConfig;
+use OCP\IConfig;
 use OCP\Session\Exceptions\SessionNotAvailableException;
 
 /**
@@ -111,14 +115,41 @@ class Internal extends Session {
 	 * Wrapper around session_regenerate_id
 	 *
 	 * @param bool $deleteOldSession Whether to delete the old associated session file or not.
+	 * @param bool $updateToken Wheater to update the associated auth token
 	 * @return void
 	 */
-	public function regenerateId(bool $deleteOldSession = true) {
+	public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {
+		$oldId = null;
+
+		if ($updateToken) {
+			// Get the old id to update the token
+			try {
+				$oldId = $this->getId();
+			} catch (SessionNotAvailableException $e) {
+				// We can't update a token if there is no previous id
+				$updateToken = false;
+			}
+		}
+
 		try {
 			@session_regenerate_id($deleteOldSession);
 		} catch (\Error $e) {
 			$this->trapError($e->getCode(), $e->getMessage());
 		}
+
+		if ($updateToken) {
+			// Get the new id to update the token
+			$newId = $this->getId();
+
+			/** @var IProvider $tokenProvider */
+			$tokenProvider = \OC::$server->query(IProvider::class);
+
+			try {
+				$tokenProvider->renewSessionToken($oldId, $newId);
+			} catch (InvalidTokenException $e) {
+				// Just ignore
+			}
+		}
 	}
 
 	/**
diff --git a/lib/private/Session/Memory.php b/lib/private/Session/Memory.php
index 79900bc8067..5a2a3039d7b 100644
--- a/lib/private/Session/Memory.php
+++ b/lib/private/Session/Memory.php
@@ -91,7 +91,7 @@ class Memory extends Session {
 	 *
 	 * @param bool $deleteOldSession
 	 */
-	public function regenerateId(bool $deleteOldSession = true) {}
+	public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {}
 
 	/**
 	 * Wrapper around session_id
diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php
index 5d8455fb5f7..ee1439b9e20 100644
--- a/lib/private/User/Session.php
+++ b/lib/private/User/Session.php
@@ -626,6 +626,8 @@ class Session implements IUserSession, Emitter {
 		try {
 			$sessionId = $this->session->getId();
 			$pwd = $this->getPassword($password);
+			// Make sure the current sessionId has no leftover tokens
+			$this->tokenProvider->invalidateToken($sessionId);
 			$this->tokenProvider->generateToken($sessionId, $uid, $loginName, $pwd, $name, IToken::TEMPORARY_TOKEN, $remember);
 			return true;
 		} catch (SessionNotAvailableException $ex) {
diff --git a/lib/public/ISession.php b/lib/public/ISession.php
index 411356b8dcc..bbf36c86520 100644
--- a/lib/public/ISession.php
+++ b/lib/public/ISession.php
@@ -96,10 +96,11 @@ interface ISession {
 	 * Wrapper around session_regenerate_id
 	 *
 	 * @param bool $deleteOldSession Whether to delete the old associated session file or not.
+	 * @param bool $updateToken Wheater to update the associated auth token
 	 * @return void
-	 * @since 9.0.0
+	 * @since 9.0.0, $updateToken added in 14.0.0
 	 */
-	public function regenerateId(bool $deleteOldSession = true);
+	public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false);
 
 	/**
 	 * Wrapper around session_id