diff options
| -rw-r--r-- | apps/files_sharing/lib/Controller/ShareController.php | 2 | ||||
| -rw-r--r-- | lib/private/Session/CryptoSessionData.php | 5 | ||||
| -rw-r--r-- | lib/private/Session/Internal.php | 33 | ||||
| -rw-r--r-- | lib/private/Session/Memory.php | 2 | ||||
| -rw-r--r-- | lib/private/User/Session.php | 2 | ||||
| -rw-r--r-- | lib/public/ISession.php | 5 |
6 files changed, 42 insertions, 7 deletions
diff --git a/apps/files_sharing/lib/Controller/ShareController.php b/apps/files_sharing/lib/Controller/ShareController.php index f8749526900..859873de1a2 100644 --- a/apps/files_sharing/lib/Controller/ShareController.php +++ b/apps/files_sharing/lib/Controller/ShareController.php @@ -204,7 +204,7 @@ class ShareController extends Controller { private function linkShareAuth(\OCP\Share\IShare $share, $password = null) { if ($password !== null) { if ($this->shareManager->checkPassword($share, $password)) { - $this->session->regenerateId(); + $this->session->regenerateId(true, true); $this->session->set('public_link_authenticated', (string)$share->getId()); } else { $this->emitAccessShareHook($share, 403, 'Wrong password'); diff --git a/lib/private/Session/CryptoSessionData.php b/lib/private/Session/CryptoSessionData.php index 272e82ef496..24582b35186 100644 --- a/lib/private/Session/CryptoSessionData.php +++ b/lib/private/Session/CryptoSessionData.php @@ -149,10 +149,11 @@ class CryptoSessionData implements \ArrayAccess, ISession { * Wrapper around session_regenerate_id * * @param bool $deleteOldSession Whether to delete the old associated session file or not. + * @param bool $updateToken Wheater to update the associated auth token * @return void */ - public function regenerateId($deleteOldSession = true) { - $this->session->regenerateId($deleteOldSession); + public function regenerateId($deleteOldSession = true, $updateToken = false) { + $this->session->regenerateId($deleteOldSession, $updateToken); } /** diff --git a/lib/private/Session/Internal.php b/lib/private/Session/Internal.php index d137d72a048..20230acebe8 100644 --- a/lib/private/Session/Internal.php +++ b/lib/private/Session/Internal.php @@ -29,6 +29,10 @@ namespace OC\Session; +use OC\Authentication\Exceptions\InvalidTokenException; +use OC\Authentication\Token\IProvider; +use OC\SystemConfig; +use OCP\IConfig; use OCP\Session\Exceptions\SessionNotAvailableException; /** @@ -110,14 +114,41 @@ class Internal extends Session { * Wrapper around session_regenerate_id * * @param bool $deleteOldSession Whether to delete the old associated session file or not. + * @param bool $updateToken Wheater to update the associated auth token * @return void */ - public function regenerateId($deleteOldSession = true) { + public function regenerateId($deleteOldSession = true, $updateToken = false) { + $oldId = null; + + if ($updateToken) { + // Get the old id to update the token + try { + $oldId = $this->getId(); + } catch (SessionNotAvailableException $e) { + // We can't update a token if there is no previous id + $updateToken = false; + } + } + try { @session_regenerate_id($deleteOldSession); } catch (\Error $e) { $this->trapError($e->getCode(), $e->getMessage()); } + + if ($updateToken) { + // Get the new id to update the token + $newId = $this->getId(); + + /** @var IProvider $tokenProvider */ + $tokenProvider = \OC::$server->query(IProvider::class); + + try { + $tokenProvider->renewSessionToken($oldId, $newId); + } catch (InvalidTokenException $e) { + // Just ignore + } + } } /** diff --git a/lib/private/Session/Memory.php b/lib/private/Session/Memory.php index 22d6ffa0110..8975d8dfe0b 100644 --- a/lib/private/Session/Memory.php +++ b/lib/private/Session/Memory.php @@ -90,7 +90,7 @@ class Memory extends Session { * * @param bool $deleteOldSession */ - public function regenerateId($deleteOldSession = true) {} + public function regenerateId($deleteOldSession = true, $updateToken = false) {} /** * Wrapper around session_id diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php index 34319760c86..489f3cc0d3d 100644 --- a/lib/private/User/Session.php +++ b/lib/private/User/Session.php @@ -624,6 +624,8 @@ class Session implements IUserSession, Emitter { try { $sessionId = $this->session->getId(); $pwd = $this->getPassword($password); + // Make sure the current sessionId has no leftover tokens + $this->tokenProvider->invalidateToken($sessionId); $this->tokenProvider->generateToken($sessionId, $uid, $loginName, $pwd, $name, IToken::TEMPORARY_TOKEN, $remember); return true; } catch (SessionNotAvailableException $ex) { diff --git a/lib/public/ISession.php b/lib/public/ISession.php index 2d234976862..36d855afbff 100644 --- a/lib/public/ISession.php +++ b/lib/public/ISession.php @@ -93,10 +93,11 @@ interface ISession { * Wrapper around session_regenerate_id * * @param bool $deleteOldSession Whether to delete the old associated session file or not. + * @param bool $updateToken Wheater to update the associated auth token * @return void - * @since 9.0.0 + * @since 9.0.0, $updateToken added in 14.0.0 */ - public function regenerateId($deleteOldSession = true); + public function regenerateId($deleteOldSession = true, $updateToken = false); /** * Wrapper around session_id |