mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Validate cookie properly and prevent auth bypass 

BIG (!) thanks to Julien CAYSSOL
This commit is contained in:
Lukas Reschke 2012-08-10 15:27:10 +02:00
parent 0de81f9dad
commit 8ec45870a3
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/base.php
View File

@ -489,7 +489,7 @@ class OC{
} }
// confirm credentials in cookie // confirm credentials in cookie
if(isset($_COOKIE['oc_token']) && OC_User::userExists($_COOKIE['oc_username']) && if(isset($_COOKIE['oc_token']) && OC_User::userExists($_COOKIE['oc_username']) &&
OC_Preferences::getValue($_COOKIE['oc_username'], "login", "token") == $_COOKIE['oc_token']) { OC_Preferences::getValue($_COOKIE['oc_username'], "login", "token") === $_COOKIE['oc_token']) {
OC_User::setUserId($_COOKIE['oc_username']); OC_User::setUserId($_COOKIE['oc_username']);
OC_Util::redirectToDefaultPage(); OC_Util::redirectToDefaultPage();
} }