Commit Graph

24 Commits

Author SHA1 Message Date
Roeland Jago Douma f52337e8be Generate a new session id if the decrypting the session data fails
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-12-04 11:55:31 +00:00
Roeland Jago Douma 8daaf33e3d
Silence duplicate session warnings
Fixes #20490

Basically restroring the old behavior.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-08-14 05:23:11 +02:00
Christoph Wurst cb057829f7
Update license headers for 19
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-29 11:57:22 +02:00
Christoph Wurst 28f8eb5dba
Add visibility to all constants
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10 16:54:27 +02:00
Christoph Wurst caff1023ea
Format control structures, classes, methods and function
To continue this formatting madness, here's a tiny patch that adds
unified formatting for control structures like if and loops as well as
classes, their methods and anonymous functions. This basically forces
the constructs to start on the same line. This is not exactly what PSR2
wants, but I think we can have a few exceptions with "our" style. The
starting of braces on the same line is pracrically standard for our
code.

This also removes and empty lines from method/function bodies at the
beginning and end.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-10 14:19:56 +02:00
Christoph Wurst 36b3bc8148
Use php keywords in lowercase
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-04-09 14:04:56 +02:00
Christoph Wurst 74936c49ea
Remove unused imports
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2020-03-25 22:08:08 +01:00
Roeland Jago Douma 2016e57eab
Only send samesite cookies
This makes the last remaining two cookies lax. The session cookie
itself. And the session password as well (on php 7.3 that is). Samesite
cookies are the best cookies!

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2020-02-06 15:24:35 +01:00
Christoph Wurst 5bf3d1bb38
Update license headers
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
2019-12-05 15:38:45 +01:00
MartB fe21b10de5 replace setcookie value with '' instead of null.
The php documentation states that an empty string should be used for a cookie when it has no real value.
null leads to the following error: expects parameter 2 to be string, null given

Signed-off-by: Martin Böh <mart.b@outlook.de>
2018-09-06 20:34:16 +02:00
Roeland Jago Douma 8c47a632e0
Allow updating the token on session regeneration
Sometimes when we force a session regeneration we want to update the
current token for this session.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-06-14 08:09:36 +02:00
Roeland Jago Douma 8cb6bb3987
Make ISession strict
* Make all implementations strict
* Add scalar types

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2018-02-26 22:20:21 +01:00
Morris Jobke fe0dbe7fb7
Fix type in CryptoSessionData
Found while adding strict typing for PHP7+.

Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2018-01-12 22:41:03 +01:00
Morris Jobke 0eebff152a
Update license headers
Signed-off-by: Morris Jobke <hey@morrisjobke.de>
2017-11-06 16:56:19 +01:00
Lukas Reschke 4166d61ce6
Fix MigrationSchemaChecker and CryptoWrapper
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
2017-08-01 08:20:16 +02:00
Arthur Schiwon d1a8269de3
Forward port of #5190 to master
Treat PHP Errors on User session regenerate

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

remove unnecessary lines…

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

change PHP errors to ErrorException in the session (PHP >=7)

Otherwise it might be that authentication apps are being disabled on
during operation while in fact the session handler has hiccup.

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>
2017-06-15 11:20:49 +02:00
Victor Dubiniuk 131df248ef
Catch session already closed exception in destructor 2017-04-25 16:28:52 +02:00
Roeland Jago Douma bb94b39745
Do not clear CSRF token on logout (fix for #1303)
This is a hacky way to allow the use case of #1303.

What happens is

1. User tries to login
2. PreLoginHook kicks in and figures out that the user need to change
their LDAP password or whatever => redirects user
3. While loading the redirect some logic of ours kicks in and logouts
the user (thus clearing the session).
4. We render the new page but now the session and the page disagree
about the CSRF token

This is kind of hacky but I don't think it introduces new attack
vectors.

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
2017-03-13 22:16:56 +01:00
Joas Schilling 0215b004da
Update with robin 2016-07-21 18:13:58 +02:00
Joas Schilling ba87db3fcc
Fix others 2016-07-21 18:13:57 +02:00
Lukas Reschke aba539703c
Update license headers 2016-05-26 19:57:24 +02:00
Christoph Wurst e93bf80b29
throw SessionNotAvailableException if session_id returns empty string 2016-04-26 14:51:21 +02:00
Christoph Wurst 0d53e86421
add ISession::getId() wrapper for session_id 2016-04-25 10:36:24 +02:00
Roeland Jago Douma e2c36c2903
Move \OC\Session to PSR-4 2016-04-15 07:46:19 +02:00