There are a lot of clients that support multiple WebDAV accounts in the same application. However, they resent all the cookies they received from one of the accounts also to the other one. In the case of ownCloud this means that we will always show the user from the session and not the user that is specified in the basic authentication header.
This patch adds a workaround the following way:
1. If the user authenticates via the Sabre Auth Connector add a hint to the session that this was authorized via Basic Auth (this is to prevent logout CSRF)
2. If the request contains this hint and the username specified in the basic auth header differs from the one in the session relogin the user using basic auth
Fixes https://github.com/owncloud/core/issues/11400 and https://github.com/owncloud/core/issues/13245 and probably some other issues as well.
This requires proper testing also considering LDAP / Shibboleth and whatever instances.
The cache isn't cleared properly because unlink() doesn't remove the
cache entry which caused side-effects when reusing the same file name
(which randomly happens when time() returns the same value)
This fix first makes sure the unit tests don't fail any more.
The unlink() case with the cache will be investigated separately.
If the file does not exist, realpath() returns false and "include false;"
produces "Failed opening '' for inclusion" which is a useless error message.
'include' works just fine with symlinks, "./" and "../".
Lukas Reschke
Joas Schilling
Bjoern Schiessle
Thomas Müller
Jörn Friedrich Dreyer
Robin Appelman
Morris Jobke
Vincent Petry
Andreas Fischer
Björn Schießle
kondou
Florin Peter