mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
nextcloud/lib/private
History
Lukas Reschke 3adbfbfd69 Use / instead of an empty string as cookie path 
When an empty string is used as cookie path PHP will assign the current directory as cookie path.

This means when an user had installed an ownCloud under "/", which is mapped to an empty string in \OC::$WEBROOT, and accessed it the cookie was set to values such as "/index.php/apps/files" since the web browser assumed this to be a directory. This means that multiple encryption cookies were set for the same domain resulting in potential havoc.

With this patch the path will be set to "/" in case an empty web root is installed which makes the cookie accessible to the whole domain.

To test this setup multiple ownCloud instances on the same domain under different ports and have both installed under "/", then try to login in both of it and previously this can in some cases lead to a lockout of the user.

Note that this affects the cookies that the browsers do sent and thus to test this you need to clear all cookies from your browser previously. I consider this an acceptable behaviour for now since this code is only in master.

Fixes https://github.com/owncloud/core/issues/18919
 		2015-09-14 11:22:34 +02:00
..
activity Remove unnecessary code 2015-08-20 13:10:11 +02:00
app Merge pull request #17434 from owncloud/update-showappnameonappupdate 2015-08-20 11:50:01 +02:00
appframework make resolve public to avoid boiler plate code 2015-09-13 17:44:24 +02:00
archive Update license headers 2015-03-26 11:44:36 +01:00
assetic Update license headers 2015-03-26 11:44:36 +01:00
backgroundjob Unique exception for invalid autoload paths, better handling 2015-09-05 16:50:02 +01:00
cache Remove OC_Log 2015-07-03 18:00:16 +02:00
command Merge pull request #15129 from owncloud/version-command-bus 2015-03-26 19:55:13 +01:00
connector/sabre Explicitly specify status code 200 as response code 2015-08-25 18:07:40 +02:00
console Merge pull request #17093 from owncloud/upgrade-timestamp 2015-07-01 08:55:32 +02:00
contacts Update license headers 2015-03-26 11:44:36 +01:00
db Merge pull request #17662 from owncloud/locking-db 2015-08-26 03:56:37 +02:00
diagnostics Update license headers 2015-03-26 11:44:36 +01:00
encryption make system root of key storage configurable 2015-08-30 19:00:03 +02:00
files Merge pull request #18653 from owncloud/dav-stream-guzzle 2015-09-11 17:10:10 +02:00
group update license headers and authors 2015-06-25 14:13:49 +02:00
hooks update license headers and authors 2015-06-25 14:13:49 +02:00
http/client allow streamed responses in http client 2015-08-29 14:56:08 +02:00
l10n Add a public interface for the language factory so apps can use it 2015-08-27 13:14:50 +02:00
legacy Remove OC_Appconfig 2015-07-03 18:00:16 +02:00
lock Adding path to log message 2015-08-25 14:31:21 +02:00
log Remove OC_Log 2015-07-03 18:00:16 +02:00
mail Add "Reply-To" support for mails 2015-04-10 15:05:34 +02:00
memcache Fallback to complete Memcached flush if getAllKeys fails 2015-09-05 20:02:49 +01:00
notification Move interfaces to private until they are no longer experimental 2015-09-08 09:01:02 +02:00
ocs Cleanup OCS code 2015-08-14 13:42:56 +02:00
preview Remove OC_Log 2015-07-03 18:00:16 +02:00
route Delay adding OCS prefix to route collection until all is loaded 2015-09-01 15:42:41 +01:00
search Scrutinizer Auto-Fixes 2015-05-19 11:23:06 +00:00
security don't read certificates if ownCloud is not installed 2015-08-30 19:00:03 +02:00
session Use / instead of an empty string as cookie path 2015-09-14 11:22:34 +02:00
setup - more injection 2015-07-30 00:04:30 +02:00
share Allow 0 and false as password 2015-09-08 17:53:29 +02:00
tagging Update license headers 2015-03-26 11:44:36 +01:00
template update license headers and authors 2015-06-25 14:13:49 +02:00
user Remove last occurence of `forcessl` 2015-08-26 14:29:36 +02:00
activitymanager.php Sticky the notification types of files and sharing 2015-08-28 18:40:50 +02:00
allconfig.php Make scrutinizer happy 2015-04-01 12:13:49 +02:00
api.php With V2 we should ensure that the status codes are kept in sync 2015-08-13 10:45:25 +02:00
app.php Only add valid root for enabled apps 2015-09-05 00:04:58 +01:00
appconfig.php Make sure the array exists 2015-09-03 15:41:30 +02:00
apphelper.php update license headers and authors 2015-06-25 14:13:49 +02:00
archive.php Update license headers 2015-03-26 11:44:36 +01:00
arrayparser.php Update license headers 2015-03-26 11:44:36 +01:00
avatar.php update license headers and authors 2015-06-25 14:13:49 +02:00
avatarmanager.php update license headers and authors 2015-06-25 14:13:49 +02:00
capabilitiesmanager.php Use DI 2015-08-10 10:45:16 +02:00
config.php Remove DEBUG constant and use config value 2015-08-24 15:14:05 +02:00
contactsmanager.php Update license headers 2015-03-26 11:44:36 +01:00
databaseexception.php Update license headers 2015-03-26 11:44:36 +01:00
databasesetupexception.php Update license headers 2015-03-26 11:44:36 +01:00
datetimeformatter.php Update license headers 2015-03-26 11:44:36 +01:00
datetimezone.php When guessing the timezone, the offset might only be valid on a given timestamp 2015-04-07 10:13:06 +02:00
db.php Remove remainings of mssql 2015-07-29 18:19:31 +02:00
defaults.php Revert "make knowledge base url configurable" 2015-08-11 14:20:25 +02:00
eventsource.php Add custom CSP for Win 10 compatibility 2015-07-21 20:40:32 +02:00
filechunking.php kill OC_FileProxy 💥 2015-04-07 13:30:28 +02:00
files.php Remove XSendFile support 2015-09-07 16:52:50 +02:00
forbiddenexception.php Update license headers 2015-03-26 11:44:36 +01:00
group.php Update license headers 2015-03-26 11:44:36 +01:00
helper.php Proper deprecate methods 2015-07-27 14:59:49 +02:00
hintexception.php Update license headers 2015-03-26 11:44:36 +01:00
hook.php Remove OC_Log 2015-07-03 18:00:16 +02:00
httphelper.php Add connection timeout to default POST options 2015-05-26 11:22:50 +02:00
image.php Make sure we have a resource before measuring its size 2015-06-08 15:10:29 +02:00
installer.php Update installer.php 2015-08-10 10:34:44 +02:00
json.php Encode HTML tags in JSON 2015-09-03 00:44:46 +02:00
l10n.php Deprecate OC_L10N::get() 2015-08-28 12:04:52 +02:00
largefilehelper.php Update license headers 2015-03-26 11:44:36 +01:00
log.php Remove OC_Log 2015-07-03 18:00:16 +02:00
naturalsort.php Remove OC_Log 2015-07-03 18:00:16 +02:00
naturalsort_defaultcollator.php Update license headers 2015-03-26 11:44:36 +01:00
navigationmanager.php Update license headers 2015-03-26 11:44:36 +01:00
needsupdateexception.php Update license headers 2015-03-26 11:44:36 +01:00
notsquareexception.php Update license headers 2015-03-26 11:44:36 +01:00
ocs.php Fix format of log/private/ocs.php 2015-08-19 14:21:10 +02:00
ocsclient.php Degrade log message about missing app in appstore to debug 2015-08-17 11:27:41 +02:00
preview.php Allow creating previewss that cover the specified dimensions 2015-09-02 10:32:39 +02:00
previewmanager.php update license headers and authors 2015-06-25 14:13:49 +02:00
repair.php Use the public interface and our method instead of the doctrine thing 2015-07-21 15:25:47 +02:00
repairexception.php Update license headers 2015-03-26 11:44:36 +01:00
repairstep.php update license headers and authors 2015-06-25 14:13:49 +02:00
response.php update license headers and authors 2015-06-25 14:13:49 +02:00
search.php Update license headers 2015-03-26 11:44:36 +01:00
server.php Merge pull request #18658 from owncloud/configurable-temp 2015-09-12 22:04:41 +02:00
servernotavailableexception.php update license headers and authors 2015-06-25 14:13:49 +02:00
serviceunavailableexception.php Update license headers 2015-03-26 11:44:36 +01:00
setup.php Check for PDO instead of removed function for PHP 7 compatibility 2015-07-30 12:32:22 +02:00
subadmin.php Remove unused variables 2015-04-18 16:35:19 +02:00
systemconfig.php Add missing tunnel on new class 2015-07-07 11:18:24 +02:00
tagmanager.php Update license headers 2015-03-26 11:44:36 +01:00
tags.php Fix undefined variable $tagId 2015-05-04 16:19:26 +02:00
template.php Remove DEBUG constant and use config value 2015-08-24 15:14:05 +02:00
templatelayout.php update license headers and authors 2015-06-25 14:13:49 +02:00
tempmanager.php Clean up TempManager to follow code guidelines 2015-08-30 23:30:56 +01:00
updater.php Improved update version detection logic 2015-08-31 18:35:35 +02:00
urlgenerator.php Fix UrlGenerator::imagePath() for app paths 2015-04-03 23:42:18 +01:00
user.php Escape ampersand in logout URL 2015-07-21 00:26:30 +02:00
util.php Merge pull request #18684 from owncloud/explicit-upgrade-version 2015-09-09 11:08:55 +02:00