From 2ea06f67bd8bf8293afdff91fbbc42d021d2c211 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20G=C3=B6hler?= <somebody.here@gmx.de>
Date: Thu, 11 Oct 2012 11:54:40 +0200
Subject: [PATCH] delete all tokens on password change
---
lib/base.php | 8 +++++---
lib/user.php | 2 ++
2 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/lib/base.php b/lib/base.php
index cac416003e..b02db4d05f 100644
--- a/lib/base.php
+++ b/lib/base.php
@@ -552,9 +552,11 @@ class OC{
OC_Util::redirectToDefaultPage();
// doesn't return
}
- // if you reach this point you are an attacker
- // we remove all tokens to be save
- OC_Preferences::deleteApp($_POST['user'], 'login_token');
+ // if you reach this point you have changed your password
+ // or you are an attacker
+ // we can not delete tokens here because users will reach
+ // this point multible times after a password change
+ //OC_Preferences::deleteApp($_POST['user'], 'login_token');
}
OC_User::unsetMagicInCookie();
return true;
diff --git a/lib/user.php b/lib/user.php
index be8ddce88b..11373a7401 100644
--- a/lib/user.php
+++ b/lib/user.php
@@ -329,6 +329,8 @@ class OC_User {
}
}
}
+ // invalidate all login cookies
+ OC_Preferences::deleteApp($uid, 'login_token');
OC_Hook::emit( "OC_User", "post_setPassword", array( "uid" => $uid, "password" => $password ));
return $success;
}
--
GitLab