Skip to content
Snippets Groups Projects
Commit 8ec45870 authored by Lukas Reschke's avatar Lukas Reschke
Browse files

Validate cookie properly and prevent auth bypass

BIG (!) thanks to Julien CAYSSOL
parent 0de81f9d
No related branches found
No related tags found
No related merge requests found
......@@ -489,7 +489,7 @@ class OC{
}
// confirm credentials in cookie
if(isset($_COOKIE['oc_token']) && OC_User::userExists($_COOKIE['oc_username']) &&
OC_Preferences::getValue($_COOKIE['oc_username'], "login", "token") == $_COOKIE['oc_token']) {
OC_Preferences::getValue($_COOKIE['oc_username'], "login", "token") === $_COOKIE['oc_token']) {
OC_User::setUserId($_COOKIE['oc_username']);
OC_Util::redirectToDefaultPage();
}
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment