diff options
| author | Julius Härtl <jus@bitgrid.net> | 2020-09-07 08:36:56 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-09-07 08:36:56 +0300 |
| commit | 70d7b3d6d5df0648bd476db789c69b985b10b03e (patch) | |
| tree | e0d1c4ba17728ccd4ec1e049ff89321aa1e7a6b9 /lib | |
| parent | f81b55e960f5dd5b801f6ed90b33d5641eb7b83e (diff) | |
| parent | 57ab100044d54b7198857add981c643deda54822 (diff) | |
Merge pull request #1014 from nextcloud/harden/memcachetokenfetching
Harden check when using token from memcache
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/Service/SessionService.php | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/lib/Service/SessionService.php b/lib/Service/SessionService.php index d02d2ad0b..16d1fcabb 100644 --- a/lib/Service/SessionService.php +++ b/lib/Service/SessionService.php @@ -152,7 +152,14 @@ class SessionService { $data = $this->cache->get($token); if ($data !== null) { - return Session::fromRow(json_decode($data, true)); + $session = Session::fromRow(json_decode($data, true)); + if ($session->getId() !== $sessionId || $session->getDocumentId() !== $documentId) { + $this->cache->remove($token); + $this->session = false; + return false; + } + + return $session; } try { |