upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-02-27 12:00:39 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

Merge pull request #46436 from nextcloud/backport/46398/stable28

Browse source 
[stable28] fix(Session): avoid race conditions on clustered setups
This commit is contained in:
Arthur Schiwon 2024-07-11 13:33:08 +02:00 committed by GitHub
commit 7096ef29f1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 22 additions and 46 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
build/psalm-baseline.xml
View file

@ -3433,6 +3433,9 @@
<code><![CDATA[$request->server]]></code>
<code><![CDATA[$request->server]]></code>
</NoInterfaceProperties>
<RedundantCondition>
<code><![CDATA[$this->manager instanceof PublicEmitter]]></code>
</RedundantCondition>
</file>
<file src="lib/private/User/User.php">
<UndefinedInterfaceMethod>

2
lib/private/Authentication/Token/PublicKeyTokenProvider.php
View file

@ -193,7 +193,7 @@ class PublicKeyTokenProvider implements IProvider {
private function getTokenFromCache(string $tokenHash): ?PublicKeyToken {
$serializedToken = $this->cache->get($tokenHash);
if ($serializedToken === false) {
throw new InvalidTokenException('Token does not exist: ' . $tokenHash);
return null;
}
if ($serializedToken === null) {

2
lib/private/Server.php
View file

@ -539,7 +539,7 @@ class Server extends ServerContainer implements IServerContainer {
$c->get(ISecureRandom::class),
$c->getLockdownManager(),
$c->get(LoggerInterface::class),
$c->get(IEventDispatcher::class)
$c->get(IEventDispatcher::class),
);
/** @deprecated 21.0.0 use BeforeUserCreatedEvent event with the IEventDispatcher instead */
$userSession->listen('\OC\User', 'preCreateUser', function ($uid, $password) {

61
lib/private/User/Session.php
View file

@ -49,6 +49,7 @@ use OC\Hooks\PublicEmitter;
use OC_User;
use OC_Util;
use OCA\DAV\Connector\Sabre\Auth;
use OCP\AppFramework\Db\TTransactional;
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\Authentication\Exceptions\ExpiredTokenException;
use OCP\Authentication\Exceptions\InvalidTokenException;
@ -56,6 +57,7 @@ use OCP\EventDispatcher\GenericEvent;
use OCP\EventDispatcher\IEventDispatcher;
use OCP\Files\NotPermittedException;
use OCP\IConfig;
use OCP\IDBConnection;
use OCP\IRequest;
use OCP\ISession;
use OCP\IUser;
@ -92,53 +94,22 @@ use Psr\Log\LoggerInterface;
* @package OC\User
*/
class Session implements IUserSession, Emitter {
/** @var Manager $manager */
private $manager;
/** @var ISession $session */
private $session;
/** @var ITimeFactory */
private $timeFactory;
/** @var IProvider */
private $tokenProvider;
/** @var IConfig */
private $config;
use TTransactional;
/** @var User $activeUser */
protected $activeUser;
/** @var ISecureRandom */
private $random;
/** @var ILockdownManager */
private $lockdownManager;
private LoggerInterface $logger;
/** @var IEventDispatcher */
private $dispatcher;
public function __construct(Manager $manager,
ISession $session,
ITimeFactory $timeFactory,
?IProvider $tokenProvider,
IConfig $config,
ISecureRandom $random,
ILockdownManager $lockdownManager,
LoggerInterface $logger,
IEventDispatcher $dispatcher
public function __construct(
private Manager $manager,
private ISession $session,
private ITimeFactory $timeFactory,
private ?IProvider $tokenProvider,
private IConfig $config,
private ISecureRandom $random,
private ILockdownManager $lockdownManager,
private LoggerInterface $logger,
private IEventDispatcher $dispatcher,
) {
$this->manager = $manager;
$this->session = $session;
$this->timeFactory = $timeFactory;
$this->tokenProvider = $tokenProvider;
$this->config = $config;
$this->random = $random;
$this->lockdownManager = $lockdownManager;
$this->logger = $logger;
$this->dispatcher = $dispatcher;
}
/**
@ -695,8 +666,10 @@ class Session implements IUserSession, Emitter {
$sessionId = $this->session->getId();
$pwd = $this->getPassword($password);
// Make sure the current sessionId has no leftover tokens
$this->tokenProvider->invalidateToken($sessionId);
$this->tokenProvider->generateToken($sessionId, $uid, $loginName, $pwd, $name, IToken::TEMPORARY_TOKEN, $remember);
$this->atomic(function () use ($sessionId, $uid, $loginName, $pwd, $name, $remember) {
$this->tokenProvider->invalidateToken($sessionId);
$this->tokenProvider->generateToken($sessionId, $uid, $loginName, $pwd, $name, IToken::TEMPORARY_TOKEN, $remember);
}, \OCP\Server::get(IDBConnection::class));
return true;
} catch (SessionNotAvailableException $ex) {
// This can happen with OCC, where a memory session is used