Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-28 03:29:20 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Resolve #798

Browse source
This commit is contained in:
the-djmaze 2022-12-27 10:24:16 +01:00
parent 3f2d193bf6
commit 228fefc121
4 changed files with 14 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

7
dev/boot.js
View file

@ -32,14 +32,15 @@ navigator.cookieEnabled || redirect('NoCookie');
[].flat || redirect('BadBrowser');
try {
let smctoken = localStorage.getItem('smctoken');
let smctoken = doc.cookie.match(/(^|;) ?smctoken=([^;]+)/);
smctoken = smctoken ? smctoken[2] : localStorage.getItem('smctoken');
if (!smctoken) {
let data = new Uint8Array(16);
crypto.getRandomValues(data);
smctoken = btoa(String.fromCharCode(...data));
localStorage.setItem('smctoken', smctoken);
}
document.cookie = 'smctoken='+encodeURIComponent(smctoken)+"; path=/; samesite=strict";
localStorage.setItem('smctoken', smctoken);
doc.cookie = 'smctoken='+encodeURIComponent(smctoken)+"; path=/; samesite=strict";
} catch (e) {
console.error(e);
}

3
snappymail/v/0.0.0/app/libraries/RainLoop/Actions/UserAuth.php
View file

@ -309,6 +309,9 @@ trait UserAuth
{
$this->oAdditionalAuthAccount = false;
$this->oMainAuthAccount = $oAccount;
if (!isset($_COOKIE['smctoken'])) {
\RainLoop\Utils::SetCookie('smctoken', \base64_encode(\random_bytes(16)), 0, false);
}
static::SetAccountCookie(self::AUTH_SPEC_TOKEN_KEY, $oAccount);
}

6
snappymail/v/0.0.0/app/libraries/RainLoop/Utils.php
View file

@ -131,7 +131,7 @@ class Utils
: null;
}
private static function _SetCookie(string $sName, string $sValue, int $iExpire)
private static function _SetCookie(string $sName, string $sValue, int $iExpire, bool $httponly = true)
{
$sPath = static::$CookieDefaultPath;
$sPath = $sPath && \strlen($sPath) ? $sPath : '/';
@ -176,7 +176,7 @@ class Utils
'path' => $sPath,
// 'domain' => null,
'secure' => static::$CookieSecure,
'httponly' => true,
'httponly' => $httponly,
'samesite' => static::$CookieSameSite
));
}
@ -185,7 +185,7 @@ class Utils
* Firefox: Cookie "$sName" has been rejected because it is already expired.
* \header_remove("set-cookie: {$sName}");
*/
public static function SetCookie(string $sName, string $sValue, int $iExpire = 0)
public static function SetCookie(string $sName, string $sValue, int $iExpire = 0, bool $httponly = true)
{
$sPath = static::$CookieDefaultPath;
$sPath = $sPath && \strlen($sPath) ? $sPath : '/';

7
snappymail/v/0.0.0/app/libraries/snappymail/crypt.php
View file

@ -46,9 +46,10 @@ abstract class Crypt
private static function Passphrase(?string $key) : string
{
if (!$key) {
$key = isset($_COOKIE['smctoken'])
? $_COOKIE['smctoken']
: \preg_replace('/[^a-z]+/i', '', \explode(')', $_SERVER['HTTP_USER_AGENT'])[0]);
if (empty($_COOKIE['smctoken'])) {
throw new \RuntimeException('Missing smctoken');
}
$key = $_COOKIE['smctoken'];
}
return \sha1($key . APP_SALT, true);
}