From 228fefc1215b01dae9afb83648808cf40fc94279 Mon Sep 17 00:00:00 2001
From: the-djmaze <>
Date: Tue, 27 Dec 2022 10:24:16 +0100
Subject: [PATCH] Resolve #798

---
 dev/boot.js                                                | 7 ++++---
 .../v/0.0.0/app/libraries/RainLoop/Actions/UserAuth.php    | 3 +++
 snappymail/v/0.0.0/app/libraries/RainLoop/Utils.php        | 6 +++---
 snappymail/v/0.0.0/app/libraries/snappymail/crypt.php      | 7 ++++---
 4 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/dev/boot.js b/dev/boot.js
index 0d52d9ba9..f21c8e752 100644
--- a/dev/boot.js
+++ b/dev/boot.js
@@ -32,14 +32,15 @@ navigator.cookieEnabled || redirect('NoCookie');
 [].flat || redirect('BadBrowser');
 
 try {
-	let smctoken = localStorage.getItem('smctoken');
+	let smctoken = doc.cookie.match(/(^|;) ?smctoken=([^;]+)/);
+	smctoken = smctoken ? smctoken[2] : localStorage.getItem('smctoken');
 	if (!smctoken) {
 		let data = new Uint8Array(16);
 		crypto.getRandomValues(data);
 		smctoken = btoa(String.fromCharCode(...data));
-		localStorage.setItem('smctoken', smctoken);
 	}
-	document.cookie = 'smctoken='+encodeURIComponent(smctoken)+"; path=/; samesite=strict";
+	localStorage.setItem('smctoken', smctoken);
+	doc.cookie = 'smctoken='+encodeURIComponent(smctoken)+"; path=/; samesite=strict";
 } catch (e) {
 	console.error(e);
 }
diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/UserAuth.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/UserAuth.php
index 2d49b1d9c..71a9a8525 100644
--- a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/UserAuth.php
+++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions/UserAuth.php
@@ -309,6 +309,9 @@ trait UserAuth
 	{
 		$this->oAdditionalAuthAccount = false;
 		$this->oMainAuthAccount = $oAccount;
+		if (!isset($_COOKIE['smctoken'])) {
+			\RainLoop\Utils::SetCookie('smctoken', \base64_encode(\random_bytes(16)), 0, false);
+		}
 		static::SetAccountCookie(self::AUTH_SPEC_TOKEN_KEY, $oAccount);
 	}
 
diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Utils.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Utils.php
index 4d05d9b83..245614310 100644
--- a/snappymail/v/0.0.0/app/libraries/RainLoop/Utils.php
+++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Utils.php
@@ -131,7 +131,7 @@ class Utils
 			: null;
 	}
 
-	private static function _SetCookie(string $sName, string $sValue, int $iExpire)
+	private static function _SetCookie(string $sName, string $sValue, int $iExpire, bool $httponly = true)
 	{
 		$sPath = static::$CookieDefaultPath;
 		$sPath = $sPath && \strlen($sPath) ? $sPath : '/';
@@ -176,7 +176,7 @@ class Utils
 			'path' => $sPath,
 //			'domain' => null,
 			'secure' => static::$CookieSecure,
-			'httponly' => true,
+			'httponly' => $httponly,
 			'samesite' => static::$CookieSameSite
 		));
 	}
@@ -185,7 +185,7 @@ class Utils
 	 * Firefox: Cookie "$sName" has been rejected because it is already expired.
 	 * \header_remove("set-cookie: {$sName}");
 	 */
-	public static function SetCookie(string $sName, string $sValue, int $iExpire = 0)
+	public static function SetCookie(string $sName, string $sValue, int $iExpire = 0, bool $httponly = true)
 	{
 		$sPath = static::$CookieDefaultPath;
 		$sPath = $sPath && \strlen($sPath) ? $sPath : '/';
diff --git a/snappymail/v/0.0.0/app/libraries/snappymail/crypt.php b/snappymail/v/0.0.0/app/libraries/snappymail/crypt.php
index 4fc1d3f9c..8dd4ce235 100644
--- a/snappymail/v/0.0.0/app/libraries/snappymail/crypt.php
+++ b/snappymail/v/0.0.0/app/libraries/snappymail/crypt.php
@@ -46,9 +46,10 @@ abstract class Crypt
 	private static function Passphrase(?string $key) : string
 	{
 		if (!$key) {
-			$key = isset($_COOKIE['smctoken'])
-				 ? $_COOKIE['smctoken']
-				 : \preg_replace('/[^a-z]+/i', '', \explode(')', $_SERVER['HTTP_USER_AGENT'])[0]);
+			if (empty($_COOKIE['smctoken'])) {
+				throw new \RuntimeException('Missing smctoken');
+			}
+			$key = $_COOKIE['smctoken'];
 		}
 		return \sha1($key . APP_SALT, true);
 	}