Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-09-07 08:27:03 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Resolve #798

Browse source
This commit is contained in:
the-djmaze 2022-12-27 10:24:16 +01:00
parent 3f2d193bf6
commit 228fefc121
4 changed files with 14 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

7
dev/boot.js
View file

@ -32,14 +32,15 @@ navigator.cookieEnabled || redirect('NoCookie');
[].flat || redirect('BadBrowser'); [].flat || redirect('BadBrowser');
try { try {
let smctoken = localStorage.getItem('smctoken'); let smctoken = doc.cookie.match(/(^|;) ?smctoken=([^;]+)/);
smctoken = smctoken ? smctoken[2] : localStorage.getItem('smctoken');
if (!smctoken) { if (!smctoken) {
let data = new Uint8Array(16); let data = new Uint8Array(16);
crypto.getRandomValues(data); crypto.getRandomValues(data);
smctoken = btoa(String.fromCharCode(...data)); smctoken = btoa(String.fromCharCode(...data));
localStorage.setItem('smctoken', smctoken);
} }
document.cookie = 'smctoken='+encodeURIComponent(smctoken)+"; path=/; samesite=strict"; localStorage.setItem('smctoken', smctoken);
doc.cookie = 'smctoken='+encodeURIComponent(smctoken)+"; path=/; samesite=strict";
} catch (e) { } catch (e) {
console.error(e); console.error(e);
} }

3
snappymail/v/0.0.0/app/libraries/RainLoop/Actions/UserAuth.php
View file

@ -309,6 +309,9 @@ trait UserAuth
{ {
$this->oAdditionalAuthAccount = false; $this->oAdditionalAuthAccount = false;
$this->oMainAuthAccount = $oAccount; $this->oMainAuthAccount = $oAccount;
if (!isset($_COOKIE['smctoken'])) {
\RainLoop\Utils::SetCookie('smctoken', \base64_encode(\random_bytes(16)), 0, false);
}
static::SetAccountCookie(self::AUTH_SPEC_TOKEN_KEY, $oAccount); static::SetAccountCookie(self::AUTH_SPEC_TOKEN_KEY, $oAccount);
} }

6
snappymail/v/0.0.0/app/libraries/RainLoop/Utils.php
View file

@ -131,7 +131,7 @@ class Utils
: null; : null;
} }
private static function _SetCookie(string $sName, string $sValue, int $iExpire) private static function _SetCookie(string $sName, string $sValue, int $iExpire, bool $httponly = true)
{ {
$sPath = static::$CookieDefaultPath; $sPath = static::$CookieDefaultPath;
$sPath = $sPath && \strlen($sPath) ? $sPath : '/'; $sPath = $sPath && \strlen($sPath) ? $sPath : '/';
@ -176,7 +176,7 @@ class Utils
'path' => $sPath, 'path' => $sPath,
// 'domain' => null, // 'domain' => null,
'secure' => static::$CookieSecure, 'secure' => static::$CookieSecure,
'httponly' => true, 'httponly' => $httponly,
'samesite' => static::$CookieSameSite 'samesite' => static::$CookieSameSite
)); ));
} }
@ -185,7 +185,7 @@ class Utils
* Firefox: Cookie "$sName" has been rejected because it is already expired. * Firefox: Cookie "$sName" has been rejected because it is already expired.
* \header_remove("set-cookie: {$sName}"); * \header_remove("set-cookie: {$sName}");
*/ */
public static function SetCookie(string $sName, string $sValue, int $iExpire = 0) public static function SetCookie(string $sName, string $sValue, int $iExpire = 0, bool $httponly = true)
{ {
$sPath = static::$CookieDefaultPath; $sPath = static::$CookieDefaultPath;
$sPath = $sPath && \strlen($sPath) ? $sPath : '/'; $sPath = $sPath && \strlen($sPath) ? $sPath : '/';

7
snappymail/v/0.0.0/app/libraries/snappymail/crypt.php
View file

@ -46,9 +46,10 @@ abstract class Crypt
private static function Passphrase(?string $key) : string private static function Passphrase(?string $key) : string
{ {
if (!$key) { if (!$key) {
$key = isset($_COOKIE['smctoken']) if (empty($_COOKIE['smctoken'])) {
? $_COOKIE['smctoken'] throw new \RuntimeException('Missing smctoken');
: \preg_replace('/[^a-z]+/i', '', \explode(')', $_SERVER['HTTP_USER_AGENT'])[0]); }
$key = $_COOKIE['smctoken'];
} }
return \sha1($key . APP_SALT, true); return \sha1($key . APP_SALT, true);
} }