Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-27 19:19:21 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Improved "remember me" cookie handling

Browse source
This commit is contained in:
the-djmaze 2024-04-29 21:21:07 +02:00
parent e9f2b71574
commit cc360837b1
1 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

17
snappymail/v/0.0.0/app/libraries/RainLoop/Actions/UserAuth.php
View file

@ -341,11 +341,14 @@ trait UserAuth
\SnappyMail\Log::notice(self::AUTH_SIGN_ME_TOKEN_KEY, 'decrypt');
$aResult = \SnappyMail\Crypt::DecryptUrlSafe($sSignMeToken, 'signme');
if (isset($aResult['e'], $aResult['u']) && \SnappyMail\UUID::isValid($aResult['u'])) {
if (!isset($aResult['c'])) {
$aTokenData['c'] = \array_key_last($aTokenData);
$aTokenData['d'] = \end($aTokenData);
}
return $aResult;
}
\SnappyMail\Log::notice(self::AUTH_SIGN_ME_TOKEN_KEY, 'invalid');
// Don't clear due to login checkbox
// Cookies::clear(self::AUTH_SIGN_ME_TOKEN_KEY);
Cookies::clear(self::AUTH_SIGN_ME_TOKEN_KEY);
}
return null;
}
@ -360,7 +363,8 @@ trait UserAuth
\SnappyMail\Crypt::EncryptUrlSafe([
'e' => $oAccount->Email(),
'u' => $uuid,
$data[0] => \base64_encode($data[1])
'c' => $data[0],
'd' => \base64_encode($data[1])
], 'signme'),
\time() + 3600 * 24 * 30 // 30 days
);
@ -382,8 +386,8 @@ trait UserAuth
throw new \RuntimeException("server token not found for {$aTokenData['e']}/.sign_me/{$aTokenData['u']}");
}
$aAccountHash = \SnappyMail\Crypt::Decrypt([
\array_key_last($aTokenData),
\base64_decode(\end($aTokenData)),
$aTokenData['c'],
\base64_decode($aTokenData['d']),
$sAuthToken
], 'signme');
if (!\is_array($aAccountHash)) {
@ -401,8 +405,7 @@ trait UserAuth
catch (\Throwable $oException)
{
\SnappyMail\Log::warning(self::AUTH_SIGN_ME_TOKEN_KEY, $oException->getMessage());
// Don't clear due to smctoken cookie missing at initialization and login checkbox
// $this->ClearSignMeData();
$this->ClearSignMeData();
}
}
return null;