Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-09-07 08:27:03 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Improved "remember me" cookie handling

Browse source
This commit is contained in:
the-djmaze 2024-04-29 21:21:07 +02:00
parent e9f2b71574
commit cc360837b1
1 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

17
snappymail/v/0.0.0/app/libraries/RainLoop/Actions/UserAuth.php
View file

@ -341,11 +341,14 @@ trait UserAuth
\SnappyMail\Log::notice(self::AUTH_SIGN_ME_TOKEN_KEY, 'decrypt'); \SnappyMail\Log::notice(self::AUTH_SIGN_ME_TOKEN_KEY, 'decrypt');
$aResult = \SnappyMail\Crypt::DecryptUrlSafe($sSignMeToken, 'signme'); $aResult = \SnappyMail\Crypt::DecryptUrlSafe($sSignMeToken, 'signme');
if (isset($aResult['e'], $aResult['u']) && \SnappyMail\UUID::isValid($aResult['u'])) { if (isset($aResult['e'], $aResult['u']) && \SnappyMail\UUID::isValid($aResult['u'])) {
if (!isset($aResult['c'])) {
$aTokenData['c'] = \array_key_last($aTokenData);
$aTokenData['d'] = \end($aTokenData);
}
return $aResult; return $aResult;
} }
\SnappyMail\Log::notice(self::AUTH_SIGN_ME_TOKEN_KEY, 'invalid'); \SnappyMail\Log::notice(self::AUTH_SIGN_ME_TOKEN_KEY, 'invalid');
// Don't clear due to login checkbox Cookies::clear(self::AUTH_SIGN_ME_TOKEN_KEY);
// Cookies::clear(self::AUTH_SIGN_ME_TOKEN_KEY);
} }
return null; return null;
} }
@ -360,7 +363,8 @@ trait UserAuth
\SnappyMail\Crypt::EncryptUrlSafe([ \SnappyMail\Crypt::EncryptUrlSafe([
'e' => $oAccount->Email(), 'e' => $oAccount->Email(),
'u' => $uuid, 'u' => $uuid,
$data[0] => \base64_encode($data[1]) 'c' => $data[0],
'd' => \base64_encode($data[1])
], 'signme'), ], 'signme'),
\time() + 3600 * 24 * 30 // 30 days \time() + 3600 * 24 * 30 // 30 days
); );
@ -382,8 +386,8 @@ trait UserAuth
throw new \RuntimeException("server token not found for {$aTokenData['e']}/.sign_me/{$aTokenData['u']}"); throw new \RuntimeException("server token not found for {$aTokenData['e']}/.sign_me/{$aTokenData['u']}");
} }
$aAccountHash = \SnappyMail\Crypt::Decrypt([ $aAccountHash = \SnappyMail\Crypt::Decrypt([
\array_key_last($aTokenData), $aTokenData['c'],
\base64_decode(\end($aTokenData)), \base64_decode($aTokenData['d']),
$sAuthToken $sAuthToken
], 'signme'); ], 'signme');
if (!\is_array($aAccountHash)) { if (!\is_array($aAccountHash)) {
@ -401,8 +405,7 @@ trait UserAuth
catch (\Throwable $oException) catch (\Throwable $oException)
{ {
\SnappyMail\Log::warning(self::AUTH_SIGN_ME_TOKEN_KEY, $oException->getMessage()); \SnappyMail\Log::warning(self::AUTH_SIGN_ME_TOKEN_KEY, $oException->getMessage());
// Don't clear due to smctoken cookie missing at initialization and login checkbox $this->ClearSignMeData();
// $this->ClearSignMeData();
} }
} }
return null; return null;