You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Christoph Wurst 87aeae21e3 Fix failing csp/nonce check due to timed out session ... The CSP nonce is based on the CSRF token. This token does not change, unless you log in (or out). In case of the session data being lost, e.g. because php gets rid of old sessions, a new CSRF token is gen- erated. While this is fine in theory, it actually caused some annoying problems where the browser restored a tab and Nextcloud js was blocked due to an outdated nonce. The main problem here is that, while processing the request, we write out security headers relatively early. At that point the CSRF token is known/generated and transformed into a CSP nonce. During this request, however, we also log the user in because the session information was lost. At that point we also refresh the CSRF token, which eventually causes the browser to block any scripts as the nonce in the header does not match the one which is used to include scripts. This patch adds a flag to indicate whether the CSRF token should be refreshed or not. It is assumed that refreshing is only necessary if we want to re-generate the session id too. To my knowledge, this case only happens on fresh logins, not when we recover from a deleted session file. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>		8 years ago
..
Backend.php	Unnecessary fully qualified names	10 years ago
Database.php	Prevent SQL error message in case of error	8 years ago
LoginException.php	Update with robin	10 years ago
Manager.php	Prevent SQL error message in case of error	8 years ago
NoUserException.php	Fix others	10 years ago
Session.php	Fix failing csp/nonce check due to timed out session	8 years ago
User.php	emit changeUser only if there really was a change (quota, displayname)	9 years ago