Harden check when using token from memcache

Explicitly comparing never hurt anybody. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
nextcloud · Sep 5, 2020 · 57ab100 · 57ab100
1 parent 44d7dac
commit 57ab100
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/lib/Service/SessionService.php b/lib/Service/SessionService.php
@@ -152,7 +152,14 @@ public function getSession($documentId, $sessionId, $token) {
 
  $data = $this->cache->get($token);
  if ($data !== null) {
- return Session::fromRow(json_decode($data, true));
+ $session = Session::fromRow(json_decode($data, true));
+ if ($session->getId() !== $sessionId || $session->getDocumentId() !== $documentId) {
+ $this->cache->remove($token);
+ $this->session = false;
+ return false;
+ }
+
+ return $session;
  }
 
  try {