Harden check when using token from memcache

Explicitly comparing never hurt anybody. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
nextcloud · Sep 5, 2020 · 68ad904 · 68ad904
1 parent 7521b23
commit 68ad904
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/lib/Service/SessionService.php b/lib/Service/SessionService.php
@@ -152,7 +152,14 @@ public function getSession($documentId, $sessionId, $token) {
 
 		$data = $this->cache->get($token);
 		if ($data !== null) {
-			return Session::fromRow(json_decode($data, true));
+			$session = Session::fromRow(json_decode($data, true));
+			if ($session->getId() !== $sessionId || $session->getDocumentId() !== $documentId) {
+				$this->cache->remove($token);
+				$this->session = false;
+				return false;
+			}
+
+			return $session;
 		}
 
 		try {