mirror of https://github.com/nextcloud/server.git synced 2025-10-26 19:21:34 +00:00

Nextcloud Server

Go to file

Lukas Reschke 3adbfbfd69 Use / instead of an empty string as cookie path When an empty string is used as cookie path PHP will assign the current directory as cookie path. This means when an user had installed an ownCloud under "/", which is mapped to an empty string in \OC::$WEBROOT, and accessed it the cookie was set to values such as "/index.php/apps/files" since the web browser assumed this to be a directory. This means that multiple encryption cookies were set for the same domain resulting in potential havoc. With this patch the path will be set to "/" in case an empty web root is installed which makes the cookie accessible to the whole domain. To test this setup multiple ownCloud instances on the same domain under different ports and have both installed under "/", then try to login in both of it and previously this can in some cases lead to a lockout of the user. Note that this affects the cookies that the browsers do sent and thus to test this you need to clear all cookies from your browser previously. I consider this an acceptable behaviour for now since this code is only in master. Fixes https://github.com/owncloud/core/issues/18919		2015-09-14 11:22:34 +02:00
.idea
3rdparty@b94f7d38f6
apps	[tx-robot] updated from transifex	2015-09-14 01:55:35 -04:00
build
config	Merge pull request #18658 from owncloud/configurable-temp	2015-09-12 22:04:41 +02:00
core	[tx-robot] updated from transifex	2015-09-14 01:55:35 -04:00
l10n	Adding simple script to remove language files from core	2015-08-26 12:19:58 +02:00
lib	Use / instead of an empty string as cookie path	2015-09-14 11:22:34 +02:00
ocs	Check if files_sharing is actually enabled before using it	2015-09-09 14:56:49 +01:00
ocs-provider
settings	[tx-robot] updated from transifex	2015-09-14 01:55:35 -04:00
tests	Merge pull request #18658 from owncloud/configurable-temp	2015-09-12 22:04:41 +02:00
themes	[example theme] make it easier for non PHP people to understand what to change	2015-09-10 11:03:00 +02:00
.bowerrc
.gitignore
.gitmodules
.htaccess
.jshintrc
.mailmap
.scrutinizer.yml
.tag
.user.ini
AUTHORS
autotest-external.sh	Allow easy XDEBUG debugging with autotest	2015-08-31 14:22:02 +01:00
autotest-hhvm.sh
autotest-js.sh
autotest.cmd
autotest.sh	Allow easy XDEBUG debugging with autotest	2015-08-31 14:22:02 +01:00
bower.json
buildjsdocs.sh
console.php
CONTRIBUTING.md
COPYING-AGPL
COPYING-README
cron.php
db_structure.xml
index.html
index.php
indie.json
issue_template.md
occ
public.php
README.md
remote.php
robots.txt
status.php
version.php	Restrict upgrades to explicit allowed version	2015-08-30 18:04:18 +02:00