From 38b73180fd33070f4e28a6baeb4d5dcc24870ad8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Tue, 2 Aug 2016 08:42:44 +0200 Subject: [PATCH] Fix password change in cookie auth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We can not set same cookie twice, so we have to avoid sending auth cookie when we're about to change the password. Signed-off-by: Michal Čihař --- libraries/plugins/auth/AuthenticationCookie.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libraries/plugins/auth/AuthenticationCookie.php b/libraries/plugins/auth/AuthenticationCookie.php index 0cb425ae95..b413ff95fb 100644 --- a/libraries/plugins/auth/AuthenticationCookie.php +++ b/libraries/plugins/auth/AuthenticationCookie.php @@ -492,7 +492,11 @@ class AuthenticationCookie extends AuthenticationPlugin $this->storeUsernameCookie($cfg['Server']['user']); // Duration = as configured - $this->storePasswordCookie($cfg['Server']['password']); + // Do not store password cookie on password change as we will + // set the cookie again after password has been changed + if (! isset($_POST['change_pw'])) { + $this->storePasswordCookie($cfg['Server']['password']); + } // Set server cookies if required (once per session) and, in this case, // force reload to ensure the client accepts cookies