From 9b5c9648a459d950f6e2fd3476fc45275f69ff04 Mon Sep 17 00:00:00 2001 From: Robin Appelman Date: Thu, 11 May 2023 17:45:16 +0200 Subject: [PATCH] check the username when doing external storage session auth Signed-off-by: Robin Appelman --- .../lib/Lib/Auth/Password/SessionCredentials.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apps/files_external/lib/Lib/Auth/Password/SessionCredentials.php b/apps/files_external/lib/Lib/Auth/Password/SessionCredentials.php index 47fb044f885..ea90b903ca9 100644 --- a/apps/files_external/lib/Lib/Auth/Password/SessionCredentials.php +++ b/apps/files_external/lib/Lib/Auth/Password/SessionCredentials.php @@ -31,6 +31,7 @@ use OCA\Files_External\Lib\StorageConfig; use OCP\Authentication\Exceptions\CredentialsUnavailableException; use OCP\Authentication\LoginCredentials\IStore as CredentialsStore; use OCP\Files\Storage; +use OCP\Files\StorageAuthException; use OCP\IL10N; use OCP\IUser; @@ -58,6 +59,10 @@ class SessionCredentials extends AuthMechanism { throw new InsufficientDataForMeaningfulAnswerException('No session credentials saved'); } + if ($credentials->getUID() !== $user->getUID()) { + throw new StorageAuthException('Session credentials for storage owner not available'); + } + $storage->setBackendOption('user', $credentials->getLoginName()); $storage->setBackendOption('password', $credentials->getPassword()); }