nextcloud / server

lib/private/User/Session.php

Indentation +826 added lines, -826 removed lines

@@ -86,832 +86,832 @@
  */
 class Session implements IUserSession, Emitter {
 
-	/** @var Manager|PublicEmitter $manager */
-	private $manager;
-
-	/** @var ISession $session */
-	private $session;
-
-	/** @var ITimeFactory */
-	private $timeFactory;
-
-	/** @var IProvider */
-	private $tokenProvider;
-
-	/** @var IConfig */
-	private $config;
-
-	/** @var User $activeUser */
-	protected $activeUser;
-
-	/** @var ISecureRandom */
-	private $random;
-
-	/** @var ILockdownManager  */
-	private $lockdownManager;
-
-	/** @var ILogger */
-	private $logger;
-
-	/**
-	 * @param Manager $manager
-	 * @param ISession $session
-	 * @param ITimeFactory $timeFactory
-	 * @param IProvider $tokenProvider
-	 * @param IConfig $config
-	 * @param ISecureRandom $random
-	 * @param ILockdownManager $lockdownManager
-	 * @param ILogger $logger
-	 */
-	public function __construct(Manager $manager,
-								ISession $session,
-								ITimeFactory $timeFactory,
-								$tokenProvider,
-								IConfig $config,
-								ISecureRandom $random,
-								ILockdownManager $lockdownManager,
-								ILogger $logger) {
-		$this->manager = $manager;
-		$this->session = $session;
-		$this->timeFactory = $timeFactory;
-		$this->tokenProvider = $tokenProvider;
-		$this->config = $config;
-		$this->random = $random;
-		$this->lockdownManager = $lockdownManager;
-		$this->logger = $logger;
-	}
-
-	/**
-	 * @param IProvider $provider
-	 */
-	public function setTokenProvider(IProvider $provider) {
-		$this->tokenProvider = $provider;
-	}
-
-	/**
-	 * @param string $scope
-	 * @param string $method
-	 * @param callable $callback
-	 */
-	public function listen($scope, $method, callable $callback) {
-		$this->manager->listen($scope, $method, $callback);
-	}
-
-	/**
-	 * @param string $scope optional
-	 * @param string $method optional
-	 * @param callable $callback optional
-	 */
-	public function removeListener($scope = null, $method = null, callable $callback = null) {
-		$this->manager->removeListener($scope, $method, $callback);
-	}
-
-	/**
-	 * get the manager object
-	 *
-	 * @return Manager|PublicEmitter
-	 */
-	public function getManager() {
-		return $this->manager;
-	}
-
-	/**
-	 * get the session object
-	 *
-	 * @return ISession
-	 */
-	public function getSession() {
-		return $this->session;
-	}
-
-	/**
-	 * set the session object
-	 *
-	 * @param ISession $session
-	 */
-	public function setSession(ISession $session) {
-		if ($this->session instanceof ISession) {
-			$this->session->close();
-		}
-		$this->session = $session;
-		$this->activeUser = null;
-	}
-
-	/**
-	 * set the currently active user
-	 *
-	 * @param IUser|null $user
-	 */
-	public function setUser($user) {
-		if (is_null($user)) {
-			$this->session->remove('user_id');
-		} else {
-			$this->session->set('user_id', $user->getUID());
-		}
-		$this->activeUser = $user;
-	}
-
-	/**
-	 * get the current active user
-	 *
-	 * @return IUser|null Current user, otherwise null
-	 */
-	public function getUser() {
-		// FIXME: This is a quick'n dirty work-around for the incognito mode as
-		// described at https://github.com/owncloud/core/pull/12912#issuecomment-67391155
-		if (OC_User::isIncognitoMode()) {
-			return null;
-		}
-		if (is_null($this->activeUser)) {
-			$uid = $this->session->get('user_id');
-			if (is_null($uid)) {
-				return null;
-			}
-			$this->activeUser = $this->manager->get($uid);
-			if (is_null($this->activeUser)) {
-				return null;
-			}
-			$this->validateSession();
-		}
-		return $this->activeUser;
-	}
-
-	/**
-	 * Validate whether the current session is valid
-	 *
-	 * - For token-authenticated clients, the token validity is checked
-	 * - For browsers, the session token validity is checked
-	 */
-	protected function validateSession() {
-		$token = null;
-		$appPassword = $this->session->get('app_password');
-
-		if (is_null($appPassword)) {
-			try {
-				$token = $this->session->getId();
-			} catch (SessionNotAvailableException $ex) {
-				return;
-			}
-		} else {
-			$token = $appPassword;
-		}
-
-		if (!$this->validateToken($token)) {
-			// Session was invalidated
-			$this->logout();
-		}
-	}
-
-	/**
-	 * Checks whether the user is logged in
-	 *
-	 * @return bool if logged in
-	 */
-	public function isLoggedIn() {
-		$user = $this->getUser();
-		if (is_null($user)) {
-			return false;
-		}
-
-		return $user->isEnabled();
-	}
-
-	/**
-	 * set the login name
-	 *
-	 * @param string|null $loginName for the logged in user
-	 */
-	public function setLoginName($loginName) {
-		if (is_null($loginName)) {
-			$this->session->remove('loginname');
-		} else {
-			$this->session->set('loginname', $loginName);
-		}
-	}
-
-	/**
-	 * get the login name of the current user
-	 *
-	 * @return string
-	 */
-	public function getLoginName() {
-		if ($this->activeUser) {
-			return $this->session->get('loginname');
-		}
-
-		$uid = $this->session->get('user_id');
-		if ($uid) {
-			$this->activeUser = $this->manager->get($uid);
-			return $this->session->get('loginname');
-		}
-
-		return null;
-	}
-
-	/**
-	 * set the token id
-	 *
-	 * @param int|null $token that was used to log in
-	 */
-	protected function setToken($token) {
-		if ($token === null) {
-			$this->session->remove('token-id');
-		} else {
-			$this->session->set('token-id', $token);
-		}
-	}
-
-	/**
-	 * try to log in with the provided credentials
-	 *
-	 * @param string $uid
-	 * @param string $password
-	 * @return boolean|null
-	 * @throws LoginException
-	 */
-	public function login($uid, $password) {
-		$this->session->regenerateId();
-		if ($this->validateToken($password, $uid)) {
-			return $this->loginWithToken($password);
-		}
-		return $this->loginWithPassword($uid, $password);
-	}
-
-	/**
-	 * @param IUser $user
-	 * @param array $loginDetails
-	 * @param bool $regenerateSessionId
-	 * @return true returns true if login successful or an exception otherwise
-	 * @throws LoginException
-	 */
-	public function completeLogin(IUser $user, array $loginDetails, $regenerateSessionId = true) {
-		if (!$user->isEnabled()) {
-			// disabled users can not log in
-			// injecting l10n does not work - there is a circular dependency between session and \OCP\L10N\IFactory
-			$message = \OC::$server->getL10N('lib')->t('User disabled');
-			throw new LoginException($message);
-		}
-
-		if($regenerateSessionId) {
-			$this->session->regenerateId();
-		}
-
-		$this->setUser($user);
-		$this->setLoginName($loginDetails['loginName']);
-
-		if(isset($loginDetails['token']) && $loginDetails['token'] instanceof IToken) {
-			$this->setToken($loginDetails['token']->getId());
-			$this->lockdownManager->setToken($loginDetails['token']);
-			$firstTimeLogin = false;
-		} else {
-			$this->setToken(null);
-			$firstTimeLogin = $user->updateLastLoginTimestamp();
-		}
-		$this->manager->emit('\OC\User', 'postLogin', [$user, $loginDetails['password']]);
-		if($this->isLoggedIn()) {
-			$this->prepareUserLogin($firstTimeLogin, $regenerateSessionId);
-			return true;
-		}
-
-		$message = \OC::$server->getL10N('lib')->t('Login canceled by app');
-		throw new LoginException($message);
-	}
-
-	/**
-	 * Tries to log in a client
-	 *
-	 * Checks token auth enforced
-	 * Checks 2FA enabled
-	 *
-	 * @param string $user
-	 * @param string $password
-	 * @param IRequest $request
-	 * @param OC\Security\Bruteforce\Throttler $throttler
-	 * @throws LoginException
-	 * @throws PasswordLoginForbiddenException
-	 * @return boolean
-	 */
-	public function logClientIn($user,
-								$password,
-								IRequest $request,
-								OC\Security\Bruteforce\Throttler $throttler) {
-		$currentDelay = $throttler->sleepDelay($request->getRemoteAddress(), 'login');
-
-		if ($this->manager instanceof PublicEmitter) {
-			$this->manager->emit('\OC\User', 'preLogin', array($user, $password));
-		}
-
-		$isTokenPassword = $this->isTokenPassword($password);
-		if (!$isTokenPassword && $this->isTokenAuthEnforced()) {
-			throw new PasswordLoginForbiddenException();
-		}
-		if (!$isTokenPassword && $this->isTwoFactorEnforced($user)) {
-			throw new PasswordLoginForbiddenException();
-		}
-
-		// Try to login with this username and password
-		if (!$this->login($user, $password) ) {
-
-			// Failed, maybe the user used their email address
-			$users = $this->manager->getByEmail($user);
-			if (!(\count($users) === 1 && $this->login($users[0]->getUID(), $password))) {
-
-				$this->logger->warning('Login failed: \'' . $user . '\' (Remote IP: \'' . \OC::$server->getRequest()->getRemoteAddress() . '\')', ['app' => 'core']);
-
-				$throttler->registerAttempt('login', $request->getRemoteAddress(), ['uid' => $user]);
-				if ($currentDelay === 0) {
-					$throttler->sleepDelay($request->getRemoteAddress(), 'login');
-				}
-				return false;
-			}
-		}
-
-		if ($isTokenPassword) {
-			$this->session->set('app_password', $password);
-		} else if($this->supportsCookies($request)) {
-			// Password login, but cookies supported -> create (browser) session token
-			$this->createSessionToken($request, $this->getUser()->getUID(), $user, $password);
-		}
-
-		return true;
-	}
-
-	protected function supportsCookies(IRequest $request) {
-		if (!is_null($request->getCookie('cookie_test'))) {
-			return true;
-		}
-		setcookie('cookie_test', 'test', $this->timeFactory->getTime() + 3600);
-		return false;
-	}
-
-	private function isTokenAuthEnforced() {
-		return $this->config->getSystemValue('token_auth_enforced', false);
-	}
-
-	protected function isTwoFactorEnforced($username) {
-		Util::emitHook(
-			'\OCA\Files_Sharing\API\Server2Server',
-			'preLoginNameUsedAsUserName',
-			array('uid' => &$username)
-		);
-		$user = $this->manager->get($username);
-		if (is_null($user)) {
-			$users = $this->manager->getByEmail($username);
-			if (empty($users)) {
-				return false;
-			}
-			if (count($users) !== 1) {
-				return true;
-			}
-			$user = $users[0];
-		}
-		// DI not possible due to cyclic dependencies :'-/
-		return OC::$server->getTwoFactorAuthManager()->isTwoFactorAuthenticated($user);
-	}
-
-	/**
-	 * Check if the given 'password' is actually a device token
-	 *
-	 * @param string $password
-	 * @return boolean
-	 */
-	public function isTokenPassword($password) {
-		try {
-			$this->tokenProvider->getToken($password);
-			return true;
-		} catch (InvalidTokenException $ex) {
-			return false;
-		}
-	}
-
-	protected function prepareUserLogin($firstTimeLogin, $refreshCsrfToken = true) {
-		if ($refreshCsrfToken) {
-			// TODO: mock/inject/use non-static
-			// Refresh the token
-			\OC::$server->getCsrfTokenManager()->refreshToken();
-		}
-
-		//we need to pass the user name, which may differ from login name
-		$user = $this->getUser()->getUID();
-		OC_Util::setupFS($user);
-
-		if ($firstTimeLogin) {
-			// TODO: lock necessary?
-			//trigger creation of user home and /files folder
-			$userFolder = \OC::$server->getUserFolder($user);
-
-			try {
-				// copy skeleton
-				\OC_Util::copySkeleton($user, $userFolder);
-			} catch (NotPermittedException $ex) {
-				// read only uses
-			}
-
-			// trigger any other initialization
-			\OC::$server->getEventDispatcher()->dispatch(IUser::class . '::firstLogin', new GenericEvent($this->getUser()));
-		}
-	}
-
-	/**
-	 * Tries to login the user with HTTP Basic Authentication
-	 *
-	 * @todo do not allow basic auth if the user is 2FA enforced
-	 * @param IRequest $request
-	 * @param OC\Security\Bruteforce\Throttler $throttler
-	 * @return boolean if the login was successful
-	 */
-	public function tryBasicAuthLogin(IRequest $request,
-									  OC\Security\Bruteforce\Throttler $throttler) {
-		if (!empty($request->server['PHP_AUTH_USER']) && !empty($request->server['PHP_AUTH_PW'])) {
-			try {
-				if ($this->logClientIn($request->server['PHP_AUTH_USER'], $request->server['PHP_AUTH_PW'], $request, $throttler)) {
-					/**
-					 * Add DAV authenticated. This should in an ideal world not be
-					 * necessary but the iOS App reads cookies from anywhere instead
-					 * only the DAV endpoint.
-					 * This makes sure that the cookies will be valid for the whole scope
-					 * @see https://github.com/owncloud/core/issues/22893
-					 */
-					$this->session->set(
-						Auth::DAV_AUTHENTICATED, $this->getUser()->getUID()
-					);
-
-					// Set the last-password-confirm session to make the sudo mode work
-					 $this->session->set('last-password-confirm', $this->timeFactory->getTime());
-
-					return true;
-				}
-			} catch (PasswordLoginForbiddenException $ex) {
-				// Nothing to do
-			}
-		}
-		return false;
-	}
-
-	/**
-	 * Log an user in via login name and password
-	 *
-	 * @param string $uid
-	 * @param string $password
-	 * @return boolean
-	 * @throws LoginException if an app canceld the login process or the user is not enabled
-	 */
-	private function loginWithPassword($uid, $password) {
-		$user = $this->manager->checkPasswordNoLogging($uid, $password);
-		if ($user === false) {
-			// Password check failed
-			return false;
-		}
-
-		return $this->completeLogin($user, ['loginName' => $uid, 'password' => $password], false);
-	}
-
-	/**
-	 * Log an user in with a given token (id)
-	 *
-	 * @param string $token
-	 * @return boolean
-	 * @throws LoginException if an app canceled the login process or the user is not enabled
-	 */
-	private function loginWithToken($token) {
-		try {
-			$dbToken = $this->tokenProvider->getToken($token);
-		} catch (InvalidTokenException $ex) {
-			return false;
-		}
-		$uid = $dbToken->getUID();
-
-		// When logging in with token, the password must be decrypted first before passing to login hook
-		$password = '';
-		try {
-			$password = $this->tokenProvider->getPassword($dbToken, $token);
-		} catch (PasswordlessTokenException $ex) {
-			// Ignore and use empty string instead
-		}
-
-		$this->manager->emit('\OC\User', 'preLogin', array($uid, $password));
-
-		$user = $this->manager->get($uid);
-		if (is_null($user)) {
-			// user does not exist
-			return false;
-		}
-
-		return $this->completeLogin(
-			$user,
-			[
-				'loginName' => $dbToken->getLoginName(),
-				'password' => $password,
-				'token' => $dbToken
-			],
-			false);
-	}
-
-	/**
-	 * Create a new session token for the given user credentials
-	 *
-	 * @param IRequest $request
-	 * @param string $uid user UID
-	 * @param string $loginName login name
-	 * @param string $password
-	 * @param int $remember
-	 * @return boolean
-	 */
-	public function createSessionToken(IRequest $request, $uid, $loginName, $password = null, $remember = IToken::DO_NOT_REMEMBER) {
-		if (is_null($this->manager->get($uid))) {
-			// User does not exist
-			return false;
-		}
-		$name = isset($request->server['HTTP_USER_AGENT']) ? $request->server['HTTP_USER_AGENT'] : 'unknown browser';
-		try {
-			$sessionId = $this->session->getId();
-			$pwd = $this->getPassword($password);
-			// Make sure the current sessionId has no leftover tokens
-			$this->tokenProvider->invalidateToken($sessionId);
-			$this->tokenProvider->generateToken($sessionId, $uid, $loginName, $pwd, $name, IToken::TEMPORARY_TOKEN, $remember);
-			return true;
-		} catch (SessionNotAvailableException $ex) {
-			// This can happen with OCC, where a memory session is used
-			// if a memory session is used, we shouldn't create a session token anyway
-			return false;
-		}
-	}
-
-	/**
-	 * Checks if the given password is a token.
-	 * If yes, the password is extracted from the token.
-	 * If no, the same password is returned.
-	 *
-	 * @param string $password either the login password or a device token
-	 * @return string|null the password or null if none was set in the token
-	 */
-	private function getPassword($password) {
-		if (is_null($password)) {
-			// This is surely no token ;-)
-			return null;
-		}
-		try {
-			$token = $this->tokenProvider->getToken($password);
-			try {
-				return $this->tokenProvider->getPassword($token, $password);
-			} catch (PasswordlessTokenException $ex) {
-				return null;
-			}
-		} catch (InvalidTokenException $ex) {
-			return $password;
-		}
-	}
-
-	/**
-	 * @param IToken $dbToken
-	 * @param string $token
-	 * @return boolean
-	 */
-	private function checkTokenCredentials(IToken $dbToken, $token) {
-		// Check whether login credentials are still valid and the user was not disabled
-		// This check is performed each 5 minutes
-		$lastCheck = $dbToken->getLastCheck() ? : 0;
-		$now = $this->timeFactory->getTime();
-		if ($lastCheck > ($now - 60 * 5)) {
-			// Checked performed recently, nothing to do now
-			return true;
-		}
-
-		try {
-			$pwd = $this->tokenProvider->getPassword($dbToken, $token);
-		} catch (InvalidTokenException $ex) {
-			// An invalid token password was used -> log user out
-			return false;
-		} catch (PasswordlessTokenException $ex) {
-			// Token has no password
-
-			if (!is_null($this->activeUser) && !$this->activeUser->isEnabled()) {
-				$this->tokenProvider->invalidateToken($token);
-				return false;
-			}
-
-			$dbToken->setLastCheck($now);
-			return true;
-		}
-
-		if ($this->manager->checkPassword($dbToken->getLoginName(), $pwd) === false
-			|| (!is_null($this->activeUser) && !$this->activeUser->isEnabled())) {
-			$this->tokenProvider->invalidateToken($token);
-			// Password has changed or user was disabled -> log user out
-			return false;
-		}
-		$dbToken->setLastCheck($now);
-		return true;
-	}
-
-	/**
-	 * Check if the given token exists and performs password/user-enabled checks
-	 *
-	 * Invalidates the token if checks fail
-	 *
-	 * @param string $token
-	 * @param string $user login name
-	 * @return boolean
-	 */
-	private function validateToken($token, $user = null) {
-		try {
-			$dbToken = $this->tokenProvider->getToken($token);
-		} catch (InvalidTokenException $ex) {
-			return false;
-		}
-
-		// Check if login names match
-		if (!is_null($user) && $dbToken->getLoginName() !== $user) {
-			// TODO: this makes it imposssible to use different login names on browser and client
-			// e.g. login by e-mail 'user@example.com' on browser for generating the token will not
-			//      allow to use the client token with the login name 'user'.
-			return false;
-		}
-
-		if (!$this->checkTokenCredentials($dbToken, $token)) {
-			return false;
-		}
-
-		$this->tokenProvider->updateTokenActivity($dbToken);
-
-		return true;
-	}
-
-	/**
-	 * Tries to login the user with auth token header
-	 *
-	 * @param IRequest $request
-	 * @todo check remember me cookie
-	 * @return boolean
-	 */
-	public function tryTokenLogin(IRequest $request) {
-		$authHeader = $request->getHeader('Authorization');
-		if (strpos($authHeader, 'Bearer ') === false) {
-			// No auth header, let's try session id
-			try {
-				$token = $this->session->getId();
-			} catch (SessionNotAvailableException $ex) {
-				return false;
-			}
-		} else {
-			$token = substr($authHeader, 7);
-		}
-
-		if (!$this->loginWithToken($token)) {
-			return false;
-		}
-		if(!$this->validateToken($token)) {
-			return false;
-		}
-		return true;
-	}
-
-	/**
-	 * perform login using the magic cookie (remember login)
-	 *
-	 * @param string $uid the username
-	 * @param string $currentToken
-	 * @param string $oldSessionId
-	 * @return bool
-	 */
-	public function loginWithCookie($uid, $currentToken, $oldSessionId) {
-		$this->session->regenerateId();
-		$this->manager->emit('\OC\User', 'preRememberedLogin', array($uid));
-		$user = $this->manager->get($uid);
-		if (is_null($user)) {
-			// user does not exist
-			return false;
-		}
-
-		// get stored tokens
-		$tokens = $this->config->getUserKeys($uid, 'login_token');
-		// test cookies token against stored tokens
-		if (!in_array($currentToken, $tokens, true)) {
-			return false;
-		}
-		// replace successfully used token with a new one
-		$this->config->deleteUserValue($uid, 'login_token', $currentToken);
-		$newToken = $this->random->generate(32);
-		$this->config->setUserValue($uid, 'login_token', $newToken, $this->timeFactory->getTime());
-
-		try {
-			$sessionId = $this->session->getId();
-			$this->tokenProvider->renewSessionToken($oldSessionId, $sessionId);
-		} catch (SessionNotAvailableException $ex) {
-			return false;
-		} catch (InvalidTokenException $ex) {
-			\OC::$server->getLogger()->warning('Renewing session token failed', ['app' => 'core']);
-			return false;
-		}
-
-		$this->setMagicInCookie($user->getUID(), $newToken);
-		$token = $this->tokenProvider->getToken($sessionId);
-
-		//login
-		$this->setUser($user);
-		$this->setLoginName($token->getLoginName());
-		$this->setToken($token->getId());
-		$this->lockdownManager->setToken($token);
-		$user->updateLastLoginTimestamp();
-		$password = null;
-		try {
-			$password = $this->tokenProvider->getPassword($token, $sessionId);
-		} catch (PasswordlessTokenException $ex) {
-			// Ignore
-		}
-		$this->manager->emit('\OC\User', 'postRememberedLogin', [$user, $password]);
-		return true;
-	}
-
-	/**
-	 * @param IUser $user
-	 */
-	public function createRememberMeToken(IUser $user) {
-		$token = $this->random->generate(32);
-		$this->config->setUserValue($user->getUID(), 'login_token', $token, $this->timeFactory->getTime());
-		$this->setMagicInCookie($user->getUID(), $token);
-	}
-
-	/**
-	 * logout the user from the session
-	 */
-	public function logout() {
-		$this->manager->emit('\OC\User', 'logout');
-		$user = $this->getUser();
-		if (!is_null($user)) {
-			try {
-				$this->tokenProvider->invalidateToken($this->session->getId());
-			} catch (SessionNotAvailableException $ex) {
-
-			}
-		}
-		$this->setUser(null);
-		$this->setLoginName(null);
-		$this->setToken(null);
-		$this->unsetMagicInCookie();
-		$this->session->clear();
-		$this->manager->emit('\OC\User', 'postLogout');
-	}
-
-	/**
-	 * Set cookie value to use in next page load
-	 *
-	 * @param string $username username to be set
-	 * @param string $token
-	 */
-	public function setMagicInCookie($username, $token) {
-		$secureCookie = OC::$server->getRequest()->getServerProtocol() === 'https';
-		$webRoot = \OC::$WEBROOT;
-		if ($webRoot === '') {
-			$webRoot = '/';
-		}
-
-		$expires = $this->timeFactory->getTime() + $this->config->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
-		setcookie('nc_username', $username, $expires, $webRoot, '', $secureCookie, true);
-		setcookie('nc_token', $token, $expires, $webRoot, '', $secureCookie, true);
-		try {
-			setcookie('nc_session_id', $this->session->getId(), $expires, $webRoot, '', $secureCookie, true);
-		} catch (SessionNotAvailableException $ex) {
-			// ignore
-		}
-	}
-
-	/**
-	 * Remove cookie for "remember username"
-	 */
-	public function unsetMagicInCookie() {
-		//TODO: DI for cookies and IRequest
-		$secureCookie = OC::$server->getRequest()->getServerProtocol() === 'https';
-
-		unset($_COOKIE['nc_username']); //TODO: DI
-		unset($_COOKIE['nc_token']);
-		unset($_COOKIE['nc_session_id']);
-		setcookie('nc_username', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, '', $secureCookie, true);
-		setcookie('nc_token', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, '', $secureCookie, true);
-		setcookie('nc_session_id', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, '', $secureCookie, true);
-		// old cookies might be stored under /webroot/ instead of /webroot
-		// and Firefox doesn't like it!
-		setcookie('nc_username', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
-		setcookie('nc_token', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
-		setcookie('nc_session_id', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
-	}
-
-	/**
-	 * Update password of the browser session token if there is one
-	 *
-	 * @param string $password
-	 */
-	public function updateSessionTokenPassword($password) {
-		try {
-			$sessionId = $this->session->getId();
-			$token = $this->tokenProvider->getToken($sessionId);
-			$this->tokenProvider->setPassword($token, $sessionId, $password);
-		} catch (SessionNotAvailableException $ex) {
-			// Nothing to do
-		} catch (InvalidTokenException $ex) {
-			// Nothing to do
-		}
-	}
+    /** @var Manager|PublicEmitter $manager */
+    private $manager;
+
+    /** @var ISession $session */
+    private $session;
+
+    /** @var ITimeFactory */
+    private $timeFactory;
+
+    /** @var IProvider */
+    private $tokenProvider;
+
+    /** @var IConfig */
+    private $config;
+
+    /** @var User $activeUser */
+    protected $activeUser;
+
+    /** @var ISecureRandom */
+    private $random;
+
+    /** @var ILockdownManager  */
+    private $lockdownManager;
+
+    /** @var ILogger */
+    private $logger;
+
+    /**
+     * @param Manager $manager
+     * @param ISession $session
+     * @param ITimeFactory $timeFactory
+     * @param IProvider $tokenProvider
+     * @param IConfig $config
+     * @param ISecureRandom $random
+     * @param ILockdownManager $lockdownManager
+     * @param ILogger $logger
+     */
+    public function __construct(Manager $manager,
+                                ISession $session,
+                                ITimeFactory $timeFactory,
+                                $tokenProvider,
+                                IConfig $config,
+                                ISecureRandom $random,
+                                ILockdownManager $lockdownManager,
+                                ILogger $logger) {
+        $this->manager = $manager;
+        $this->session = $session;
+        $this->timeFactory = $timeFactory;
+        $this->tokenProvider = $tokenProvider;
+        $this->config = $config;
+        $this->random = $random;
+        $this->lockdownManager = $lockdownManager;
+        $this->logger = $logger;
+    }
+
+    /**
+     * @param IProvider $provider
+     */
+    public function setTokenProvider(IProvider $provider) {
+        $this->tokenProvider = $provider;
+    }
+
+    /**
+     * @param string $scope
+     * @param string $method
+     * @param callable $callback
+     */
+    public function listen($scope, $method, callable $callback) {
+        $this->manager->listen($scope, $method, $callback);
+    }
+
+    /**
+     * @param string $scope optional
+     * @param string $method optional
+     * @param callable $callback optional
+     */
+    public function removeListener($scope = null, $method = null, callable $callback = null) {
+        $this->manager->removeListener($scope, $method, $callback);
+    }
+
+    /**
+     * get the manager object
+     *
+     * @return Manager|PublicEmitter
+     */
+    public function getManager() {
+        return $this->manager;
+    }
+
+    /**
+     * get the session object
+     *
+     * @return ISession
+     */
+    public function getSession() {
+        return $this->session;
+    }
+
+    /**
+     * set the session object
+     *
+     * @param ISession $session
+     */
+    public function setSession(ISession $session) {
+        if ($this->session instanceof ISession) {
+            $this->session->close();
+        }
+        $this->session = $session;
+        $this->activeUser = null;
+    }
+
+    /**
+     * set the currently active user
+     *
+     * @param IUser|null $user
+     */
+    public function setUser($user) {
+        if (is_null($user)) {
+            $this->session->remove('user_id');
+        } else {
+            $this->session->set('user_id', $user->getUID());
+        }
+        $this->activeUser = $user;
+    }
+
+    /**
+     * get the current active user
+     *
+     * @return IUser|null Current user, otherwise null
+     */
+    public function getUser() {
+        // FIXME: This is a quick'n dirty work-around for the incognito mode as
+        // described at https://github.com/owncloud/core/pull/12912#issuecomment-67391155
+        if (OC_User::isIncognitoMode()) {
+            return null;
+        }
+        if (is_null($this->activeUser)) {
+            $uid = $this->session->get('user_id');
+            if (is_null($uid)) {
+                return null;
+            }
+            $this->activeUser = $this->manager->get($uid);
+            if (is_null($this->activeUser)) {
+                return null;
+            }
+            $this->validateSession();
+        }
+        return $this->activeUser;
+    }
+
+    /**
+     * Validate whether the current session is valid
+     *
+     * - For token-authenticated clients, the token validity is checked
+     * - For browsers, the session token validity is checked
+     */
+    protected function validateSession() {
+        $token = null;
+        $appPassword = $this->session->get('app_password');
+
+        if (is_null($appPassword)) {
+            try {
+                $token = $this->session->getId();
+            } catch (SessionNotAvailableException $ex) {
+                return;
+            }
+        } else {
+            $token = $appPassword;
+        }
+
+        if (!$this->validateToken($token)) {
+            // Session was invalidated
+            $this->logout();
+        }
+    }
+
+    /**
+     * Checks whether the user is logged in
+     *
+     * @return bool if logged in
+     */
+    public function isLoggedIn() {
+        $user = $this->getUser();
+        if (is_null($user)) {
+            return false;
+        }
+
+        return $user->isEnabled();
+    }
+
+    /**
+     * set the login name
+     *
+     * @param string|null $loginName for the logged in user
+     */
+    public function setLoginName($loginName) {
+        if (is_null($loginName)) {
+            $this->session->remove('loginname');
+        } else {
+            $this->session->set('loginname', $loginName);
+        }
+    }
+
+    /**
+     * get the login name of the current user
+     *
+     * @return string
+     */
+    public function getLoginName() {
+        if ($this->activeUser) {
+            return $this->session->get('loginname');
+        }
+
+        $uid = $this->session->get('user_id');
+        if ($uid) {
+            $this->activeUser = $this->manager->get($uid);
+            return $this->session->get('loginname');
+        }
+
+        return null;
+    }
+
+    /**
+     * set the token id
+     *
+     * @param int|null $token that was used to log in
+     */
+    protected function setToken($token) {
+        if ($token === null) {
+            $this->session->remove('token-id');
+        } else {
+            $this->session->set('token-id', $token);
+        }
+    }
+
+    /**
+     * try to log in with the provided credentials
+     *
+     * @param string $uid
+     * @param string $password
+     * @return boolean|null
+     * @throws LoginException
+     */
+    public function login($uid, $password) {
+        $this->session->regenerateId();
+        if ($this->validateToken($password, $uid)) {
+            return $this->loginWithToken($password);
+        }
+        return $this->loginWithPassword($uid, $password);
+    }
+
+    /**
+     * @param IUser $user
+     * @param array $loginDetails
+     * @param bool $regenerateSessionId
+     * @return true returns true if login successful or an exception otherwise
+     * @throws LoginException
+     */
+    public function completeLogin(IUser $user, array $loginDetails, $regenerateSessionId = true) {
+        if (!$user->isEnabled()) {
+            // disabled users can not log in
+            // injecting l10n does not work - there is a circular dependency between session and \OCP\L10N\IFactory
+            $message = \OC::$server->getL10N('lib')->t('User disabled');
+            throw new LoginException($message);
+        }
+
+        if($regenerateSessionId) {
+            $this->session->regenerateId();
+        }
+
+        $this->setUser($user);
+        $this->setLoginName($loginDetails['loginName']);
+
+        if(isset($loginDetails['token']) && $loginDetails['token'] instanceof IToken) {
+            $this->setToken($loginDetails['token']->getId());
+            $this->lockdownManager->setToken($loginDetails['token']);
+            $firstTimeLogin = false;
+        } else {
+            $this->setToken(null);
+            $firstTimeLogin = $user->updateLastLoginTimestamp();
+        }
+        $this->manager->emit('\OC\User', 'postLogin', [$user, $loginDetails['password']]);
+        if($this->isLoggedIn()) {
+            $this->prepareUserLogin($firstTimeLogin, $regenerateSessionId);
+            return true;
+        }
+
+        $message = \OC::$server->getL10N('lib')->t('Login canceled by app');
+        throw new LoginException($message);
+    }
+
+    /**
+     * Tries to log in a client
+     *
+     * Checks token auth enforced
+     * Checks 2FA enabled
+     *
+     * @param string $user
+     * @param string $password
+     * @param IRequest $request
+     * @param OC\Security\Bruteforce\Throttler $throttler
+     * @throws LoginException
+     * @throws PasswordLoginForbiddenException
+     * @return boolean
+     */
+    public function logClientIn($user,
+                                $password,
+                                IRequest $request,
+                                OC\Security\Bruteforce\Throttler $throttler) {
+        $currentDelay = $throttler->sleepDelay($request->getRemoteAddress(), 'login');
+
+        if ($this->manager instanceof PublicEmitter) {
+            $this->manager->emit('\OC\User', 'preLogin', array($user, $password));
+        }
+
+        $isTokenPassword = $this->isTokenPassword($password);
+        if (!$isTokenPassword && $this->isTokenAuthEnforced()) {
+            throw new PasswordLoginForbiddenException();
+        }
+        if (!$isTokenPassword && $this->isTwoFactorEnforced($user)) {
+            throw new PasswordLoginForbiddenException();
+        }
+
+        // Try to login with this username and password
+        if (!$this->login($user, $password) ) {
+
+            // Failed, maybe the user used their email address
+            $users = $this->manager->getByEmail($user);
+            if (!(\count($users) === 1 && $this->login($users[0]->getUID(), $password))) {
+
+                $this->logger->warning('Login failed: \'' . $user . '\' (Remote IP: \'' . \OC::$server->getRequest()->getRemoteAddress() . '\')', ['app' => 'core']);
+
+                $throttler->registerAttempt('login', $request->getRemoteAddress(), ['uid' => $user]);
+                if ($currentDelay === 0) {
+                    $throttler->sleepDelay($request->getRemoteAddress(), 'login');
+                }
+                return false;
+            }
+        }
+
+        if ($isTokenPassword) {
+            $this->session->set('app_password', $password);
+        } else if($this->supportsCookies($request)) {
+            // Password login, but cookies supported -> create (browser) session token
+            $this->createSessionToken($request, $this->getUser()->getUID(), $user, $password);
+        }
+
+        return true;
+    }
+
+    protected function supportsCookies(IRequest $request) {
+        if (!is_null($request->getCookie('cookie_test'))) {
+            return true;
+        }
+        setcookie('cookie_test', 'test', $this->timeFactory->getTime() + 3600);
+        return false;
+    }
+
+    private function isTokenAuthEnforced() {
+        return $this->config->getSystemValue('token_auth_enforced', false);
+    }
+
+    protected function isTwoFactorEnforced($username) {
+        Util::emitHook(
+            '\OCA\Files_Sharing\API\Server2Server',
+            'preLoginNameUsedAsUserName',
+            array('uid' => &$username)
+        );
+        $user = $this->manager->get($username);
+        if (is_null($user)) {
+            $users = $this->manager->getByEmail($username);
+            if (empty($users)) {
+                return false;
+            }
+            if (count($users) !== 1) {
+                return true;
+            }
+            $user = $users[0];
+        }
+        // DI not possible due to cyclic dependencies :'-/
+        return OC::$server->getTwoFactorAuthManager()->isTwoFactorAuthenticated($user);
+    }
+
+    /**
+     * Check if the given 'password' is actually a device token
+     *
+     * @param string $password
+     * @return boolean
+     */
+    public function isTokenPassword($password) {
+        try {
+            $this->tokenProvider->getToken($password);
+            return true;
+        } catch (InvalidTokenException $ex) {
+            return false;
+        }
+    }
+
+    protected function prepareUserLogin($firstTimeLogin, $refreshCsrfToken = true) {
+        if ($refreshCsrfToken) {
+            // TODO: mock/inject/use non-static
+            // Refresh the token
+            \OC::$server->getCsrfTokenManager()->refreshToken();
+        }
+
+        //we need to pass the user name, which may differ from login name
+        $user = $this->getUser()->getUID();
+        OC_Util::setupFS($user);
+
+        if ($firstTimeLogin) {
+            // TODO: lock necessary?
+            //trigger creation of user home and /files folder
+            $userFolder = \OC::$server->getUserFolder($user);
+
+            try {
+                // copy skeleton
+                \OC_Util::copySkeleton($user, $userFolder);
+            } catch (NotPermittedException $ex) {
+                // read only uses
+            }
+
+            // trigger any other initialization
+            \OC::$server->getEventDispatcher()->dispatch(IUser::class . '::firstLogin', new GenericEvent($this->getUser()));
+        }
+    }
+
+    /**
+     * Tries to login the user with HTTP Basic Authentication
+     *
+     * @todo do not allow basic auth if the user is 2FA enforced
+     * @param IRequest $request
+     * @param OC\Security\Bruteforce\Throttler $throttler
+     * @return boolean if the login was successful
+     */
+    public function tryBasicAuthLogin(IRequest $request,
+                                        OC\Security\Bruteforce\Throttler $throttler) {
+        if (!empty($request->server['PHP_AUTH_USER']) && !empty($request->server['PHP_AUTH_PW'])) {
+            try {
+                if ($this->logClientIn($request->server['PHP_AUTH_USER'], $request->server['PHP_AUTH_PW'], $request, $throttler)) {
+                    /**
+                     * Add DAV authenticated. This should in an ideal world not be
+                     * necessary but the iOS App reads cookies from anywhere instead
+                     * only the DAV endpoint.
+                     * This makes sure that the cookies will be valid for the whole scope
+                     * @see https://github.com/owncloud/core/issues/22893
+                     */
+                    $this->session->set(
+                        Auth::DAV_AUTHENTICATED, $this->getUser()->getUID()
+                    );
+
+                    // Set the last-password-confirm session to make the sudo mode work
+                        $this->session->set('last-password-confirm', $this->timeFactory->getTime());
+
+                    return true;
+                }
+            } catch (PasswordLoginForbiddenException $ex) {
+                // Nothing to do
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Log an user in via login name and password
+     *
+     * @param string $uid
+     * @param string $password
+     * @return boolean
+     * @throws LoginException if an app canceld the login process or the user is not enabled
+     */
+    private function loginWithPassword($uid, $password) {
+        $user = $this->manager->checkPasswordNoLogging($uid, $password);
+        if ($user === false) {
+            // Password check failed
+            return false;
+        }
+
+        return $this->completeLogin($user, ['loginName' => $uid, 'password' => $password], false);
+    }
+
+    /**
+     * Log an user in with a given token (id)
+     *
+     * @param string $token
+     * @return boolean
+     * @throws LoginException if an app canceled the login process or the user is not enabled
+     */
+    private function loginWithToken($token) {
+        try {
+            $dbToken = $this->tokenProvider->getToken($token);
+        } catch (InvalidTokenException $ex) {
+            return false;
+        }
+        $uid = $dbToken->getUID();
+
+        // When logging in with token, the password must be decrypted first before passing to login hook
+        $password = '';
+        try {
+            $password = $this->tokenProvider->getPassword($dbToken, $token);
+        } catch (PasswordlessTokenException $ex) {
+            // Ignore and use empty string instead
+        }
+
+        $this->manager->emit('\OC\User', 'preLogin', array($uid, $password));
+
+        $user = $this->manager->get($uid);
+        if (is_null($user)) {
+            // user does not exist
+            return false;
+        }
+
+        return $this->completeLogin(
+            $user,
+            [
+                'loginName' => $dbToken->getLoginName(),
+                'password' => $password,
+                'token' => $dbToken
+            ],
+            false);
+    }
+
+    /**
+     * Create a new session token for the given user credentials
+     *
+     * @param IRequest $request
+     * @param string $uid user UID
+     * @param string $loginName login name
+     * @param string $password
+     * @param int $remember
+     * @return boolean
+     */
+    public function createSessionToken(IRequest $request, $uid, $loginName, $password = null, $remember = IToken::DO_NOT_REMEMBER) {
+        if (is_null($this->manager->get($uid))) {
+            // User does not exist
+            return false;
+        }
+        $name = isset($request->server['HTTP_USER_AGENT']) ? $request->server['HTTP_USER_AGENT'] : 'unknown browser';
+        try {
+            $sessionId = $this->session->getId();
+            $pwd = $this->getPassword($password);
+            // Make sure the current sessionId has no leftover tokens
+            $this->tokenProvider->invalidateToken($sessionId);
+            $this->tokenProvider->generateToken($sessionId, $uid, $loginName, $pwd, $name, IToken::TEMPORARY_TOKEN, $remember);
+            return true;
+        } catch (SessionNotAvailableException $ex) {
+            // This can happen with OCC, where a memory session is used
+            // if a memory session is used, we shouldn't create a session token anyway
+            return false;
+        }
+    }
+
+    /**
+     * Checks if the given password is a token.
+     * If yes, the password is extracted from the token.
+     * If no, the same password is returned.
+     *
+     * @param string $password either the login password or a device token
+     * @return string|null the password or null if none was set in the token
+     */
+    private function getPassword($password) {
+        if (is_null($password)) {
+            // This is surely no token ;-)
+            return null;
+        }
+        try {
+            $token = $this->tokenProvider->getToken($password);
+            try {
+                return $this->tokenProvider->getPassword($token, $password);
+            } catch (PasswordlessTokenException $ex) {
+                return null;
+            }
+        } catch (InvalidTokenException $ex) {
+            return $password;
+        }
+    }
+
+    /**
+     * @param IToken $dbToken
+     * @param string $token
+     * @return boolean
+     */
+    private function checkTokenCredentials(IToken $dbToken, $token) {
+        // Check whether login credentials are still valid and the user was not disabled
+        // This check is performed each 5 minutes
+        $lastCheck = $dbToken->getLastCheck() ? : 0;
+        $now = $this->timeFactory->getTime();
+        if ($lastCheck > ($now - 60 * 5)) {
+            // Checked performed recently, nothing to do now
+            return true;
+        }
+
+        try {
+            $pwd = $this->tokenProvider->getPassword($dbToken, $token);
+        } catch (InvalidTokenException $ex) {
+            // An invalid token password was used -> log user out
+            return false;
+        } catch (PasswordlessTokenException $ex) {
+            // Token has no password
+
+            if (!is_null($this->activeUser) && !$this->activeUser->isEnabled()) {
+                $this->tokenProvider->invalidateToken($token);
+                return false;
+            }
+
+            $dbToken->setLastCheck($now);
+            return true;
+        }
+
+        if ($this->manager->checkPassword($dbToken->getLoginName(), $pwd) === false
+            || (!is_null($this->activeUser) && !$this->activeUser->isEnabled())) {
+            $this->tokenProvider->invalidateToken($token);
+            // Password has changed or user was disabled -> log user out
+            return false;
+        }
+        $dbToken->setLastCheck($now);
+        return true;
+    }
+
+    /**
+     * Check if the given token exists and performs password/user-enabled checks
+     *
+     * Invalidates the token if checks fail
+     *
+     * @param string $token
+     * @param string $user login name
+     * @return boolean
+     */
+    private function validateToken($token, $user = null) {
+        try {
+            $dbToken = $this->tokenProvider->getToken($token);
+        } catch (InvalidTokenException $ex) {
+            return false;
+        }
+
+        // Check if login names match
+        if (!is_null($user) && $dbToken->getLoginName() !== $user) {
+            // TODO: this makes it imposssible to use different login names on browser and client
+            // e.g. login by e-mail 'user@example.com' on browser for generating the token will not
+            //      allow to use the client token with the login name 'user'.
+            return false;
+        }
+
+        if (!$this->checkTokenCredentials($dbToken, $token)) {
+            return false;
+        }
+
+        $this->tokenProvider->updateTokenActivity($dbToken);
+
+        return true;
+    }
+
+    /**
+     * Tries to login the user with auth token header
+     *
+     * @param IRequest $request
+     * @todo check remember me cookie
+     * @return boolean
+     */
+    public function tryTokenLogin(IRequest $request) {
+        $authHeader = $request->getHeader('Authorization');
+        if (strpos($authHeader, 'Bearer ') === false) {
+            // No auth header, let's try session id
+            try {
+                $token = $this->session->getId();
+            } catch (SessionNotAvailableException $ex) {
+                return false;
+            }
+        } else {
+            $token = substr($authHeader, 7);
+        }
+
+        if (!$this->loginWithToken($token)) {
+            return false;
+        }
+        if(!$this->validateToken($token)) {
+            return false;
+        }
+        return true;
+    }
+
+    /**
+     * perform login using the magic cookie (remember login)
+     *
+     * @param string $uid the username
+     * @param string $currentToken
+     * @param string $oldSessionId
+     * @return bool
+     */
+    public function loginWithCookie($uid, $currentToken, $oldSessionId) {
+        $this->session->regenerateId();
+        $this->manager->emit('\OC\User', 'preRememberedLogin', array($uid));
+        $user = $this->manager->get($uid);
+        if (is_null($user)) {
+            // user does not exist
+            return false;
+        }
+
+        // get stored tokens
+        $tokens = $this->config->getUserKeys($uid, 'login_token');
+        // test cookies token against stored tokens
+        if (!in_array($currentToken, $tokens, true)) {
+            return false;
+        }
+        // replace successfully used token with a new one
+        $this->config->deleteUserValue($uid, 'login_token', $currentToken);
+        $newToken = $this->random->generate(32);
+        $this->config->setUserValue($uid, 'login_token', $newToken, $this->timeFactory->getTime());
+
+        try {
+            $sessionId = $this->session->getId();
+            $this->tokenProvider->renewSessionToken($oldSessionId, $sessionId);
+        } catch (SessionNotAvailableException $ex) {
+            return false;
+        } catch (InvalidTokenException $ex) {
+            \OC::$server->getLogger()->warning('Renewing session token failed', ['app' => 'core']);
+            return false;
+        }
+
+        $this->setMagicInCookie($user->getUID(), $newToken);
+        $token = $this->tokenProvider->getToken($sessionId);
+
+        //login
+        $this->setUser($user);
+        $this->setLoginName($token->getLoginName());
+        $this->setToken($token->getId());
+        $this->lockdownManager->setToken($token);
+        $user->updateLastLoginTimestamp();
+        $password = null;
+        try {
+            $password = $this->tokenProvider->getPassword($token, $sessionId);
+        } catch (PasswordlessTokenException $ex) {
+            // Ignore
+        }
+        $this->manager->emit('\OC\User', 'postRememberedLogin', [$user, $password]);
+        return true;
+    }
+
+    /**
+     * @param IUser $user
+     */
+    public function createRememberMeToken(IUser $user) {
+        $token = $this->random->generate(32);
+        $this->config->setUserValue($user->getUID(), 'login_token', $token, $this->timeFactory->getTime());
+        $this->setMagicInCookie($user->getUID(), $token);
+    }
+
+    /**
+     * logout the user from the session
+     */
+    public function logout() {
+        $this->manager->emit('\OC\User', 'logout');
+        $user = $this->getUser();
+        if (!is_null($user)) {
+            try {
+                $this->tokenProvider->invalidateToken($this->session->getId());
+            } catch (SessionNotAvailableException $ex) {
+
+            }
+        }
+        $this->setUser(null);
+        $this->setLoginName(null);
+        $this->setToken(null);
+        $this->unsetMagicInCookie();
+        $this->session->clear();
+        $this->manager->emit('\OC\User', 'postLogout');
+    }
+
+    /**
+     * Set cookie value to use in next page load
+     *
+     * @param string $username username to be set
+     * @param string $token
+     */
+    public function setMagicInCookie($username, $token) {
+        $secureCookie = OC::$server->getRequest()->getServerProtocol() === 'https';
+        $webRoot = \OC::$WEBROOT;
+        if ($webRoot === '') {
+            $webRoot = '/';
+        }
+
+        $expires = $this->timeFactory->getTime() + $this->config->getSystemValue('remember_login_cookie_lifetime', 60 * 60 * 24 * 15);
+        setcookie('nc_username', $username, $expires, $webRoot, '', $secureCookie, true);
+        setcookie('nc_token', $token, $expires, $webRoot, '', $secureCookie, true);
+        try {
+            setcookie('nc_session_id', $this->session->getId(), $expires, $webRoot, '', $secureCookie, true);
+        } catch (SessionNotAvailableException $ex) {
+            // ignore
+        }
+    }
+
+    /**
+     * Remove cookie for "remember username"
+     */
+    public function unsetMagicInCookie() {
+        //TODO: DI for cookies and IRequest
+        $secureCookie = OC::$server->getRequest()->getServerProtocol() === 'https';
+
+        unset($_COOKIE['nc_username']); //TODO: DI
+        unset($_COOKIE['nc_token']);
+        unset($_COOKIE['nc_session_id']);
+        setcookie('nc_username', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, '', $secureCookie, true);
+        setcookie('nc_token', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, '', $secureCookie, true);
+        setcookie('nc_session_id', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT, '', $secureCookie, true);
+        // old cookies might be stored under /webroot/ instead of /webroot
+        // and Firefox doesn't like it!
+        setcookie('nc_username', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
+        setcookie('nc_token', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
+        setcookie('nc_session_id', '', $this->timeFactory->getTime() - 3600, OC::$WEBROOT . '/', '', $secureCookie, true);
+    }
+
+    /**
+     * Update password of the browser session token if there is one
+     *
+     * @param string $password
+     */
+    public function updateSessionTokenPassword($password) {
+        try {
+            $sessionId = $this->session->getId();
+            $token = $this->tokenProvider->getToken($sessionId);
+            $this->tokenProvider->setPassword($token, $sessionId, $password);
+        } catch (SessionNotAvailableException $ex) {
+            // Nothing to do
+        } catch (InvalidTokenException $ex) {
+            // Nothing to do
+        }
+    }
 
 
 }

lib/private/Session/Memory.php

Indentation +72 added lines, -72 removed lines

@@ -39,86 +39,86 @@
  * @package OC\Session
  */
 class Memory extends Session {
-	protected $data;
+    protected $data;
 
-	public function __construct(string $name) {
-		//no need to use $name since all data is already scoped to this instance
-		$this->data = [];
-	}
+    public function __construct(string $name) {
+        //no need to use $name since all data is already scoped to this instance
+        $this->data = [];
+    }
 
-	/**
-	 * @param string $key
-	 * @param integer $value
-	 */
-	public function set(string $key, $value) {
-		$this->validateSession();
-		$this->data[$key] = $value;
-	}
+    /**
+     * @param string $key
+     * @param integer $value
+     */
+    public function set(string $key, $value) {
+        $this->validateSession();
+        $this->data[$key] = $value;
+    }
 
-	/**
-	 * @param string $key
-	 * @return mixed
-	 */
-	public function get(string $key) {
-		if (!$this->exists($key)) {
-			return null;
-		}
-		return $this->data[$key];
-	}
+    /**
+     * @param string $key
+     * @return mixed
+     */
+    public function get(string $key) {
+        if (!$this->exists($key)) {
+            return null;
+        }
+        return $this->data[$key];
+    }
 
-	/**
-	 * @param string $key
-	 * @return bool
-	 */
-	public function exists(string $key): bool {
-		return isset($this->data[$key]);
-	}
+    /**
+     * @param string $key
+     * @return bool
+     */
+    public function exists(string $key): bool {
+        return isset($this->data[$key]);
+    }
 
-	/**
-	 * @param string $key
-	 */
-	public function remove(string $key) {
-		$this->validateSession();
-		unset($this->data[$key]);
-	}
+    /**
+     * @param string $key
+     */
+    public function remove(string $key) {
+        $this->validateSession();
+        unset($this->data[$key]);
+    }
 
-	public function clear() {
-		$this->data = [];
-	}
+    public function clear() {
+        $this->data = [];
+    }
 
-	/**
-	 * Stub since the session ID does not need to get regenerated for the cache
-	 *
-	 * @param bool $deleteOldSession
-	 */
-	public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {}
+    /**
+     * Stub since the session ID does not need to get regenerated for the cache
+     *
+     * @param bool $deleteOldSession
+     */
+    public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {}
 
-	/**
-	 * Wrapper around session_id
-	 *
-	 * @return string
-	 * @throws SessionNotAvailableException
-	 * @since 9.1.0
-	 */
-	public function getId(): string {
-		throw new SessionNotAvailableException('Memory session does not have an ID');
-	}
+    /**
+     * Wrapper around session_id
+     *
+     * @return string
+     * @throws SessionNotAvailableException
+     * @since 9.1.0
+     */
+    public function getId(): string {
+        throw new SessionNotAvailableException('Memory session does not have an ID');
+    }
 
-	/**
-	 * Helper function for PHPUnit execution - don't use in non-test code
-	 */
-	public function reopen() {
-		$this->sessionClosed = false;
-	}
+    /**
+     * Helper function for PHPUnit execution - don't use in non-test code
+     */
+    public function reopen() {
+        $this->sessionClosed = false;
+    }
 
-	/**
-	 * In case the session has already been locked an exception will be thrown
-	 *
-	 * @throws Exception
-	 */
-	private function validateSession() {
-		if ($this->sessionClosed) {
-			throw new Exception('Session has been closed - no further changes to the session are allowed');
-		}
-	}
+    /**
+     * In case the session has already been locked an exception will be thrown
+     *
+     * @throws Exception
+     */
+    private function validateSession() {
+        if ($this->sessionClosed) {
+            throw new Exception('Session has been closed - no further changes to the session are allowed');
+        }
+    }
 }

lib/private/Session/CryptoSessionData.php

Indentation +173 added lines, -173 removed lines

@@ -37,177 +37,177 @@
  * @package OC\Session
  */
 class CryptoSessionData implements \ArrayAccess, ISession {
-	/** @var ISession */
-	protected $session;
-	/** @var \OCP\Security\ICrypto */
-	protected $crypto;
-	/** @var string */
-	protected $passphrase;
-	/** @var array */
-	protected $sessionValues;
-	/** @var bool */
-	protected $isModified = false;
-	CONST encryptedSessionName = 'encrypted_session_data';
-
-	/**
-	 * @param ISession $session
-	 * @param ICrypto $crypto
-	 * @param string $passphrase
-	 */
-	public function __construct(ISession $session,
-								ICrypto $crypto,
-								string $passphrase) {
-		$this->crypto = $crypto;
-		$this->session = $session;
-		$this->passphrase = $passphrase;
-		$this->initializeSession();
-	}
-
-	/**
-	 * Close session if class gets destructed
-	 */
-	public function __destruct() {
-		try {
-			$this->close();
-		} catch (SessionNotAvailableException $e){
-			// This exception can occur if session is already closed
-			// So it is safe to ignore it and let the garbage collector to proceed
-		}
-	}
-
-	protected function initializeSession() {
-		$encryptedSessionData = $this->session->get(self::encryptedSessionName) ?: '';
-		try {
-			$this->sessionValues = json_decode(
-				$this->crypto->decrypt($encryptedSessionData, $this->passphrase),
-				true
-			);
-		} catch (\Exception $e) {
-			$this->sessionValues = [];
-		}
-	}
-
-	/**
-	 * Set a value in the session
-	 *
-	 * @param string $key
-	 * @param mixed $value
-	 */
-	public function set(string $key, $value) {
-		$this->sessionValues[$key] = $value;
-		$this->isModified = true;
-	}
-
-	/**
-	 * Get a value from the session
-	 *
-	 * @param string $key
-	 * @return string|null Either the value or null
-	 */
-	public function get(string $key) {
-		if(isset($this->sessionValues[$key])) {
-			return $this->sessionValues[$key];
-		}
-
-		return null;
-	}
-
-	/**
-	 * Check if a named key exists in the session
-	 *
-	 * @param string $key
-	 * @return bool
-	 */
-	public function exists(string $key): bool {
-		return isset($this->sessionValues[$key]);
-	}
-
-	/**
-	 * Remove a $key/$value pair from the session
-	 *
-	 * @param string $key
-	 */
-	public function remove(string $key) {
-		$this->isModified = true;
-		unset($this->sessionValues[$key]);
-		$this->session->remove(self::encryptedSessionName);
-	}
-
-	/**
-	 * Reset and recreate the session
-	 */
-	public function clear() {
-		$requesttoken = $this->get('requesttoken');
-		$this->sessionValues = [];
-		if ($requesttoken !== null) {
-			$this->set('requesttoken', $requesttoken);
-		}
-		$this->isModified = true;
-		$this->session->clear();
-	}
-
-	/**
-	 * Wrapper around session_regenerate_id
-	 *
-	 * @param bool $deleteOldSession Whether to delete the old associated session file or not.
-	 * @param bool $updateToken Wheater to update the associated auth token
-	 * @return void
-	 */
-	public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {
-		$this->session->regenerateId($deleteOldSession, $updateToken);
-	}
-
-	/**
-	 * Wrapper around session_id
-	 *
-	 * @return string
-	 * @throws SessionNotAvailableException
-	 * @since 9.1.0
-	 */
-	public function getId(): string {
-		return $this->session->getId();
-	}
-
-	/**
-	 * Close the session and release the lock, also writes all changed data in batch
-	 */
-	public function close() {
-		if($this->isModified) {
-			$encryptedValue = $this->crypto->encrypt(json_encode($this->sessionValues), $this->passphrase);
-			$this->session->set(self::encryptedSessionName, $encryptedValue);
-			$this->isModified = false;
-		}
-		$this->session->close();
-	}
-
-	/**
-	 * @param mixed $offset
-	 * @return bool
-	 */
-	public function offsetExists($offset): bool {
-		return $this->exists($offset);
-	}
-
-	/**
-	 * @param mixed $offset
-	 * @return mixed
-	 */
-	public function offsetGet($offset) {
-		return $this->get($offset);
-	}
-
-	/**
-	 * @param mixed $offset
-	 * @param mixed $value
-	 */
-	public function offsetSet($offset, $value) {
-		$this->set($offset, $value);
-	}
-
-	/**
-	 * @param mixed $offset
-	 */
-	public function offsetUnset($offset) {
-		$this->remove($offset);
-	}
+    /** @var ISession */
+    protected $session;
+    /** @var \OCP\Security\ICrypto */
+    protected $crypto;
+    /** @var string */
+    protected $passphrase;
+    /** @var array */
+    protected $sessionValues;
+    /** @var bool */
+    protected $isModified = false;
+    CONST encryptedSessionName = 'encrypted_session_data';
+
+    /**
+     * @param ISession $session
+     * @param ICrypto $crypto
+     * @param string $passphrase
+     */
+    public function __construct(ISession $session,
+                                ICrypto $crypto,
+                                string $passphrase) {
+        $this->crypto = $crypto;
+        $this->session = $session;
+        $this->passphrase = $passphrase;
+        $this->initializeSession();
+    }
+
+    /**
+     * Close session if class gets destructed
+     */
+    public function __destruct() {
+        try {
+            $this->close();
+        } catch (SessionNotAvailableException $e){
+            // This exception can occur if session is already closed
+            // So it is safe to ignore it and let the garbage collector to proceed
+        }
+    }
+
+    protected function initializeSession() {
+        $encryptedSessionData = $this->session->get(self::encryptedSessionName) ?: '';
+        try {
+            $this->sessionValues = json_decode(
+                $this->crypto->decrypt($encryptedSessionData, $this->passphrase),
+                true
+            );
+        } catch (\Exception $e) {
+            $this->sessionValues = [];
+        }
+    }
+
+    /**
+     * Set a value in the session
+     *
+     * @param string $key
+     * @param mixed $value
+     */
+    public function set(string $key, $value) {
+        $this->sessionValues[$key] = $value;
+        $this->isModified = true;
+    }
+
+    /**
+     * Get a value from the session
+     *
+     * @param string $key
+     * @return string|null Either the value or null
+     */
+    public function get(string $key) {
+        if(isset($this->sessionValues[$key])) {
+            return $this->sessionValues[$key];
+        }
+
+        return null;
+    }
+
+    /**
+     * Check if a named key exists in the session
+     *
+     * @param string $key
+     * @return bool
+     */
+    public function exists(string $key): bool {
+        return isset($this->sessionValues[$key]);
+    }
+
+    /**
+     * Remove a $key/$value pair from the session
+     *
+     * @param string $key
+     */
+    public function remove(string $key) {
+        $this->isModified = true;
+        unset($this->sessionValues[$key]);
+        $this->session->remove(self::encryptedSessionName);
+    }
+
+    /**
+     * Reset and recreate the session
+     */
+    public function clear() {
+        $requesttoken = $this->get('requesttoken');
+        $this->sessionValues = [];
+        if ($requesttoken !== null) {
+            $this->set('requesttoken', $requesttoken);
+        }
+        $this->isModified = true;
+        $this->session->clear();
+    }
+
+    /**
+     * Wrapper around session_regenerate_id
+     *
+     * @param bool $deleteOldSession Whether to delete the old associated session file or not.
+     * @param bool $updateToken Wheater to update the associated auth token
+     * @return void
+     */
+    public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {
+        $this->session->regenerateId($deleteOldSession, $updateToken);
+    }
+
+    /**
+     * Wrapper around session_id
+     *
+     * @return string
+     * @throws SessionNotAvailableException
+     * @since 9.1.0
+     */
+    public function getId(): string {
+        return $this->session->getId();
+    }
+
+    /**
+     * Close the session and release the lock, also writes all changed data in batch
+     */
+    public function close() {
+        if($this->isModified) {
+            $encryptedValue = $this->crypto->encrypt(json_encode($this->sessionValues), $this->passphrase);
+            $this->session->set(self::encryptedSessionName, $encryptedValue);
+            $this->isModified = false;
+        }
+        $this->session->close();
+    }
+
+    /**
+     * @param mixed $offset
+     * @return bool
+     */
+    public function offsetExists($offset): bool {
+        return $this->exists($offset);
+    }
+
+    /**
+     * @param mixed $offset
+     * @return mixed
+     */
+    public function offsetGet($offset) {
+        return $this->get($offset);
+    }
+
+    /**
+     * @param mixed $offset
+     * @param mixed $value
+     */
+    public function offsetSet($offset, $value) {
+        $this->set($offset, $value);
+    }
+
+    /**
+     * @param mixed $offset
+     */
+    public function offsetUnset($offset) {
+        $this->remove($offset);
+    }
 }

apps/files_sharing/lib/Controller/ShareController.php

Indentation +596 added lines, -596 removed lines

@@ -70,604 +70,604 @@
  */
 class ShareController extends Controller {
 
-	/** @var IConfig */
-	protected $config;
-	/** @var IURLGenerator */
-	protected $urlGenerator;
-	/** @var IUserManager */
-	protected $userManager;
-	/** @var ILogger */
-	protected $logger;
-	/** @var \OCP\Activity\IManager */
-	protected $activityManager;
-	/** @var \OCP\Share\IManager */
-	protected $shareManager;
-	/** @var ISession */
-	protected $session;
-	/** @var IPreview */
-	protected $previewManager;
-	/** @var IRootFolder */
-	protected $rootFolder;
-	/** @var FederatedShareProvider */
-	protected $federatedShareProvider;
-	/** @var EventDispatcherInterface */
-	protected $eventDispatcher;
-	/** @var IL10N */
-	protected $l10n;
-	/** @var Defaults */
-	protected $defaults;
-
-	/**
-	 * @param string $appName
-	 * @param IRequest $request
-	 * @param IConfig $config
-	 * @param IURLGenerator $urlGenerator
-	 * @param IUserManager $userManager
-	 * @param ILogger $logger
-	 * @param \OCP\Activity\IManager $activityManager
-	 * @param \OCP\Share\IManager $shareManager
-	 * @param ISession $session
-	 * @param IPreview $previewManager
-	 * @param IRootFolder $rootFolder
-	 * @param FederatedShareProvider $federatedShareProvider
-	 * @param EventDispatcherInterface $eventDispatcher
-	 * @param IL10N $l10n
-	 * @param Defaults $defaults
-	 */
-	public function __construct($appName,
-								IRequest $request,
-								IConfig $config,
-								IURLGenerator $urlGenerator,
-								IUserManager $userManager,
-								ILogger $logger,
-								\OCP\Activity\IManager $activityManager,
-								\OCP\Share\IManager $shareManager,
-								ISession $session,
-								IPreview $previewManager,
-								IRootFolder $rootFolder,
-								FederatedShareProvider $federatedShareProvider,
-								EventDispatcherInterface $eventDispatcher,
-								IL10N $l10n,
-								Defaults $defaults) {
-		parent::__construct($appName, $request);
-
-		$this->config = $config;
-		$this->urlGenerator = $urlGenerator;
-		$this->userManager = $userManager;
-		$this->logger = $logger;
-		$this->activityManager = $activityManager;
-		$this->shareManager = $shareManager;
-		$this->session = $session;
-		$this->previewManager = $previewManager;
-		$this->rootFolder = $rootFolder;
-		$this->federatedShareProvider = $federatedShareProvider;
-		$this->eventDispatcher = $eventDispatcher;
-		$this->l10n = $l10n;
-		$this->defaults = $defaults;
-	}
-
-	/**
-	 * @PublicPage
-	 * @NoCSRFRequired
-	 *
-	 * @param string $token
-	 * @return TemplateResponse|RedirectResponse
-	 */
-	public function showAuthenticate($token) {
-		$share = $this->shareManager->getShareByToken($token);
-
-		if($this->linkShareAuth($share)) {
-			return new RedirectResponse($this->urlGenerator->linkToRoute('files_sharing.sharecontroller.showShare', array('token' => $token)));
-		}
-
-		return new TemplateResponse($this->appName, 'authenticate', array(), 'guest');
-	}
-
-	/**
-	 * @PublicPage
-	 * @UseSession
-	 * @BruteForceProtection(action=publicLinkAuth)
-	 *
-	 * Authenticates against password-protected shares
-	 * @param string $token
-	 * @param string $redirect
-	 * @param string $password
-	 * @return RedirectResponse|TemplateResponse|NotFoundResponse
-	 */
-	public function authenticate($token, $redirect, $password = '') {
-
-		// Check whether share exists
-		try {
-			$share = $this->shareManager->getShareByToken($token);
-		} catch (ShareNotFound $e) {
-			return new NotFoundResponse();
-		}
-
-		$authenticate = $this->linkShareAuth($share, $password);
-
-		// if download was requested before auth, redirect to download
-		if ($authenticate === true && $redirect === 'download') {
-			return new RedirectResponse($this->urlGenerator->linkToRoute(
-				'files_sharing.sharecontroller.downloadShare',
-				array('token' => $token))
-			);
-		} else if ($authenticate === true) {
-			return new RedirectResponse($this->urlGenerator->linkToRoute(
-				'files_sharing.sharecontroller.showShare',
-				array('token' => $token))
-			);
-		}
-
-		$response = new TemplateResponse($this->appName, 'authenticate', array('wrongpw' => true), 'guest');
-		$response->throttle();
-		return $response;
-	}
-
-	/**
-	 * Authenticate a link item with the given password.
-	 * Or use the session if no password is provided.
-	 *
-	 * This is a modified version of Helper::authenticate
-	 * TODO: Try to merge back eventually with Helper::authenticate
-	 *
-	 * @param \OCP\Share\IShare $share
-	 * @param string|null $password
-	 * @return bool
-	 */
-	private function linkShareAuth(\OCP\Share\IShare $share, $password = null) {
-		if ($password !== null) {
-			if ($this->shareManager->checkPassword($share, $password)) {
-				$this->session->regenerateId(true, true);
-				$this->session->set('public_link_authenticated', (string)$share->getId());
-			} else {
-				$this->emitAccessShareHook($share, 403, 'Wrong password');
-				return false;
-			}
-		} else {
-			// not authenticated ?
-			if ( ! $this->session->exists('public_link_authenticated')
-				|| $this->session->get('public_link_authenticated') !== (string)$share->getId()) {
-				return false;
-			}
-		}
-		return true;
-	}
-
-	/**
-	 * throws hooks when a share is attempted to be accessed
-	 *
-	 * @param \OCP\Share\IShare|string $share the Share instance if available,
-	 * otherwise token
-	 * @param int $errorCode
-	 * @param string $errorMessage
-	 * @throws \OC\HintException
-	 * @throws \OC\ServerNotAvailableException
-	 */
-	protected function emitAccessShareHook($share, $errorCode = 200, $errorMessage = '') {
-		$itemType = $itemSource = $uidOwner = '';
-		$token = $share;
-		$exception = null;
-		if($share instanceof \OCP\Share\IShare) {
-			try {
-				$token = $share->getToken();
-				$uidOwner = $share->getSharedBy();
-				$itemType = $share->getNodeType();
-				$itemSource = $share->getNodeId();
-			} catch (\Exception $e) {
-				// we log what we know and pass on the exception afterwards
-				$exception = $e;
-			}
-		}
-		\OC_Hook::emit(Share::class, 'share_link_access', [
-			'itemType' => $itemType,
-			'itemSource' => $itemSource,
-			'uidOwner' => $uidOwner,
-			'token' => $token,
-			'errorCode' => $errorCode,
-			'errorMessage' => $errorMessage,
-		]);
-		if(!is_null($exception)) {
-			throw $exception;
-		}
-	}
-
-	/**
-	 * Validate the permissions of the share
-	 *
-	 * @param Share\IShare $share
-	 * @return bool
-	 */
-	private function validateShare(\OCP\Share\IShare $share) {
-		return $share->getNode()->isReadable() && $share->getNode()->isShareable();
-	}
-
-	/**
-	 * @PublicPage
-	 * @NoCSRFRequired
-	 *
-	 * @param string $token
-	 * @param string $path
-	 * @return TemplateResponse|RedirectResponse|NotFoundResponse
-	 * @throws NotFoundException
-	 * @throws \Exception
-	 */
-	public function showShare($token, $path = '') {
-		\OC_User::setIncognitoMode(true);
-
-		// Check whether share exists
-		try {
-			$share = $this->shareManager->getShareByToken($token);
-		} catch (ShareNotFound $e) {
-			$this->emitAccessShareHook($token, 404, 'Share not found');
-			return new NotFoundResponse();
-		}
-
-		// Share is password protected - check whether the user is permitted to access the share
-		if ($share->getPassword() !== null && !$this->linkShareAuth($share)) {
-			return new RedirectResponse($this->urlGenerator->linkToRoute('files_sharing.sharecontroller.authenticate',
-				array('token' => $token, 'redirect' => 'preview')));
-		}
-
-		if (!$this->validateShare($share)) {
-			throw new NotFoundException();
-		}
-		// We can't get the path of a file share
-		try {
-			if ($share->getNode() instanceof \OCP\Files\File && $path !== '') {
-				$this->emitAccessShareHook($share, 404, 'Share not found');
-				throw new NotFoundException();
-			}
-		} catch (\Exception $e) {
-			$this->emitAccessShareHook($share, 404, 'Share not found');
-			throw $e;
-		}
-
-		$shareTmpl = [];
-		$shareTmpl['displayName'] = $this->userManager->get($share->getShareOwner())->getDisplayName();
-		$shareTmpl['owner'] = $share->getShareOwner();
-		$shareTmpl['filename'] = $share->getNode()->getName();
-		$shareTmpl['directory_path'] = $share->getTarget();
-		$shareTmpl['mimetype'] = $share->getNode()->getMimetype();
-		$shareTmpl['previewSupported'] = $this->previewManager->isMimeSupported($share->getNode()->getMimetype());
-		$shareTmpl['dirToken'] = $token;
-		$shareTmpl['sharingToken'] = $token;
-		$shareTmpl['server2serversharing'] = $this->federatedShareProvider->isOutgoingServer2serverShareEnabled();
-		$shareTmpl['protected'] = $share->getPassword() !== null ? 'true' : 'false';
-		$shareTmpl['dir'] = '';
-		$shareTmpl['nonHumanFileSize'] = $share->getNode()->getSize();
-		$shareTmpl['fileSize'] = \OCP\Util::humanFileSize($share->getNode()->getSize());
-
-		// Show file list
-		$hideFileList = false;
-		if ($share->getNode() instanceof \OCP\Files\Folder) {
-			/** @var \OCP\Files\Folder $rootFolder */
-			$rootFolder = $share->getNode();
-
-			try {
-				$folderNode = $rootFolder->get($path);
-			} catch (\OCP\Files\NotFoundException $e) {
-				$this->emitAccessShareHook($share, 404, 'Share not found');
-				throw new NotFoundException();
-			}
-
-			$shareTmpl['dir'] = $rootFolder->getRelativePath($folderNode->getPath());
-
-			/*
+    /** @var IConfig */
+    protected $config;
+    /** @var IURLGenerator */
+    protected $urlGenerator;
+    /** @var IUserManager */
+    protected $userManager;
+    /** @var ILogger */
+    protected $logger;
+    /** @var \OCP\Activity\IManager */
+    protected $activityManager;
+    /** @var \OCP\Share\IManager */
+    protected $shareManager;
+    /** @var ISession */
+    protected $session;
+    /** @var IPreview */
+    protected $previewManager;
+    /** @var IRootFolder */
+    protected $rootFolder;
+    /** @var FederatedShareProvider */
+    protected $federatedShareProvider;
+    /** @var EventDispatcherInterface */
+    protected $eventDispatcher;
+    /** @var IL10N */
+    protected $l10n;
+    /** @var Defaults */
+    protected $defaults;
+
+    /**
+     * @param string $appName
+     * @param IRequest $request
+     * @param IConfig $config
+     * @param IURLGenerator $urlGenerator
+     * @param IUserManager $userManager
+     * @param ILogger $logger
+     * @param \OCP\Activity\IManager $activityManager
+     * @param \OCP\Share\IManager $shareManager
+     * @param ISession $session
+     * @param IPreview $previewManager
+     * @param IRootFolder $rootFolder
+     * @param FederatedShareProvider $federatedShareProvider
+     * @param EventDispatcherInterface $eventDispatcher
+     * @param IL10N $l10n
+     * @param Defaults $defaults
+     */
+    public function __construct($appName,
+                                IRequest $request,
+                                IConfig $config,
+                                IURLGenerator $urlGenerator,
+                                IUserManager $userManager,
+                                ILogger $logger,
+                                \OCP\Activity\IManager $activityManager,
+                                \OCP\Share\IManager $shareManager,
+                                ISession $session,
+                                IPreview $previewManager,
+                                IRootFolder $rootFolder,
+                                FederatedShareProvider $federatedShareProvider,
+                                EventDispatcherInterface $eventDispatcher,
+                                IL10N $l10n,
+                                Defaults $defaults) {
+        parent::__construct($appName, $request);
+
+        $this->config = $config;
+        $this->urlGenerator = $urlGenerator;
+        $this->userManager = $userManager;
+        $this->logger = $logger;
+        $this->activityManager = $activityManager;
+        $this->shareManager = $shareManager;
+        $this->session = $session;
+        $this->previewManager = $previewManager;
+        $this->rootFolder = $rootFolder;
+        $this->federatedShareProvider = $federatedShareProvider;
+        $this->eventDispatcher = $eventDispatcher;
+        $this->l10n = $l10n;
+        $this->defaults = $defaults;
+    }
+
+    /**
+     * @PublicPage
+     * @NoCSRFRequired
+     *
+     * @param string $token
+     * @return TemplateResponse|RedirectResponse
+     */
+    public function showAuthenticate($token) {
+        $share = $this->shareManager->getShareByToken($token);
+
+        if($this->linkShareAuth($share)) {
+            return new RedirectResponse($this->urlGenerator->linkToRoute('files_sharing.sharecontroller.showShare', array('token' => $token)));
+        }
+
+        return new TemplateResponse($this->appName, 'authenticate', array(), 'guest');
+    }
+
+    /**
+     * @PublicPage
+     * @UseSession
+     * @BruteForceProtection(action=publicLinkAuth)
+     *
+     * Authenticates against password-protected shares
+     * @param string $token
+     * @param string $redirect
+     * @param string $password
+     * @return RedirectResponse|TemplateResponse|NotFoundResponse
+     */
+    public function authenticate($token, $redirect, $password = '') {
+
+        // Check whether share exists
+        try {
+            $share = $this->shareManager->getShareByToken($token);
+        } catch (ShareNotFound $e) {
+            return new NotFoundResponse();
+        }
+
+        $authenticate = $this->linkShareAuth($share, $password);
+
+        // if download was requested before auth, redirect to download
+        if ($authenticate === true && $redirect === 'download') {
+            return new RedirectResponse($this->urlGenerator->linkToRoute(
+                'files_sharing.sharecontroller.downloadShare',
+                array('token' => $token))
+            );
+        } else if ($authenticate === true) {
+            return new RedirectResponse($this->urlGenerator->linkToRoute(
+                'files_sharing.sharecontroller.showShare',
+                array('token' => $token))
+            );
+        }
+
+        $response = new TemplateResponse($this->appName, 'authenticate', array('wrongpw' => true), 'guest');
+        $response->throttle();
+        return $response;
+    }
+
+    /**
+     * Authenticate a link item with the given password.
+     * Or use the session if no password is provided.
+     *
+     * This is a modified version of Helper::authenticate
+     * TODO: Try to merge back eventually with Helper::authenticate
+     *
+     * @param \OCP\Share\IShare $share
+     * @param string|null $password
+     * @return bool
+     */
+    private function linkShareAuth(\OCP\Share\IShare $share, $password = null) {
+        if ($password !== null) {
+            if ($this->shareManager->checkPassword($share, $password)) {
+                $this->session->regenerateId(true, true);
+                $this->session->set('public_link_authenticated', (string)$share->getId());
+            } else {
+                $this->emitAccessShareHook($share, 403, 'Wrong password');
+                return false;
+            }
+        } else {
+            // not authenticated ?
+            if ( ! $this->session->exists('public_link_authenticated')
+                || $this->session->get('public_link_authenticated') !== (string)$share->getId()) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * throws hooks when a share is attempted to be accessed
+     *
+     * @param \OCP\Share\IShare|string $share the Share instance if available,
+     * otherwise token
+     * @param int $errorCode
+     * @param string $errorMessage
+     * @throws \OC\HintException
+     * @throws \OC\ServerNotAvailableException
+     */
+    protected function emitAccessShareHook($share, $errorCode = 200, $errorMessage = '') {
+        $itemType = $itemSource = $uidOwner = '';
+        $token = $share;
+        $exception = null;
+        if($share instanceof \OCP\Share\IShare) {
+            try {
+                $token = $share->getToken();
+                $uidOwner = $share->getSharedBy();
+                $itemType = $share->getNodeType();
+                $itemSource = $share->getNodeId();
+            } catch (\Exception $e) {
+                // we log what we know and pass on the exception afterwards
+                $exception = $e;
+            }
+        }
+        \OC_Hook::emit(Share::class, 'share_link_access', [
+            'itemType' => $itemType,
+            'itemSource' => $itemSource,
+            'uidOwner' => $uidOwner,
+            'token' => $token,
+            'errorCode' => $errorCode,
+            'errorMessage' => $errorMessage,
+        ]);
+        if(!is_null($exception)) {
+            throw $exception;
+        }
+    }
+
+    /**
+     * Validate the permissions of the share
+     *
+     * @param Share\IShare $share
+     * @return bool
+     */
+    private function validateShare(\OCP\Share\IShare $share) {
+        return $share->getNode()->isReadable() && $share->getNode()->isShareable();
+    }
+
+    /**
+     * @PublicPage
+     * @NoCSRFRequired
+     *
+     * @param string $token
+     * @param string $path
+     * @return TemplateResponse|RedirectResponse|NotFoundResponse
+     * @throws NotFoundException
+     * @throws \Exception
+     */
+    public function showShare($token, $path = '') {
+        \OC_User::setIncognitoMode(true);
+
+        // Check whether share exists
+        try {
+            $share = $this->shareManager->getShareByToken($token);
+        } catch (ShareNotFound $e) {
+            $this->emitAccessShareHook($token, 404, 'Share not found');
+            return new NotFoundResponse();
+        }
+
+        // Share is password protected - check whether the user is permitted to access the share
+        if ($share->getPassword() !== null && !$this->linkShareAuth($share)) {
+            return new RedirectResponse($this->urlGenerator->linkToRoute('files_sharing.sharecontroller.authenticate',
+                array('token' => $token, 'redirect' => 'preview')));
+        }
+
+        if (!$this->validateShare($share)) {
+            throw new NotFoundException();
+        }
+        // We can't get the path of a file share
+        try {
+            if ($share->getNode() instanceof \OCP\Files\File && $path !== '') {
+                $this->emitAccessShareHook($share, 404, 'Share not found');
+                throw new NotFoundException();
+            }
+        } catch (\Exception $e) {
+            $this->emitAccessShareHook($share, 404, 'Share not found');
+            throw $e;
+        }
+
+        $shareTmpl = [];
+        $shareTmpl['displayName'] = $this->userManager->get($share->getShareOwner())->getDisplayName();
+        $shareTmpl['owner'] = $share->getShareOwner();
+        $shareTmpl['filename'] = $share->getNode()->getName();
+        $shareTmpl['directory_path'] = $share->getTarget();
+        $shareTmpl['mimetype'] = $share->getNode()->getMimetype();
+        $shareTmpl['previewSupported'] = $this->previewManager->isMimeSupported($share->getNode()->getMimetype());
+        $shareTmpl['dirToken'] = $token;
+        $shareTmpl['sharingToken'] = $token;
+        $shareTmpl['server2serversharing'] = $this->federatedShareProvider->isOutgoingServer2serverShareEnabled();
+        $shareTmpl['protected'] = $share->getPassword() !== null ? 'true' : 'false';
+        $shareTmpl['dir'] = '';
+        $shareTmpl['nonHumanFileSize'] = $share->getNode()->getSize();
+        $shareTmpl['fileSize'] = \OCP\Util::humanFileSize($share->getNode()->getSize());
+
+        // Show file list
+        $hideFileList = false;
+        if ($share->getNode() instanceof \OCP\Files\Folder) {
+            /** @var \OCP\Files\Folder $rootFolder */
+            $rootFolder = $share->getNode();
+
+            try {
+                $folderNode = $rootFolder->get($path);
+            } catch (\OCP\Files\NotFoundException $e) {
+                $this->emitAccessShareHook($share, 404, 'Share not found');
+                throw new NotFoundException();
+            }
+
+            $shareTmpl['dir'] = $rootFolder->getRelativePath($folderNode->getPath());
+
+            /*
 			 * The OC_Util methods require a view. This just uses the node API
 			 */
-			$freeSpace = $share->getNode()->getStorage()->free_space($share->getNode()->getInternalPath());
-			if ($freeSpace < \OCP\Files\FileInfo::SPACE_UNLIMITED) {
-				$freeSpace = max($freeSpace, 0);
-			} else {
-				$freeSpace = (INF > 0) ? INF: PHP_INT_MAX; // work around https://bugs.php.net/bug.php?id=69188
-			}
-
-			$hideFileList = !($share->getPermissions() & \OCP\Constants::PERMISSION_READ);
-			$maxUploadFilesize = $freeSpace;
-
-			$folder = new Template('files', 'list', '');
-			$folder->assign('dir', $rootFolder->getRelativePath($folderNode->getPath()));
-			$folder->assign('dirToken', $token);
-			$folder->assign('permissions', \OCP\Constants::PERMISSION_READ);
-			$folder->assign('isPublic', true);
-			$folder->assign('hideFileList', $hideFileList);
-			$folder->assign('publicUploadEnabled', 'no');
-			$folder->assign('uploadMaxFilesize', $maxUploadFilesize);
-			$folder->assign('uploadMaxHumanFilesize', \OCP\Util::humanFileSize($maxUploadFilesize));
-			$folder->assign('freeSpace', $freeSpace);
-			$folder->assign('usedSpacePercent', 0);
-			$folder->assign('trash', false);
-			$shareTmpl['folder'] = $folder->fetchPage();
-		}
-
-		$shareTmpl['hideFileList'] = $hideFileList;
-		$shareTmpl['shareOwner'] = $this->userManager->get($share->getShareOwner())->getDisplayName();
-		$shareTmpl['downloadURL'] = $this->urlGenerator->linkToRouteAbsolute('files_sharing.sharecontroller.downloadShare', ['token' => $token]);
-		$shareTmpl['shareUrl'] = $this->urlGenerator->linkToRouteAbsolute('files_sharing.sharecontroller.showShare', ['token' => $token]);
-		$shareTmpl['maxSizeAnimateGif'] = $this->config->getSystemValue('max_filesize_animated_gifs_public_sharing', 10);
-		$shareTmpl['previewEnabled'] = $this->config->getSystemValue('enable_previews', true);
-		$shareTmpl['previewMaxX'] = $this->config->getSystemValue('preview_max_x', 1024);
-		$shareTmpl['previewMaxY'] = $this->config->getSystemValue('preview_max_y', 1024);
-		$shareTmpl['disclaimer'] = $this->config->getAppValue('core', 'shareapi_public_link_disclaimertext', null);
-		$shareTmpl['previewURL'] = $shareTmpl['downloadURL'];
-		$ogPreview = '';
-		if ($shareTmpl['previewSupported']) {
-			$shareTmpl['previewImage'] = $this->urlGenerator->linkToRouteAbsolute( 'files_sharing.PublicPreview.getPreview',
-				['x' => 200, 'y' => 200, 'file' => $shareTmpl['directory_path'], 't' => $shareTmpl['dirToken']]);
-			$ogPreview = $shareTmpl['previewImage'];
-
-			// We just have direct previews for image files
-			if ($share->getNode()->getMimePart() === 'image') {
-				$shareTmpl['previewURL'] = $this->urlGenerator->linkToRouteAbsolute('files_sharing.publicpreview.directLink', ['token' => $token]);
-
-				$ogPreview = $shareTmpl['previewURL'];
-
-				//Whatapp is kind of picky about their size requirements
-				if ($this->request->isUserAgent(['/^WhatsApp/'])) {
-					$ogPreview = $this->urlGenerator->linkToRouteAbsolute('files_sharing.PublicPreview.getPreview', [
-						't' => $token,
-						'x' => 256,
-						'y' => 256,
-						'a' => true,
-					]);
-				}
-			}
-		} else {
-			$shareTmpl['previewImage'] = $this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'favicon-fb.png'));
-			$ogPreview = $shareTmpl['previewImage'];
-		}
-
-		// Load files we need
-		\OCP\Util::addScript('files', 'file-upload');
-		\OCP\Util::addStyle('files_sharing', 'publicView');
-		\OCP\Util::addScript('files_sharing', 'public');
-		\OCP\Util::addScript('files', 'fileactions');
-		\OCP\Util::addScript('files', 'fileactionsmenu');
-		\OCP\Util::addScript('files', 'jquery.fileupload');
-		\OCP\Util::addScript('files_sharing', 'files_drop');
-
-		if (isset($shareTmpl['folder'])) {
-			// JS required for folders
-			\OCP\Util::addStyle('files', 'merged');
-			\OCP\Util::addScript('files', 'filesummary');
-			\OCP\Util::addScript('files', 'breadcrumb');
-			\OCP\Util::addScript('files', 'fileinfomodel');
-			\OCP\Util::addScript('files', 'newfilemenu');
-			\OCP\Util::addScript('files', 'files');
-			\OCP\Util::addScript('files', 'filelist');
-			\OCP\Util::addScript('files', 'keyboardshortcuts');
-		}
-
-		// OpenGraph Support: http://ogp.me/
-		\OCP\Util::addHeader('meta', ['property' => "og:title", 'content' => $shareTmpl['filename']]);
-		\OCP\Util::addHeader('meta', ['property' => "og:description", 'content' => $this->defaults->getName() . ($this->defaults->getSlogan() !== '' ? ' - ' . $this->defaults->getSlogan() : '')]);
-		\OCP\Util::addHeader('meta', ['property' => "og:site_name", 'content' => $this->defaults->getName()]);
-		\OCP\Util::addHeader('meta', ['property' => "og:url", 'content' => $shareTmpl['shareUrl']]);
-		\OCP\Util::addHeader('meta', ['property' => "og:type", 'content' => "object"]);
-		\OCP\Util::addHeader('meta', ['property' => "og:image", 'content' => $ogPreview]);
-
-		$this->eventDispatcher->dispatch('OCA\Files_Sharing::loadAdditionalScripts');
-
-		$csp = new \OCP\AppFramework\Http\ContentSecurityPolicy();
-		$csp->addAllowedFrameDomain('\'self\'');
-
-		$response = new PublicTemplateResponse($this->appName, 'public', $shareTmpl);
-		$response->setHeaderTitle($shareTmpl['filename']);
-		$response->setHeaderDetails($this->l10n->t('shared by %s', [$shareTmpl['displayName']]));
-		$response->setHeaderActions([
-			new SimpleMenuAction('download', $this->l10n->t('Download'), 'icon-download-white', $shareTmpl['downloadURL'], 0),
-			new SimpleMenuAction('download', $this->l10n->t('Download'), 'icon-download', $shareTmpl['downloadURL'], 10, $shareTmpl['fileSize']),
-			new LinkMenuAction($this->l10n->t('Direct link'), 'icon-public', $shareTmpl['previewURL']),
-			new ExternalShareMenuAction($this->l10n->t('Add to your Nextcloud'), 'icon-external', $shareTmpl['owner'], $shareTmpl['displayName'], $shareTmpl['filename']),
-		]);
-
-		$response->setContentSecurityPolicy($csp);
-
-		$this->emitAccessShareHook($share);
-
-		return $response;
-	}
-
-	/**
-	 * @PublicPage
-	 * @NoCSRFRequired
-	 *
-	 * @param string $token
-	 * @param string $files
-	 * @param string $path
-	 * @param string $downloadStartSecret
-	 * @return void|\OCP\AppFramework\Http\Response
-	 * @throws NotFoundException
-	 */
-	public function downloadShare($token, $files = null, $path = '', $downloadStartSecret = '') {
-		\OC_User::setIncognitoMode(true);
-
-		$share = $this->shareManager->getShareByToken($token);
-
-		if(!($share->getPermissions() & \OCP\Constants::PERMISSION_READ)) {
-			return new \OCP\AppFramework\Http\DataResponse('Share is read-only');
-		}
-
-		// Share is password protected - check whether the user is permitted to access the share
-		if ($share->getPassword() !== null && !$this->linkShareAuth($share)) {
-			return new RedirectResponse($this->urlGenerator->linkToRoute('files_sharing.sharecontroller.authenticate',
-				['token' => $token, 'redirect' => 'download']));
-		}
-
-		$files_list = null;
-		if (!is_null($files)) { // download selected files
-			$files_list = json_decode($files);
-			// in case we get only a single file
-			if ($files_list === null) {
-				$files_list = [$files];
-			}
-			// Just in case $files is a single int like '1234'
-			if (!is_array($files_list)) {
-				$files_list = [$files_list];
-			}
-		}
-
-		$userFolder = $this->rootFolder->getUserFolder($share->getShareOwner());
-		$originalSharePath = $userFolder->getRelativePath($share->getNode()->getPath());
-
-		if (!$this->validateShare($share)) {
-			throw new NotFoundException();
-		}
-
-		// Single file share
-		if ($share->getNode() instanceof \OCP\Files\File) {
-			// Single file download
-			$this->singleFileDownloaded($share, $share->getNode());
-		}
-		// Directory share
-		else {
-			/** @var \OCP\Files\Folder $node */
-			$node = $share->getNode();
-
-			// Try to get the path
-			if ($path !== '') {
-				try {
-					$node = $node->get($path);
-				} catch (NotFoundException $e) {
-					$this->emitAccessShareHook($share, 404, 'Share not found');
-					return new NotFoundResponse();
-				}
-			}
-
-			$originalSharePath = $userFolder->getRelativePath($node->getPath());
-
-			if ($node instanceof \OCP\Files\File) {
-				// Single file download
-				$this->singleFileDownloaded($share, $share->getNode());
-			} else if (!empty($files_list)) {
-				$this->fileListDownloaded($share, $files_list, $node);
-			} else {
-				// The folder is downloaded
-				$this->singleFileDownloaded($share, $share->getNode());
-			}
-		}
-
-		/* FIXME: We should do this all nicely in OCP */
-		OC_Util::tearDownFS();
-		OC_Util::setupFS($share->getShareOwner());
-
-		/**
-		 * this sets a cookie to be able to recognize the start of the download
-		 * the content must not be longer than 32 characters and must only contain
-		 * alphanumeric characters
-		 */
-		if (!empty($downloadStartSecret)
-			&& !isset($downloadStartSecret[32])
-			&& preg_match('!^[a-zA-Z0-9]+$!', $downloadStartSecret) === 1) {
-
-			// FIXME: set on the response once we use an actual app framework response
-			setcookie('ocDownloadStarted', $downloadStartSecret, time() + 20, '/');
-		}
-
-		$this->emitAccessShareHook($share);
-
-		$server_params = array( 'head' => $this->request->getMethod() === 'HEAD' );
-
-		/**
-		 * Http range requests support
-		 */
-		if (isset($_SERVER['HTTP_RANGE'])) {
-			$server_params['range'] = $this->request->getHeader('Range');
-		}
-
-		// download selected files
-		if (!is_null($files) && $files !== '') {
-			// FIXME: The exit is required here because otherwise the AppFramework is trying to add headers as well
-			// after dispatching the request which results in a "Cannot modify header information" notice.
-			OC_Files::get($originalSharePath, $files_list, $server_params);
-			exit();
-		} else {
-			// FIXME: The exit is required here because otherwise the AppFramework is trying to add headers as well
-			// after dispatching the request which results in a "Cannot modify header information" notice.
-			OC_Files::get(dirname($originalSharePath), basename($originalSharePath), $server_params);
-			exit();
-		}
-	}
-
-	/**
-	 * create activity for every downloaded file
-	 *
-	 * @param Share\IShare $share
-	 * @param array $files_list
-	 * @param \OCP\Files\Folder $node
-	 */
-	protected function fileListDownloaded(Share\IShare $share, array $files_list, \OCP\Files\Folder $node) {
-		foreach ($files_list as $file) {
-			$subNode = $node->get($file);
-			$this->singleFileDownloaded($share, $subNode);
-		}
-
-	}
-
-	/**
-	 * create activity if a single file was downloaded from a link share
-	 *
-	 * @param Share\IShare $share
-	 */
-	protected function singleFileDownloaded(Share\IShare $share, \OCP\Files\Node $node) {
-
-		$fileId = $node->getId();
-
-		$userFolder = $this->rootFolder->getUserFolder($share->getSharedBy());
-		$userNodeList = $userFolder->getById($fileId);
-		$userNode = $userNodeList[0];
-		$ownerFolder = $this->rootFolder->getUserFolder($share->getShareOwner());
-		$userPath = $userFolder->getRelativePath($userNode->getPath());
-		$ownerPath = $ownerFolder->getRelativePath($node->getPath());
-
-		$parameters = [$userPath];
-
-		if ($share->getShareType() === \OCP\Share::SHARE_TYPE_EMAIL) {
-			if ($node instanceof \OCP\Files\File) {
-				$subject = Downloads::SUBJECT_SHARED_FILE_BY_EMAIL_DOWNLOADED;
-			} else {
-				$subject = Downloads::SUBJECT_SHARED_FOLDER_BY_EMAIL_DOWNLOADED;
-			}
-			$parameters[] = $share->getSharedWith();
-		} else {
-			if ($node instanceof \OCP\Files\File) {
-				$subject = Downloads::SUBJECT_PUBLIC_SHARED_FILE_DOWNLOADED;
-			} else {
-				$subject = Downloads::SUBJECT_PUBLIC_SHARED_FOLDER_DOWNLOADED;
-			}
-		}
-
-		$this->publishActivity($subject, $parameters, $share->getSharedBy(), $fileId, $userPath);
-
-		if ($share->getShareOwner() !== $share->getSharedBy()) {
-			$parameters[0] = $ownerPath;
-			$this->publishActivity($subject, $parameters, $share->getShareOwner(), $fileId, $ownerPath);
-		}
-	}
-
-	/**
-	 * publish activity
-	 *
-	 * @param string $subject
-	 * @param array $parameters
-	 * @param string $affectedUser
-	 * @param int $fileId
-	 * @param string $filePath
-	 */
-	protected function publishActivity($subject,
-										array $parameters,
-										$affectedUser,
-										$fileId,
-										$filePath) {
-
-		$event = $this->activityManager->generateEvent();
-		$event->setApp('files_sharing')
-			->setType('public_links')
-			->setSubject($subject, $parameters)
-			->setAffectedUser($affectedUser)
-			->setObject('files', $fileId, $filePath);
-		$this->activityManager->publish($event);
-	}
+            $freeSpace = $share->getNode()->getStorage()->free_space($share->getNode()->getInternalPath());
+            if ($freeSpace < \OCP\Files\FileInfo::SPACE_UNLIMITED) {
+                $freeSpace = max($freeSpace, 0);
+            } else {
+                $freeSpace = (INF > 0) ? INF: PHP_INT_MAX; // work around https://bugs.php.net/bug.php?id=69188
+            }
+
+            $hideFileList = !($share->getPermissions() & \OCP\Constants::PERMISSION_READ);
+            $maxUploadFilesize = $freeSpace;
+
+            $folder = new Template('files', 'list', '');
+            $folder->assign('dir', $rootFolder->getRelativePath($folderNode->getPath()));
+            $folder->assign('dirToken', $token);
+            $folder->assign('permissions', \OCP\Constants::PERMISSION_READ);
+            $folder->assign('isPublic', true);
+            $folder->assign('hideFileList', $hideFileList);
+            $folder->assign('publicUploadEnabled', 'no');
+            $folder->assign('uploadMaxFilesize', $maxUploadFilesize);
+            $folder->assign('uploadMaxHumanFilesize', \OCP\Util::humanFileSize($maxUploadFilesize));
+            $folder->assign('freeSpace', $freeSpace);
+            $folder->assign('usedSpacePercent', 0);
+            $folder->assign('trash', false);
+            $shareTmpl['folder'] = $folder->fetchPage();
+        }
+
+        $shareTmpl['hideFileList'] = $hideFileList;
+        $shareTmpl['shareOwner'] = $this->userManager->get($share->getShareOwner())->getDisplayName();
+        $shareTmpl['downloadURL'] = $this->urlGenerator->linkToRouteAbsolute('files_sharing.sharecontroller.downloadShare', ['token' => $token]);
+        $shareTmpl['shareUrl'] = $this->urlGenerator->linkToRouteAbsolute('files_sharing.sharecontroller.showShare', ['token' => $token]);
+        $shareTmpl['maxSizeAnimateGif'] = $this->config->getSystemValue('max_filesize_animated_gifs_public_sharing', 10);
+        $shareTmpl['previewEnabled'] = $this->config->getSystemValue('enable_previews', true);
+        $shareTmpl['previewMaxX'] = $this->config->getSystemValue('preview_max_x', 1024);
+        $shareTmpl['previewMaxY'] = $this->config->getSystemValue('preview_max_y', 1024);
+        $shareTmpl['disclaimer'] = $this->config->getAppValue('core', 'shareapi_public_link_disclaimertext', null);
+        $shareTmpl['previewURL'] = $shareTmpl['downloadURL'];
+        $ogPreview = '';
+        if ($shareTmpl['previewSupported']) {
+            $shareTmpl['previewImage'] = $this->urlGenerator->linkToRouteAbsolute( 'files_sharing.PublicPreview.getPreview',
+                ['x' => 200, 'y' => 200, 'file' => $shareTmpl['directory_path'], 't' => $shareTmpl['dirToken']]);
+            $ogPreview = $shareTmpl['previewImage'];
+
+            // We just have direct previews for image files
+            if ($share->getNode()->getMimePart() === 'image') {
+                $shareTmpl['previewURL'] = $this->urlGenerator->linkToRouteAbsolute('files_sharing.publicpreview.directLink', ['token' => $token]);
+
+                $ogPreview = $shareTmpl['previewURL'];
+
+                //Whatapp is kind of picky about their size requirements
+                if ($this->request->isUserAgent(['/^WhatsApp/'])) {
+                    $ogPreview = $this->urlGenerator->linkToRouteAbsolute('files_sharing.PublicPreview.getPreview', [
+                        't' => $token,
+                        'x' => 256,
+                        'y' => 256,
+                        'a' => true,
+                    ]);
+                }
+            }
+        } else {
+            $shareTmpl['previewImage'] = $this->urlGenerator->getAbsoluteURL($this->urlGenerator->imagePath('core', 'favicon-fb.png'));
+            $ogPreview = $shareTmpl['previewImage'];
+        }
+
+        // Load files we need
+        \OCP\Util::addScript('files', 'file-upload');
+        \OCP\Util::addStyle('files_sharing', 'publicView');
+        \OCP\Util::addScript('files_sharing', 'public');
+        \OCP\Util::addScript('files', 'fileactions');
+        \OCP\Util::addScript('files', 'fileactionsmenu');
+        \OCP\Util::addScript('files', 'jquery.fileupload');
+        \OCP\Util::addScript('files_sharing', 'files_drop');
+
+        if (isset($shareTmpl['folder'])) {
+            // JS required for folders
+            \OCP\Util::addStyle('files', 'merged');
+            \OCP\Util::addScript('files', 'filesummary');
+            \OCP\Util::addScript('files', 'breadcrumb');
+            \OCP\Util::addScript('files', 'fileinfomodel');
+            \OCP\Util::addScript('files', 'newfilemenu');
+            \OCP\Util::addScript('files', 'files');
+            \OCP\Util::addScript('files', 'filelist');
+            \OCP\Util::addScript('files', 'keyboardshortcuts');
+        }
+
+        // OpenGraph Support: http://ogp.me/
+        \OCP\Util::addHeader('meta', ['property' => "og:title", 'content' => $shareTmpl['filename']]);
+        \OCP\Util::addHeader('meta', ['property' => "og:description", 'content' => $this->defaults->getName() . ($this->defaults->getSlogan() !== '' ? ' - ' . $this->defaults->getSlogan() : '')]);
+        \OCP\Util::addHeader('meta', ['property' => "og:site_name", 'content' => $this->defaults->getName()]);
+        \OCP\Util::addHeader('meta', ['property' => "og:url", 'content' => $shareTmpl['shareUrl']]);
+        \OCP\Util::addHeader('meta', ['property' => "og:type", 'content' => "object"]);
+        \OCP\Util::addHeader('meta', ['property' => "og:image", 'content' => $ogPreview]);
+
+        $this->eventDispatcher->dispatch('OCA\Files_Sharing::loadAdditionalScripts');
+
+        $csp = new \OCP\AppFramework\Http\ContentSecurityPolicy();
+        $csp->addAllowedFrameDomain('\'self\'');
+
+        $response = new PublicTemplateResponse($this->appName, 'public', $shareTmpl);
+        $response->setHeaderTitle($shareTmpl['filename']);
+        $response->setHeaderDetails($this->l10n->t('shared by %s', [$shareTmpl['displayName']]));
+        $response->setHeaderActions([
+            new SimpleMenuAction('download', $this->l10n->t('Download'), 'icon-download-white', $shareTmpl['downloadURL'], 0),
+            new SimpleMenuAction('download', $this->l10n->t('Download'), 'icon-download', $shareTmpl['downloadURL'], 10, $shareTmpl['fileSize']),
+            new LinkMenuAction($this->l10n->t('Direct link'), 'icon-public', $shareTmpl['previewURL']),
+            new ExternalShareMenuAction($this->l10n->t('Add to your Nextcloud'), 'icon-external', $shareTmpl['owner'], $shareTmpl['displayName'], $shareTmpl['filename']),
+        ]);
+
+        $response->setContentSecurityPolicy($csp);
+
+        $this->emitAccessShareHook($share);
+
+        return $response;
+    }
+
+    /**
+     * @PublicPage
+     * @NoCSRFRequired
+     *
+     * @param string $token
+     * @param string $files
+     * @param string $path
+     * @param string $downloadStartSecret
+     * @return void|\OCP\AppFramework\Http\Response
+     * @throws NotFoundException
+     */
+    public function downloadShare($token, $files = null, $path = '', $downloadStartSecret = '') {
+        \OC_User::setIncognitoMode(true);
+
+        $share = $this->shareManager->getShareByToken($token);
+
+        if(!($share->getPermissions() & \OCP\Constants::PERMISSION_READ)) {
+            return new \OCP\AppFramework\Http\DataResponse('Share is read-only');
+        }
+
+        // Share is password protected - check whether the user is permitted to access the share
+        if ($share->getPassword() !== null && !$this->linkShareAuth($share)) {
+            return new RedirectResponse($this->urlGenerator->linkToRoute('files_sharing.sharecontroller.authenticate',
+                ['token' => $token, 'redirect' => 'download']));
+        }
+
+        $files_list = null;
+        if (!is_null($files)) { // download selected files
+            $files_list = json_decode($files);
+            // in case we get only a single file
+            if ($files_list === null) {
+                $files_list = [$files];
+            }
+            // Just in case $files is a single int like '1234'
+            if (!is_array($files_list)) {
+                $files_list = [$files_list];
+            }
+        }
+
+        $userFolder = $this->rootFolder->getUserFolder($share->getShareOwner());
+        $originalSharePath = $userFolder->getRelativePath($share->getNode()->getPath());
+
+        if (!$this->validateShare($share)) {
+            throw new NotFoundException();
+        }
+
+        // Single file share
+        if ($share->getNode() instanceof \OCP\Files\File) {
+            // Single file download
+            $this->singleFileDownloaded($share, $share->getNode());
+        }
+        // Directory share
+        else {
+            /** @var \OCP\Files\Folder $node */
+            $node = $share->getNode();
+
+            // Try to get the path
+            if ($path !== '') {
+                try {
+                    $node = $node->get($path);
+                } catch (NotFoundException $e) {
+                    $this->emitAccessShareHook($share, 404, 'Share not found');
+                    return new NotFoundResponse();
+                }
+            }
+
+            $originalSharePath = $userFolder->getRelativePath($node->getPath());
+
+            if ($node instanceof \OCP\Files\File) {
+                // Single file download
+                $this->singleFileDownloaded($share, $share->getNode());
+            } else if (!empty($files_list)) {
+                $this->fileListDownloaded($share, $files_list, $node);
+            } else {
+                // The folder is downloaded
+                $this->singleFileDownloaded($share, $share->getNode());
+            }
+        }
+
+        /* FIXME: We should do this all nicely in OCP */
+        OC_Util::tearDownFS();
+        OC_Util::setupFS($share->getShareOwner());
+
+        /**
+         * this sets a cookie to be able to recognize the start of the download
+         * the content must not be longer than 32 characters and must only contain
+         * alphanumeric characters
+         */
+        if (!empty($downloadStartSecret)
+            && !isset($downloadStartSecret[32])
+            && preg_match('!^[a-zA-Z0-9]+$!', $downloadStartSecret) === 1) {
+
+            // FIXME: set on the response once we use an actual app framework response
+            setcookie('ocDownloadStarted', $downloadStartSecret, time() + 20, '/');
+        }
+
+        $this->emitAccessShareHook($share);
+
+        $server_params = array( 'head' => $this->request->getMethod() === 'HEAD' );
+
+        /**
+         * Http range requests support
+         */
+        if (isset($_SERVER['HTTP_RANGE'])) {
+            $server_params['range'] = $this->request->getHeader('Range');
+        }
+
+        // download selected files
+        if (!is_null($files) && $files !== '') {
+            // FIXME: The exit is required here because otherwise the AppFramework is trying to add headers as well
+            // after dispatching the request which results in a "Cannot modify header information" notice.
+            OC_Files::get($originalSharePath, $files_list, $server_params);
+            exit();
+        } else {
+            // FIXME: The exit is required here because otherwise the AppFramework is trying to add headers as well
+            // after dispatching the request which results in a "Cannot modify header information" notice.
+            OC_Files::get(dirname($originalSharePath), basename($originalSharePath), $server_params);
+            exit();
+        }
+    }
+
+    /**
+     * create activity for every downloaded file
+     *
+     * @param Share\IShare $share
+     * @param array $files_list
+     * @param \OCP\Files\Folder $node
+     */
+    protected function fileListDownloaded(Share\IShare $share, array $files_list, \OCP\Files\Folder $node) {
+        foreach ($files_list as $file) {
+            $subNode = $node->get($file);
+            $this->singleFileDownloaded($share, $subNode);
+        }
+
+    }
+
+    /**
+     * create activity if a single file was downloaded from a link share
+     *
+     * @param Share\IShare $share
+     */
+    protected function singleFileDownloaded(Share\IShare $share, \OCP\Files\Node $node) {
+
+        $fileId = $node->getId();
+
+        $userFolder = $this->rootFolder->getUserFolder($share->getSharedBy());
+        $userNodeList = $userFolder->getById($fileId);
+        $userNode = $userNodeList[0];
+        $ownerFolder = $this->rootFolder->getUserFolder($share->getShareOwner());
+        $userPath = $userFolder->getRelativePath($userNode->getPath());
+        $ownerPath = $ownerFolder->getRelativePath($node->getPath());
+
+        $parameters = [$userPath];
+
+        if ($share->getShareType() === \OCP\Share::SHARE_TYPE_EMAIL) {
+            if ($node instanceof \OCP\Files\File) {
+                $subject = Downloads::SUBJECT_SHARED_FILE_BY_EMAIL_DOWNLOADED;
+            } else {
+                $subject = Downloads::SUBJECT_SHARED_FOLDER_BY_EMAIL_DOWNLOADED;
+            }
+            $parameters[] = $share->getSharedWith();
+        } else {
+            if ($node instanceof \OCP\Files\File) {
+                $subject = Downloads::SUBJECT_PUBLIC_SHARED_FILE_DOWNLOADED;
+            } else {
+                $subject = Downloads::SUBJECT_PUBLIC_SHARED_FOLDER_DOWNLOADED;
+            }
+        }
+
+        $this->publishActivity($subject, $parameters, $share->getSharedBy(), $fileId, $userPath);
+
+        if ($share->getShareOwner() !== $share->getSharedBy()) {
+            $parameters[0] = $ownerPath;
+            $this->publishActivity($subject, $parameters, $share->getShareOwner(), $fileId, $ownerPath);
+        }
+    }
+
+    /**
+     * publish activity
+     *
+     * @param string $subject
+     * @param array $parameters
+     * @param string $affectedUser
+     * @param int $fileId
+     * @param string $filePath
+     */
+    protected function publishActivity($subject,
+                                        array $parameters,
+                                        $affectedUser,
+                                        $fileId,
+                                        $filePath) {
+
+        $event = $this->activityManager->generateEvent();
+        $event->setApp('files_sharing')
+            ->setType('public_links')
+            ->setSubject($subject, $parameters)
+            ->setAffectedUser($affectedUser)
+            ->setObject('files', $fileId, $filePath);
+        $this->activityManager->publish($event);
+    }
 
 
 }

Spacing +10 added lines, -10 removed lines

@@ -156,7 +156,7 @@ 
 	public function showAuthenticate($token) {
 		$share = $this->shareManager->getShareByToken($token);
 
-		if($this->linkShareAuth($share)) {
+		if ($this->linkShareAuth($share)) {
 			return new RedirectResponse($this->urlGenerator->linkToRoute('files_sharing.sharecontroller.showShare', array('token' => $token)));
 		}
 
@@ -218,15 +218,15 @@ 
 		if ($password !== null) {
 			if ($this->shareManager->checkPassword($share, $password)) {
 				$this->session->regenerateId(true, true);
-				$this->session->set('public_link_authenticated', (string)$share->getId());
+				$this->session->set('public_link_authenticated', (string) $share->getId());
 			} else {
 				$this->emitAccessShareHook($share, 403, 'Wrong password');
 				return false;
 			}
 		} else {
 			// not authenticated ?
-			if ( ! $this->session->exists('public_link_authenticated')
-				|| $this->session->get('public_link_authenticated') !== (string)$share->getId()) {
+			if (!$this->session->exists('public_link_authenticated')
+				|| $this->session->get('public_link_authenticated') !== (string) $share->getId()) {
 				return false;
 			}
 		}
@@ -247,7 +247,7 @@ 
 		$itemType = $itemSource = $uidOwner = '';
 		$token = $share;
 		$exception = null;
-		if($share instanceof \OCP\Share\IShare) {
+		if ($share instanceof \OCP\Share\IShare) {
 			try {
 				$token = $share->getToken();
 				$uidOwner = $share->getSharedBy();
@@ -266,7 +266,7 @@ 
 			'errorCode' => $errorCode,
 			'errorMessage' => $errorMessage,
 		]);
-		if(!is_null($exception)) {
+		if (!is_null($exception)) {
 			throw $exception;
 		}
 	}
@@ -392,7 +392,7 @@ 
 		$shareTmpl['previewURL'] = $shareTmpl['downloadURL'];
 		$ogPreview = '';
 		if ($shareTmpl['previewSupported']) {
-			$shareTmpl['previewImage'] = $this->urlGenerator->linkToRouteAbsolute( 'files_sharing.PublicPreview.getPreview',
+			$shareTmpl['previewImage'] = $this->urlGenerator->linkToRouteAbsolute('files_sharing.PublicPreview.getPreview',
 				['x' => 200, 'y' => 200, 'file' => $shareTmpl['directory_path'], 't' => $shareTmpl['dirToken']]);
 			$ogPreview = $shareTmpl['previewImage'];
 
@@ -440,7 +440,7 @@ 
 
 		// OpenGraph Support: http://ogp.me/
 		\OCP\Util::addHeader('meta', ['property' => "og:title", 'content' => $shareTmpl['filename']]);
-		\OCP\Util::addHeader('meta', ['property' => "og:description", 'content' => $this->defaults->getName() . ($this->defaults->getSlogan() !== '' ? ' - ' . $this->defaults->getSlogan() : '')]);
+		\OCP\Util::addHeader('meta', ['property' => "og:description", 'content' => $this->defaults->getName().($this->defaults->getSlogan() !== '' ? ' - '.$this->defaults->getSlogan() : '')]);
 		\OCP\Util::addHeader('meta', ['property' => "og:site_name", 'content' => $this->defaults->getName()]);
 		\OCP\Util::addHeader('meta', ['property' => "og:url", 'content' => $shareTmpl['shareUrl']]);
 		\OCP\Util::addHeader('meta', ['property' => "og:type", 'content' => "object"]);
@@ -484,7 +484,7 @@ 
 
 		$share = $this->shareManager->getShareByToken($token);
 
-		if(!($share->getPermissions() & \OCP\Constants::PERMISSION_READ)) {
+		if (!($share->getPermissions() & \OCP\Constants::PERMISSION_READ)) {
 			return new \OCP\AppFramework\Http\DataResponse('Share is read-only');
 		}
 
@@ -566,7 +566,7 @@ 
 
 		$this->emitAccessShareHook($share);
 
-		$server_params = array( 'head' => $this->request->getMethod() === 'HEAD' );
+		$server_params = array('head' => $this->request->getMethod() === 'HEAD');
 
 		/**
 		 * Http range requests support

lib/private/Session/Internal.php

Unused Use Statements -2 removed lines

@@ -32,8 +32,6 @@
 
 use OC\Authentication\Exceptions\InvalidTokenException;
 use OC\Authentication\Token\IProvider;
-use OC\SystemConfig;
-use OCP\IConfig;
 use OCP\Session\Exceptions\SessionNotAvailableException;
 
 /**

Indentation +166 added lines, -166 removed lines

@@ -44,170 +44,170 @@
  * @package OC\Session
  */
 class Internal extends Session {
-	/**
-	 * @param string $name
-	 * @throws \Exception
-	 */
-	public function __construct(string $name) {
-		set_error_handler([$this, 'trapError']);
-		$this->invoke('session_name', [$name]);
-		try {
-			$this->invoke('session_start');
-		} catch (\Exception $e) {
-			setcookie($this->invoke('session_name'), null, -1, \OC::$WEBROOT ?: '/');
-		}
-		restore_error_handler();
-		if (!isset($_SESSION)) {
-			throw new \Exception('Failed to start session');
-		}
-	}
-
-	/**
-	 * @param string $key
-	 * @param integer $value
-	 */
-	public function set(string $key, $value) {
-		$this->validateSession();
-		$_SESSION[$key] = $value;
-	}
-
-	/**
-	 * @param string $key
-	 * @return mixed
-	 */
-	public function get(string $key) {
-		if (!$this->exists($key)) {
-			return null;
-		}
-		return $_SESSION[$key];
-	}
-
-	/**
-	 * @param string $key
-	 * @return bool
-	 */
-	public function exists(string $key): bool {
-		return isset($_SESSION[$key]);
-	}
-
-	/**
-	 * @param string $key
-	 */
-	public function remove(string $key) {
-		if (isset($_SESSION[$key])) {
-			unset($_SESSION[$key]);
-		}
-	}
-
-	public function clear() {
-		$this->invoke('session_unset');
-		$this->regenerateId();
-		$this->invoke('session_start', [], true);
-		$_SESSION = [];
-	}
-
-	public function close() {
-		$this->invoke('session_write_close');
-		parent::close();
-	}
-
-	/**
-	 * Wrapper around session_regenerate_id
-	 *
-	 * @param bool $deleteOldSession Whether to delete the old associated session file or not.
-	 * @param bool $updateToken Wheater to update the associated auth token
-	 * @return void
-	 */
-	public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {
-		$oldId = null;
-
-		if ($updateToken) {
-			// Get the old id to update the token
-			try {
-				$oldId = $this->getId();
-			} catch (SessionNotAvailableException $e) {
-				// We can't update a token if there is no previous id
-				$updateToken = false;
-			}
-		}
-
-		try {
-			@session_regenerate_id($deleteOldSession);
-		} catch (\Error $e) {
-			$this->trapError($e->getCode(), $e->getMessage());
-		}
-
-		if ($updateToken) {
-			// Get the new id to update the token
-			$newId = $this->getId();
-
-			/** @var IProvider $tokenProvider */
-			$tokenProvider = \OC::$server->query(IProvider::class);
-
-			try {
-				$tokenProvider->renewSessionToken($oldId, $newId);
-			} catch (InvalidTokenException $e) {
-				// Just ignore
-			}
-		}
-	}
-
-	/**
-	 * Wrapper around session_id
-	 *
-	 * @return string
-	 * @throws SessionNotAvailableException
-	 * @since 9.1.0
-	 */
-	public function getId(): string {
-		$id = $this->invoke('session_id', [], true);
-		if ($id === '') {
-			throw new SessionNotAvailableException();
-		}
-		return $id;
-	}
-
-	/**
-	 * @throws \Exception
-	 */
-	public function reopen() {
-		throw new \Exception('The session cannot be reopened - reopen() is ony to be used in unit testing.');
-	}
-
-	/**
-	 * @param int $errorNumber
-	 * @param string $errorString
-	 * @throws \ErrorException
-	 */
-	public function trapError(int $errorNumber, string $errorString) {
-		throw new \ErrorException($errorString);
-	}
-
-	/**
-	 * @throws \Exception
-	 */
-	private function validateSession() {
-		if ($this->sessionClosed) {
-			throw new SessionNotAvailableException('Session has been closed - no further changes to the session are allowed');
-		}
-	}
-
-	/**
-	 * @param string $functionName the full session_* function name
-	 * @param array $parameters
-	 * @param bool $silence whether to suppress warnings
-	 * @throws \ErrorException via trapError
-	 * @return mixed
-	 */
-	private function invoke(string $functionName, array $parameters = [], bool $silence = false) {
-		try {
-			if($silence) {
-				return @call_user_func_array($functionName, $parameters);
-			} else {
-				return call_user_func_array($functionName, $parameters);
-			}
-		} catch(\Error $e) {
-			$this->trapError($e->getCode(), $e->getMessage());
-		}
-	}
+    /**
+     * @param string $name
+     * @throws \Exception
+     */
+    public function __construct(string $name) {
+        set_error_handler([$this, 'trapError']);
+        $this->invoke('session_name', [$name]);
+        try {
+            $this->invoke('session_start');
+        } catch (\Exception $e) {
+            setcookie($this->invoke('session_name'), null, -1, \OC::$WEBROOT ?: '/');
+        }
+        restore_error_handler();
+        if (!isset($_SESSION)) {
+            throw new \Exception('Failed to start session');
+        }
+    }
+
+    /**
+     * @param string $key
+     * @param integer $value
+     */
+    public function set(string $key, $value) {
+        $this->validateSession();
+        $_SESSION[$key] = $value;
+    }
+
+    /**
+     * @param string $key
+     * @return mixed
+     */
+    public function get(string $key) {
+        if (!$this->exists($key)) {
+            return null;
+        }
+        return $_SESSION[$key];
+    }
+
+    /**
+     * @param string $key
+     * @return bool
+     */
+    public function exists(string $key): bool {
+        return isset($_SESSION[$key]);
+    }
+
+    /**
+     * @param string $key
+     */
+    public function remove(string $key) {
+        if (isset($_SESSION[$key])) {
+            unset($_SESSION[$key]);
+        }
+    }
+
+    public function clear() {
+        $this->invoke('session_unset');
+        $this->regenerateId();
+        $this->invoke('session_start', [], true);
+        $_SESSION = [];
+    }
+
+    public function close() {
+        $this->invoke('session_write_close');
+        parent::close();
+    }
+
+    /**
+     * Wrapper around session_regenerate_id
+     *
+     * @param bool $deleteOldSession Whether to delete the old associated session file or not.
+     * @param bool $updateToken Wheater to update the associated auth token
+     * @return void
+     */
+    public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false) {
+        $oldId = null;
+
+        if ($updateToken) {
+            // Get the old id to update the token
+            try {
+                $oldId = $this->getId();
+            } catch (SessionNotAvailableException $e) {
+                // We can't update a token if there is no previous id
+                $updateToken = false;
+            }
+        }
+
+        try {
+            @session_regenerate_id($deleteOldSession);
+        } catch (\Error $e) {
+            $this->trapError($e->getCode(), $e->getMessage());
+        }
+
+        if ($updateToken) {
+            // Get the new id to update the token
+            $newId = $this->getId();
+
+            /** @var IProvider $tokenProvider */
+            $tokenProvider = \OC::$server->query(IProvider::class);
+
+            try {
+                $tokenProvider->renewSessionToken($oldId, $newId);
+            } catch (InvalidTokenException $e) {
+                // Just ignore
+            }
+        }
+    }
+
+    /**
+     * Wrapper around session_id
+     *
+     * @return string
+     * @throws SessionNotAvailableException
+     * @since 9.1.0
+     */
+    public function getId(): string {
+        $id = $this->invoke('session_id', [], true);
+        if ($id === '') {
+            throw new SessionNotAvailableException();
+        }
+        return $id;
+    }
+
+    /**
+     * @throws \Exception
+     */
+    public function reopen() {
+        throw new \Exception('The session cannot be reopened - reopen() is ony to be used in unit testing.');
+    }
+
+    /**
+     * @param int $errorNumber
+     * @param string $errorString
+     * @throws \ErrorException
+     */
+    public function trapError(int $errorNumber, string $errorString) {
+        throw new \ErrorException($errorString);
+    }
+
+    /**
+     * @throws \Exception
+     */
+    private function validateSession() {
+        if ($this->sessionClosed) {
+            throw new SessionNotAvailableException('Session has been closed - no further changes to the session are allowed');
+        }
+    }
+
+    /**
+     * @param string $functionName the full session_* function name
+     * @param array $parameters
+     * @param bool $silence whether to suppress warnings
+     * @throws \ErrorException via trapError
+     * @return mixed
+     */
+    private function invoke(string $functionName, array $parameters = [], bool $silence = false) {
+        try {
+            if($silence) {
+                return @call_user_func_array($functionName, $parameters);
+            } else {
+                return call_user_func_array($functionName, $parameters);
+            }
+        } catch(\Error $e) {
+            $this->trapError($e->getCode(), $e->getMessage());
+        }
+    }
 }

lib/public/ISession.php

Indentation +58 added lines, -58 removed lines

@@ -45,69 +45,69 @@
  */
 interface ISession {
 
-	/**
-	 * Set a value in the session
-	 *
-	 * @param string $key
-	 * @param mixed $value
-	 * @since 6.0.0
-	 */
-	public function set(string $key, $value);
+    /**
+     * Set a value in the session
+     *
+     * @param string $key
+     * @param mixed $value
+     * @since 6.0.0
+     */
+    public function set(string $key, $value);
 
-	/**
-	 * Get a value from the session
-	 *
-	 * @param string $key
-	 * @return mixed should return null if $key does not exist
-	 * @since 6.0.0
-	 */
-	public function get(string $key);
+    /**
+     * Get a value from the session
+     *
+     * @param string $key
+     * @return mixed should return null if $key does not exist
+     * @since 6.0.0
+     */
+    public function get(string $key);
 
-	/**
-	 * Check if a named key exists in the session
-	 *
-	 * @param string $key
-	 * @return bool
-	 * @since 6.0.0
-	 */
-	public function exists(string $key): bool;
+    /**
+     * Check if a named key exists in the session
+     *
+     * @param string $key
+     * @return bool
+     * @since 6.0.0
+     */
+    public function exists(string $key): bool;
 
-	/**
-	 * Remove a $key/$value pair from the session
-	 *
-	 * @param string $key
-	 * @since 6.0.0
-	 */
-	public function remove(string $key);
+    /**
+     * Remove a $key/$value pair from the session
+     *
+     * @param string $key
+     * @since 6.0.0
+     */
+    public function remove(string $key);
 
-	/**
-	 * Reset and recreate the session
-	 * @since 6.0.0
-	 */
-	public function clear();
+    /**
+     * Reset and recreate the session
+     * @since 6.0.0
+     */
+    public function clear();
 
-	/**
-	 * Close the session and release the lock
-	 * @since 7.0.0
-	 */
-	public function close();
+    /**
+     * Close the session and release the lock
+     * @since 7.0.0
+     */
+    public function close();
 
-	/**
-	 * Wrapper around session_regenerate_id
-	 *
-	 * @param bool $deleteOldSession Whether to delete the old associated session file or not.
-	 * @param bool $updateToken Wheater to update the associated auth token
-	 * @return void
-	 * @since 9.0.0, $updateToken added in 14.0.0
-	 */
-	public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false);
+    /**
+     * Wrapper around session_regenerate_id
+     *
+     * @param bool $deleteOldSession Whether to delete the old associated session file or not.
+     * @param bool $updateToken Wheater to update the associated auth token
+     * @return void
+     * @since 9.0.0, $updateToken added in 14.0.0
+     */
+    public function regenerateId(bool $deleteOldSession = true, bool $updateToken = false);
 
-	/**
-	 * Wrapper around session_id
-	 *
-	 * @return string
-	 * @throws SessionNotAvailableException
-	 * @since 9.1.0
-	 */
-	public function getId(): string;
+    /**
+     * Wrapper around session_id
+     *
+     * @return string
+     * @throws SessionNotAvailableException
+     * @since 9.1.0
+     */
+    public function getId(): string;
 }