N°9909 - Fix setup token unexpectedly deleted during setup due to con… - #996
N°9909 - Fix setup token unexpectedly deleted during setup due to con…#996eespie wants to merge 1 commit into
Conversation
|
| Filename | Overview |
|---|---|
| setup/setuputils.class.inc.php | Adds an ownership check before deleting the shared setup token; no actionable regression was identified. |
Reviews (1): Last reviewed commit: "N°9909 - Fix setup token unexpectedly de..." | Re-trigger Greptile
There was a problem hiding this comment.
Pull request overview
Protects active setup tokens from deletion by non-owner sessions.
Changes:
- Validates session ownership before deleting the setup token.
- Moves session-token cleanup into the ownership branch.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if (self::IsSessionSetupTokenValid()) { | ||
| $sTokenFile = utils::GetDataPath().'setup/authent'; | ||
| if (is_file($sTokenFile)) { | ||
| unlink($sTokenFile); |
| if (self::IsSessionSetupTokenValid()) { | ||
| $sTokenFile = utils::GetDataPath().'setup/authent'; | ||
| if (is_file($sTokenFile)) { | ||
| unlink($sTokenFile); | ||
| } | ||
| Session::Unset('setup_token'); | ||
| } |
| $sTokenFile = utils::GetDataPath().'setup/authent'; | ||
| if (is_file($sTokenFile)) { | ||
| unlink($sTokenFile); | ||
| if (self::IsSessionSetupTokenValid()) { |
Avoid cleaning the setup token on disk if not owner