upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 25

fix(initializeSession): only log HMAC problem to critical logs if indeed critical

Browse source 
Signed-off-by: Simon L. <szaimen@e.mail.de>
This commit is contained in:
Simon L. 2026-03-16 11:54:10 +01:00 committed by backportbot[bot]
parent ee1a7d633f
commit 0d2229b518
2 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/private/Security/Crypto.php
View file

@ -159,7 +159,7 @@ class Crypto implements ICrypto {
}
} else {
if (!hash_equals($this->calculateHMAC($parts[0] . $parts[1], $hmacKey), $hmac)) {
throw new Exception('HMAC does not match.');
throw new \RuntimeException('HMAC does not match.');
}
}

9
lib/private/Session/CryptoSessionData.php
View file

@ -72,6 +72,15 @@ class CryptoSessionData implements \ArrayAccess, ISession {
512,
JSON_THROW_ON_ERROR,
);
} catch (\RuntimeException $e) {
// Even though this might be critical in general, we are automatically trying again and will likely succeed.
// We only log to info to not spam the logs with a well-known problem the admin cannot do anything about.
// See https://github.com/nextcloud/server/issues/42157
logger('core')->info('Could not decrypt or decode encrypted session data', [
'exception' => $e,
]);
$this->sessionValues = [];
$this->regenerateId(true, false);
} catch (\Exception $e) {
logger('core')->critical('Could not decrypt or decode encrypted session data', [
'exception' => $e,