Validate cookie properly and prevent auth bypass

BIG (!) thanks to Julien CAYSSOL
14 years ago · 8ec45870a3
1 changed files with 1 additions and 1 deletions
--- a/lib/base.php
+++ b/lib/base.php
@ -489,7 +489,7 @@ class OC{
 		}
 		// confirm credentials in cookie
 		if(isset($_COOKIE['oc_token']) && OC_User::userExists($_COOKIE['oc_username']) &&
-		OC_Preferences::getValue($_COOKIE['oc_username'], "login", "token") == $_COOKIE['oc_token']) {
+		OC_Preferences::getValue($_COOKIE['oc_username'], "login", "token") === $_COOKIE['oc_token']) {
 			OC_User::setUserId($_COOKIE['oc_username']);
 			OC_Util::redirectToDefaultPage();
 		}