From 54859329efd41e87e367b24de020ba2875504d52 Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Thu, 6 Sep 2018 08:30:52 +0200 Subject: [PATCH] Do not invalidate main token on OAuth Fixes #10584 We deleted the main token when using the login flow else mutliple tokens would show up for a single user. However in the case of OAuth this is perfectly fine as the authentication happens really in your browser: 1. You are already logged in, no need to log you out 2. You are not logged in yet, but since you log in into the exact same browser the expected behavior is to stay logged in. Signed-off-by: Roeland Jago Douma --- core/Controller/ClientFlowLoginController.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/Controller/ClientFlowLoginController.php b/core/Controller/ClientFlowLoginController.php index c3b88f752db67..088a6a9869967 100644 --- a/core/Controller/ClientFlowLoginController.php +++ b/core/Controller/ClientFlowLoginController.php @@ -366,10 +366,10 @@ public function generateAppPassword($stateToken, $serverPath = $protocol . "://" . $this->request->getServerHost() . $serverPostfix; $redirectUri = 'nc://login/server:' . $serverPath . '&user:' . urlencode($loginName) . '&password:' . urlencode($token); - } - // Clear the token from the login here - $this->tokenProvider->invalidateToken($sessionId); + // Clear the token from the login here + $this->tokenProvider->invalidateToken($sessionId); + } return new Http\RedirectResponse($redirectUri); }