From b7c9ddc4e641c8c71b6680f2f5109676e7aa2be1 Mon Sep 17 00:00:00 2001
From: yuri <yurikuzn@users.noreply.github.com>
Date: Mon, 12 Aug 2019 10:56:11 +0300
Subject: [PATCH] auth token secret fixes

---
 application/Espo/Core/Utils/Auth.php | 34 ++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/application/Espo/Core/Utils/Auth.php b/application/Espo/Core/Utils/Auth.php
index 94340242a7..95813f82a9 100644
--- a/application/Espo/Core/Utils/Auth.php
+++ b/application/Espo/Core/Utils/Auth.php
@@ -144,6 +144,12 @@ class Auth
 
         $createTokenSecret = $this->request->headers->get('Espo-Authorization-Create-Token-Secret') === 'true';
 
+        if ($createTokenSecret) {
+            if ($this->getConfig()->get('authTokenSecretDisabled')) {
+                $createTokenSecret = false;
+            }
+        }
+
         if (!$isByTokenOnly) {
             $this->checkFailedAttemptsLimit($username);
         }
@@ -269,9 +275,8 @@ class Auth
 
                 if ($createTokenSecret) {
                     $secret = $this->generateToken();
-                    //$authToken->set('secret', $secret);
-
-                    setcookie('auth-token-secret', $secret, strtotime('+1000 days'), '/', '', false, true);
+                    $authToken->set('secret', $secret);
+                    $this->setSecretInCookie($secret);
                 }
 
                 if ($this->isPortal()) {
@@ -353,10 +358,16 @@ class Auth
 
     public function destroyAuthToken($token)
     {
-        $authToken = $this->getEntityManager()->getRepository('AuthToken')->select(['id', 'isActive'])->where(['token' => $token])->findOne();
+        $authToken = $this->getEntityManager()->getRepository('AuthToken')->select(['id', 'isActive', 'secret'])->where(['token' => $token])->findOne();
         if ($authToken) {
             $authToken->set('isActive', false);
             $this->getEntityManager()->saveEntity($authToken);
+            if ($authToken->get('secret')) {
+                $sentSecret = $_COOKIE['auth-token-secret'] ?? null;
+                if ($sentSecret === $authToken->get('secret')) {
+                    setcookie('auth-token-secret', null, -1, '/');
+                }
+            }
             return true;
         }
     }
@@ -398,4 +409,19 @@ class Auth
         $authLogRecord->set('denialReason', $denialReason);
         $this->getEntityManager()->saveEntity($authLogRecord);
     }
+
+    protected function setSecretInCookie(string $secret)
+    {
+        if (version_compare(\PHP_VERSION, '7.3.0') < 0) {
+            setcookie('auth-token-secret', $secret, strtotime('+1000 days'), '/', '', false, true);
+            return;
+        }
+
+        setcookie('auth-token-secret', $secret, [
+            'expires' => strtotime('+1000 days'),
+            'path' => '/',
+            'httponly' => true,
+            'samesite' => 'Lax',
+        ]);
+    }
 }