Skip to content

Commit

Permalink
fix(share): Ensure unique share tokens
Browse files Browse the repository at this point in the history
- check for token collisions and retry up to three times.
- throw after 3 attempts without finding a unique token.

Signed-off-by: ernolf <raphael.gradenwitz@googlemail.com>
  • Loading branch information
ernolf authored and nickvergessen committed Sep 25, 2024
1 parent cfb8f12 commit 0551919
Showing 1 changed file with 17 additions and 5 deletions.
22 changes: 17 additions & 5 deletions lib/private/Share20/Manager.php
Original file line number Diff line number Diff line change
Expand Up @@ -665,13 +665,25 @@ public function createShare(IShare $share) {
$this->linkCreateChecks($share);
$this->setLinkParent($share);

// For now ignore a set token.
$share->setToken(
$this->secureRandom->generate(
for ($i = 0; $i <= 3; $i++) {
$token = $this->secureRandom->generate(
\OC\Share\Constants::TOKEN_LENGTH,
\OCP\Security\ISecureRandom::CHAR_HUMAN_READABLE
)
);
);

try {
$this->getShareByToken($token);
} catch (\OCP\Share\Exceptions\ShareNotFound $e) {
// Set the unique token
$share->setToken($token);
break;
}

// Abort after 3 failed attempts
if ($i >= 3) {
throw new \Exception('Unable to generate a unique share token after 3 attempts.');
}
}

// Verify the expiration date
$share = $this->validateExpirationDateLink($share);
Expand Down

0 comments on commit 0551919

Please sign in to comment.