fix: Check rememberme cookie previous session id matches uid

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>

Author: come-nc

lib/private/User/Session.php

@@ -926,6 +926,26 @@ public function loginWithCookie($uid, $currentToken, $oldSessionId) {
 			]);
 			return false;
 		}
+
+		try {
+			$oldToken = $this->tokenProvider->getToken($oldSessionId);
+		} catch (InvalidTokenException $ex) {
+			$this->logger->error('Could not find the session token to renew', [
+				'app' => 'core',
+				'user' => $uid,
+				'exception' => $ex,
+			]);
+			return false;
+		}
+
+		if ($oldToken->getUID() !== $user->getUID()) {
+			$this->logger->warning('Tried to renew a session token belonging to a different user', [
+				'app' => 'core',
+				'user' => $uid,
+			]);
+			return false;
+		}
+
 		// replace successfully used token with a new one
 		$this->config->deleteUserValue($uid, 'login_token', $currentToken);
 		$newToken = $this->random->generate(32);

tests/lib/User/SessionTest.php

@@ -734,8 +734,14 @@ public function testRememberLoginValidToken() {
 			->with($oldSessionId, $sessionId)
 			->willReturn($tokenObject);
 
-		$this->tokenProvider->expects($this->never())
-			->method('getToken');
+		$oldTokenObject = $this->createMock(IToken::class);
+		$oldTokenObject->expects($this->once())
+			->method('getUID')
+			->willReturn('foo');
+
+		$this->tokenProvider->expects($this->once())
+			->method('getToken')
+			->willReturn($oldTokenObject);
 
 		$user->expects($this->any())
 			->method('getUID')
@@ -812,7 +818,16 @@ public function testRememberLoginInvalidSessionToken() {
 			->with($oldSessionId, $sessionId)
 			->will($this->throwException(new InvalidTokenException()));
 
-		$user->expects($this->never())
+		$oldTokenObject = $this->createMock(IToken::class);
+		$oldTokenObject->expects($this->once())
+			->method('getUID')
+			->willReturn('foo');
+
+		$this->tokenProvider->expects($this->once())
+			->method('getToken')
+			->willReturn($oldTokenObject);
+
+		$user->expects($this->once())
 			->method('getUID')
 			->willReturn('foo');
 		$userSession->expects($this->never())