Force SessionHandler::$isACP to be false

This causes the ACP to reuse the frontend session. This improves the user
experience for enabled multi-factor authentication, because the ACP will no
longer require both the password *and* an additional MFA code when the user's
web browser is already authenticated in the frontend.

Additionally it will allow to simplify the whole session handling logic, due to
the future removal of several code branches.

This removal of the branches is not yet done to keep this commit simple.

As of right now the ACP will have reduced security compared to the situation in
5.3, because no passwords will be asked either. This will also be fixed in a
future commit by using the reauthentication framework.

diff --git a/com.woltlab.wcf/package.xml b/com.woltlab.wcf/package.xml
index f0c44823e75c5aef05ea027391062b5b1c9f23f8..c298504d93d5335e861cfdd3919c0104ef755060 100644 (file)
--- a/com.woltlab.wcf/package.xml
+++ b/com.woltlab.wcf/package.xml
@@ -69,6 +69,7 @@ tar cvf com.woltlab.wcf/files_pre.tar -C wcfsetup/install/files/ \
                <!-- Preparations for the new session system. -->
                <instruction type="script" run="standalone">acp/update_com.woltlab.wcf_5.4_session_1_cookies.php</instruction>
                <instruction type="script" run="standalone">acp/update_com.woltlab.wcf_5.4_session_2_user_session.php</instruction>
+               <!-- TODO: Copy the current ACP session into a frontend session. -->
                
                <!-- New application code. -->
                <instruction type="file" skipStyleUpdate="true" />

diff --git a/wcfsetup/install/files/acp/update_com.woltlab.wcf_5.4_session_1_cookies.php b/wcfsetup/install/files/acp/update_com.woltlab.wcf_5.4_session_1_cookies.php
index 1d57873337560c55e64056a0f4fd553e8297b558..50742a500d0c8b6eec4185115161fd9281f1ef9f 100644 (file)
--- a/wcfsetup/install/files/acp/update_com.woltlab.wcf_5.4_session_1_cookies.php
+++ b/wcfsetup/install/files/acp/update_com.woltlab.wcf_5.4_session_1_cookies.php
@@ -19,8 +19,8 @@ use wcf\util\HeaderUtil;
 
 // 1) Check whether the cookies are already in place.
 $hasValidSessionCookie = false;
-if (!empty($_COOKIE[COOKIE_PREFIX."acp_session"])) {
-       $cookieValue = CryptoUtil::getValueFromSignedString($_COOKIE[COOKIE_PREFIX."acp_session"]);
+if (!empty($_COOKIE[COOKIE_PREFIX."user_session"])) {
+       $cookieValue = CryptoUtil::getValueFromSignedString($_COOKIE[COOKIE_PREFIX."user_session"]);
        if ($cookieValue && \mb_strlen($cookieValue, '8bit') === 26) {
                $sessionID = \bin2hex(\mb_substr($cookieValue, 1, 20, '8bit'));
                if ($sessionID === WCF::getSession()->sessionID) {
@@ -43,7 +43,7 @@ if ($hasValidSessionCookie && $hasValidXsrfToken) {
 
 // 2) Set new session cookie.
 HeaderUtil::setCookie(
-       "acp_session",
+       "user_session",
        CryptoUtil::createSignedString(
                \pack(
                        'CA20CN',

diff --git a/wcfsetup/install/files/lib/system/session/SessionHandler.class.php b/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
index 14b87424860593c74bd964ee781d5f0b436385c9..435546321c5154db305d1cb70eec78973a1d348b 100644 (file)
--- a/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
+++ b/wcfsetup/install/files/lib/system/session/SessionHandler.class.php
@@ -18,7 +18,6 @@ use wcf\system\request\RouteHandler;
 use wcf\system\user\storage\UserStorageHandler;
 use wcf\system\SingletonFactory;
 use wcf\system\WCF;
-use wcf\system\WCFACP;
 use wcf\util\CryptoUtil;
 use wcf\util\HeaderUtil;
 use wcf\util\UserUtil;
@@ -186,7 +185,7 @@ final class SessionHandler extends SingletonFactory {
         * @inheritDoc
         */
        protected function init() {
-               $this->isACP = (class_exists(WCFACP::class, false) || !PACKAGE_ID);
+               $this->isACP = false;
                $this->usersOnlyPermissions = UserGroupOptionCacheBuilder::getInstance()->getData([], 'usersOnlyOptions');
        }