From 96b66e330b9a592093799a50219c8118de6951eb Mon Sep 17 00:00:00 2001
From: leonklingele <5585491+leonklingele@users.noreply.github.com>
Date: Sat, 6 Jul 2019 17:47:09 +0200
Subject: [PATCH] routers/user: ensure that decryption of cookie actually
 suceeds (#7363)

Previously, only the first return value of ctx.GetSuperSecureCookie
was used to check whether decryption of the auth cookie succeeded.
ctx.GetSuperSecureCookie also returns a second value, a boolean,
indicating success or not. That value should be checked first to
be on the safe side and not rely on internal logic of the encryption
and decryption blackbox.
---
 routers/user/auth.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/routers/user/auth.go b/routers/user/auth.go
index 0731e34675..576f630577 100644
--- a/routers/user/auth.go
+++ b/routers/user/auth.go
@@ -71,8 +71,8 @@ func AutoSignIn(ctx *context.Context) (bool, error) {
 		return false, nil
 	}
 
-	if val, _ := ctx.GetSuperSecureCookie(
-		base.EncodeMD5(u.Rands+u.Passwd), setting.CookieRememberName); val != u.Name {
+	if val, ok := ctx.GetSuperSecureCookie(
+		base.EncodeMD5(u.Rands+u.Passwd), setting.CookieRememberName); !ok || val != u.Name {
 		return false, nil
 	}