Deal with garbage user_token values in the DB.

Change-Id: I92f1645d4a1cfc4151bd34b566ec3ac05eab427f

diff --git a/includes/User.php b/includes/User.php
index c9b8964..fca2032 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -980,10 +980,13 @@ class User {
                }
 
                if ( $request->getSessionData( 'wsToken' ) ) {
-                       $passwordCorrect = $proposedUser->getToken( false ) === $request->getSessionData( 'wsToken' );
+                       $passwordCorrect = ( $proposedUser->getToken( false ) === $request->getSessionData( 'wsToken' ) );
                        $from = 'session';
                } elseif ( $request->getCookie( 'Token' ) ) {
-                       $passwordCorrect = $proposedUser->getToken( false ) === $request->getCookie( 'Token' );
+                       # Get the token from DB/cache and clean it up to remove garbage padding.
+                       # This deals with historical problems with bugs and the default column value.
+                       $token = rtrim( $proposedUser->getToken( false ) ); // correct token
+                       $passwordCorrect = ( strlen( $token ) && $token === $request->getCookie( 'Token' ) );
                        $from = 'cookie';
                } else {
                        # No session or persistent login cookie