Use RFC-compliant URL encoding for cookies

[mziech]

PHP 7.4.2 changed the way how cookies are decoded, applying RFC-compliant raw URL decoding. This leads to a conflict Nextcloud's own cookie encoding, breaking the remember-me function if the UID contains a space character.

Fixes#24438

Signed-off-by: Marco Ziech marco@ziech.net

[kesselb]

I was observing the same behavior on my instance, essentially all users with a space in the name have to login twice after the session expired.

I tracked down the issue to a non-obvious change in PHP 7.4.2 and 7.4.3, which makes cookie encoding and decoding RFC compliant. See:

• https://bugs.php.net/bug.php?id=78929
• Fix #78929: Fix a cookie parsing value. Switch to a php_raw_url_decode() php/php-src#4989
• php/php-src@addc3c9

Basically PHP < 7.4.2 would encode Hans Peter as Hans+Peter and decode back to Hans Peter. However, PHP > 7.4.3 encode Hans Peter to Hans%20Peter and decode Hans+Peter to Hans+Peter leading to a clash in the expected UID.

php > echo(rawurldecode(urlencode('Hans Peter')));
Hans+Peter
php > echo(urldecode(rawurlencode('Hans Peter')));
Hans Peter
php > echo(urldecode(urlencode('Hans Peter')));
Hans Peter
php > echo(rawurldecode(rawurlencode('Hans Peter')));
Hans Peter

Since NextCloud uses its own cookie encoding function, the PHP 7.4.3 encoding fix won't work. I fixed the issue by changing urlencode to rawurlencode in https://github.com/nextcloud/server/blob/master/lib/private/Http/CookieHelper.php#L46

Originally posted by @mziech in #24438 (comment)

[rullzer]

O that is a nasty little change.
Thanks for the detailed explanation.

[ChristophWurst]

👍 so HP can use his Nextcloud again

[welcome]

Thanks for your first pull request and welcome to the community! Feel free to keep them coming! If you are looking for issues to tackle then have a look at this selection: https://github.com/nextcloud/server/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22

[ChristophWurst]

/backport to stable20

[ChristophWurst]

/backport to stable19