From 7287ad54a83caf0ed7ad3ebe878f61843cde620a Mon Sep 17 00:00:00 2001
From: mostafa <mostafakhaki00@gmail.com>
Date: Thu, 6 Aug 2026 17:32:21 +0330
Subject: [PATCH] fix: don't set session user in getCurrentUserId

Reverts the setSessionUser() calls added in #1376.

IApacheBackend::getCurrentUserId() is called from the first line of
loginWithApache(), which guards its whole login block on the active
user not already being set. Setting the session user inside
getCurrentUserId() satisfies that guard before core reaches it, so the
entire block gets skipped: no oc_authtoken row, no remember-me cookie,
no filesystem setup, no login events.

The missing token row breaks any later request that reuses the
session cookie. Session::validateSession() looks up a token by session
id, finds none, and calls logout(), which strips the cookie and
returns a 401.

Confirmed independently against master and 8.11.0-dev: bearer request
then cookie-only request goes 200 then 401 with the calls in place,
200 then 200 with them removed. DAV also reaches this code through
apps/dav's own handleApacheAuth() call site, confirmed 207 both before
and after.

Signed-off-by: mostafa <mostafakhaki00@gmail.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 lib/User/Backend.php | 29 -----------------------------
 1 file changed, 29 deletions(-)

diff --git a/lib/User/Backend.php b/lib/User/Backend.php
index e06aee48..87d392b4 100644
--- a/lib/User/Backend.php
+++ b/lib/User/Backend.php
@@ -37,7 +37,6 @@
 use OCP\IURLGenerator;
 use OCP\IUser;
 use OCP\IUserManager;
-use OCP\IUserSession;
 use OCP\Server;
 use OCP\User\Backend\ABackend;
 use OCP\User\Backend\ICountUsersBackend;
@@ -369,12 +368,10 @@ public function getCurrentUserId(): string {
 							}
 
 							$this->session->set('last-password-confirm', $this->timeFactory->getTime() + 4 * 365 * 24 * 3600);
-							$this->setSessionUser($userId);
 							return $userId;
 						} elseif ($this->userExists($tokenUserId)) {
 							$this->checkFirstLogin($tokenUserId);
 							$this->session->set('last-password-confirm', $this->timeFactory->getTime() + 4 * 365 * 24 * 3600);
-							$this->setSessionUser($tokenUserId);
 							return $tokenUserId;
 						} else {
 							// check if the user exists locally
@@ -396,7 +393,6 @@ public function getCurrentUserId(): string {
 							}
 							$this->checkFirstLogin($tokenUserId);
 							$this->session->set('last-password-confirm', $this->timeFactory->getTime() + 4 * 365 * 24 * 3600);
-							$this->setSessionUser($tokenUserId);
 							return $tokenUserId;
 						}
 					}
@@ -417,31 +413,6 @@ private function isAcceptableUserId(mixed $userId): bool {
 		return is_string($userId) && $userId !== '' && trim($userId) !== '';
 	}
 
-	/**
-	 * Set the user in IUserSession after bearer token validation.
-	 * Without this, DI-injected $userId is null in OCS controllers
-	 * and CalDAV plugins, causing 500 errors in Deck, Talk, and Tasks.
-	 *
-	 * Note: IUserSession is resolved via Server::get() rather than constructor
-	 * injection to avoid a circular dependency (IUserSession depends on this Backend).
-	 */
-	private function setSessionUser(string $userId): void {
-		try {
-			$userSession = Server::get(IUserSession::class);
-			$currentUser = $userSession->getUser();
-
-			// Only fetch and set if the session doesn't already have this user
-			if ($currentUser === null || $currentUser->getUID() !== $userId) {
-				$user = $this->userManager->get($userId);
-				if ($user !== null) {
-					$userSession->setUser($user);
-				}
-			}
-		} catch (\Throwable $e) {
-			$this->logger->debug('Failed to set session user after bearer validation: ' . $e->getMessage());
-		}
-	}
-
 	/**
 	 *
 	 * Performs first-login initialisation (home folder setup, skeleton copy, events)