From 00a11ebc33fcfd662cb7030472539a3bd15ef90b Mon Sep 17 00:00:00 2001
From: Kenneth Skovhede <kenneth@hexad.dk>
Date: Wed, 13 Aug 2014 22:44:51 +0200
Subject: [PATCH] Fixed the problem with logging in after a password has been
 applied

---
 .../HttpServerConnection.cs                   |  8 +++----
 .../Server/WebServer/AuthenticationHandler.cs | 23 ++++++++++++++-----
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/Duplicati/GUI/Duplicati.GUI.TrayIcon/HttpServerConnection.cs b/Duplicati/GUI/Duplicati.GUI.TrayIcon/HttpServerConnection.cs
index e4c1dba2d..72f2555ba 100644
--- a/Duplicati/GUI/Duplicati.GUI.TrayIcon/HttpServerConnection.cs
+++ b/Duplicati/GUI/Duplicati.GUI.TrayIcon/HttpServerConnection.cs
@@ -13,7 +13,7 @@ namespace Duplicati.GUI.TrayIcon
         private const string LOGIN_SCRIPT = "login.cgi";
         private const string STATUS_WINDOW = "index.html";
         private const string EDIT_WINDOW = "edit-window.html";
-        private const string AUTH_COOKIE = "session_auth";
+        private const string AUTH_COOKIE = "session-auth";
         
         private Uri m_controlUri;
         private string m_baseUri;
@@ -209,13 +209,13 @@ namespace Duplicati.GUI.TrayIcon
             req.UserAgent = "Duplicati TrayIcon Monitor, v" + System.Reflection.Assembly.GetExecutingAssembly().GetName().Version.ToString();
             if (req.CookieContainer == null)
                 req.CookieContainer = new System.Net.CookieContainer();
-            req.CookieContainer.Add(new System.Net.Cookie("session_nonce", nonce, "/", req.RequestUri.Host));
+            req.CookieContainer.Add(new System.Net.Cookie("session-nonce", nonce, "/", req.RequestUri.Host));
 
             //Wrap it all in async stuff
             Duplicati.Library.Utility.AsyncHttpRequest areq = new Library.Utility.AsyncHttpRequest(req);
             using(var r = (System.Net.HttpWebResponse)areq.GetResponse())
-            if (r.StatusCode == System.Net.HttpStatusCode.OK)
-                return r.Cookies["session_auth"].Value;
+                if (r.StatusCode == System.Net.HttpStatusCode.OK)
+                    return (r.Cookies[AUTH_COOKIE] ?? r.Cookies[Library.Utility.Uri.UrlEncode(AUTH_COOKIE)]).Value;
 
             return null;
         }
diff --git a/Duplicati/Server/WebServer/AuthenticationHandler.cs b/Duplicati/Server/WebServer/AuthenticationHandler.cs
index 0df43719a..9d29e9d40 100644
--- a/Duplicati/Server/WebServer/AuthenticationHandler.cs
+++ b/Duplicati/Server/WebServer/AuthenticationHandler.cs
@@ -25,8 +25,8 @@ namespace Duplicati.Server.WebServer
 {
     internal class AuthenticationHandler : HttpModule
     {
-        private const string AUTH_COOKIE_NAME = "session_auth";
-        private const string NONCE_COOKIE_NAME = "session_nonce";
+        private const string AUTH_COOKIE_NAME = "session-auth";
+        private const string NONCE_COOKIE_NAME = "session-nonce";
 
         private Dictionary<string, DateTime> m_activeTokens = new Dictionary<string, DateTime>();
         private Dictionary<string, Tuple<DateTime, string>> m_activeNonces = new Dictionary<string, Tuple<DateTime, string>>();
@@ -35,8 +35,12 @@ namespace Duplicati.Server.WebServer
         public override bool Process(HttpServer.IHttpRequest request, HttpServer.IHttpResponse response, HttpServer.Sessions.IHttpSession session)
         {
             HttpServer.HttpInput input = request.Method.ToUpper() == "POST" ? request.Form : request.QueryString;
-            var auth_token = request.Cookies[AUTH_COOKIE_NAME] == null || string.IsNullOrWhiteSpace(request.Cookies[AUTH_COOKIE_NAME].Value) ? null : request.Cookies[AUTH_COOKIE_NAME].Value;
-            if (input["auth-token"] != null && !string.IsNullOrWhiteSpace(input["auth-token"].Value))
+
+            var authcookie = request.Cookies[AUTH_COOKIE_NAME] ?? request.Cookies[Library.Utility.Uri.UrlEncode(AUTH_COOKIE_NAME)];
+            var authinput = input["auth-token"] ?? input[Library.Utility.Uri.UrlEncode("auth-token")];
+
+            var auth_token = authcookie == null || string.IsNullOrWhiteSpace(authcookie.Value) ? null : authcookie.Value;
+            if (authinput != null && !string.IsNullOrWhiteSpace(authinput.Value))
                 auth_token = input["auth-token"].Value;
 
             if (request.Uri.AbsolutePath == "/logout.cgi")
@@ -94,7 +98,7 @@ namespace Duplicati.Server.WebServer
                 {
                     if (input["password"] != null && !string.IsNullOrWhiteSpace(input["password"].Value))
                     {
-                        var nonce_el = request.Cookies[NONCE_COOKIE_NAME];
+                        var nonce_el = request.Cookies[NONCE_COOKIE_NAME] ?? request.Cookies[Library.Utility.Uri.UrlEncode(NONCE_COOKIE_NAME)];
                         var nonce = nonce_el == null || string.IsNullOrWhiteSpace(nonce_el.Value) ? "" : nonce_el.Value;
                         var urldecoded = nonce == null ? "" : Duplicati.Library.Utility.Uri.UrlDecode(nonce);
                         if (m_activeNonces.ContainsKey(urldecoded))
@@ -148,7 +152,14 @@ namespace Duplicati.Server.WebServer
             if (!string.IsNullOrWhiteSpace(auth_token))
             {
                 DateTime expires;
-                if (m_activeTokens.TryGetValue(auth_token, out expires) && DateTime.UtcNow < expires)
+                var found = m_activeTokens.TryGetValue(auth_token, out expires);
+                if (!found)
+                {
+                    auth_token = Duplicati.Library.Utility.Uri.UrlDecode(auth_token);
+                    found = m_activeTokens.TryGetValue(auth_token, out expires);
+                }
+
+                if (found && DateTime.UtcNow < expires)
                 {
                     expires = DateTime.UtcNow.AddHours(1);
                     m_activeTokens[auth_token] = expires;