Merge pull request #1020 from nextcloud/backport/1014/stable19

[stable19] Harden check when using token from memcache

Author: juliusknorr

lib/Service/SessionService.php

@@ -152,7 +152,14 @@ public function getSession($documentId, $sessionId, $token) {
 
 		$data = $this->cache->get($token);
 		if ($data !== null) {
-			return Session::fromRow(json_decode($data, true));
+			$session = Session::fromRow(json_decode($data, true));
+			if ($session->getId() !== $sessionId || $session->getDocumentId() !== $documentId) {
+				$this->cache->remove($token);
+				$this->session = false;
+				return false;
+			}
+
+			return $session;
 		}
 
 		try {