From 34c116f70c399bfbd302895f66335b6415684f30 Mon Sep 17 00:00:00 2001 From: Maksim Sukharev Date: Thu, 27 Aug 2026 14:39:10 +0200 Subject: [PATCH] fix(TalkSession): fall back to known tabId for requests without header - img GET requests can't set the header, so they fail on that middleware if e.g. guest tabId can't be identified - avatar endpoint locked for guests - harden checks for matching $token . '$' . $tabId Assisted-by: ClaudeCode:claude-opus-5 Signed-off-by: Maksim Sukharev --- lib/TalkSession.php | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/lib/TalkSession.php b/lib/TalkSession.php index 2c26cc7bca7..6887d556287 100644 --- a/lib/TalkSession.php +++ b/lib/TalkSession.php @@ -113,9 +113,23 @@ protected function getValues(string $key): array { } protected function getValue(string $key, string $token, bool $useTabId = true): ?string { - $token .= $useTabId ? $this->getTabId() : ''; $values = $this->getValues($key); - return $values[$token] ?? null; + $tabId = $useTabId ? $this->getTabId() : ''; + + if ($tabId !== '') { + return $values[$token . $tabId] ?? null; + } + + // Requests without the tab id header (e.g. an tag) can not tell the + // tabs apart, so fall back to any value stored for the token + foreach ($values as $tokenKey => $value) { + $tokenKey = (string)$tokenKey; + if ($tokenKey === $token || str_starts_with($tokenKey, $token . self::TAB_ID_SEPARATOR)) { + return $value; + } + } + + return null; } protected function setValue(string $key, string $token, string $value, bool $useTabId = true): void { @@ -142,7 +156,7 @@ protected function removeValue(string $key, string $token, bool $useTabId = true // This request does not support tabId, so we need to destroy all related data foreach ($values as $tokenKey => $value) { $tokenKey = (string)$tokenKey; - if (str_starts_with($tokenKey, $token)) { + if ($tokenKey === $token || str_starts_with($tokenKey, $token . self::TAB_ID_SEPARATOR)) { unset($values[$tokenKey]); } }